Privacy Policy
This explains what CS2 Services collects, why, how long we keep it and how to get it removed. It is written to match what the system actually stores rather than to cover us for things we do not do.
On this page
What we never collect
We do not use advertising trackers, remarketing pixels or a chat widget, and nothing here is ever sold or passed to a data broker.
We do use Google Analytics to see which pages people find useful. Whether it is on before you choose depends on where you are, and we would rather spell that out than be vague about it:
- In the EEA, the UK and Switzerland — it stays switched off until you accept the banner. Decline it, or simply ignore it, and no analytics cookie is written and your visit is not measured.
- Everywhere else — it is on when you arrive, and the banner is there to switch it off. Press Decline and it stops, on that visit and every later one.
Either way the choice is yours, it is remembered, and the site behaves exactly the same whichever you pick. We set no advertising cookies anywhere in the world, for anyone, consented or not.
If you do accept, Google receives the pages you viewed, roughly where you are from your IP address (country or city, never the precise address), and your browser and device type. It never receives your email address, your SteamID, your Discord account, your order history or anything you typed into this site. To change your mind, clear this site's data in your browser and the banner will ask again.
What we do collect
Depending on how you use the service, that is:
If you only take the free commends, that is a Discord ID, a SteamID64, an IP address and the order itself. No email address, and no password.
Why we hold it
- To deliver what you asked for. The SteamID64 is the destination; without it there is no service.
- To keep the free trial to one per person. The Discord ID and the target profile are what make "once" mean once.
- To stop abuse. IP addresses drive the rate limits that keep the pool from being drained.
- To answer you. Order history is what lets us tell you what happened when something goes wrong.
- To keep ourselves honest. Staff actions on your account are recorded, including who did them.
We do not sell any of it, and we do not use it for advertising.
Cookies and local storage
Everything below is set by this site, with one exception: the Google Analytics cookies, which appear only after you accept the banner.
cs_sessionSigned-in session for website accounts. Expires after 30 days, or when you sign out.cs_freeRemembers which half-finished free-trial attempt this browser belongs to. Expires after 7 days. It is not an identity and grants nothing on its own.langYour chosen language. Stored in the browser, never sent to us.promo_dismissedWhich announcement banner you closed. Stored in the browser, never sent to us.cs2_consentWhether you accepted or declined analytics. Stored in the browser so we stop asking. Removing it makes the banner reappear._ga, _ga_*Google Analytics. Set only if you accept, and never before. They distinguish one browser from another so a return visit is not counted as a new person. Expire after two years.
The first two are strictly necessary for the service to work. lang,
promo_dismissed and cs2_consent live in your browser's
local storage and never reach our server; clearing your browser data removes
them. The Google Analytics cookies are the only third-party ones, they are
never set without your agreement, and declining costs you nothing.
Who else sees it
We share personal data with nobody, with four narrow exceptions:
- Discord. When you verify, our bot sees your Discord ID and username, because that is how verification works. Discord's own privacy policy governs what they do with your use of Discord.
- Our hosting and delivery infrastructure. The server that delivers your commends receives the SteamID64 it is delivering to. It is ours, not a third party's.
- Google Analytics, and only if you accepted the banner. Google receives which pages you viewed, an approximate location and your device type — never your account, your SteamID or your orders. If you declined, Google receives nothing at all.
- The law. If we are legally required to disclose something, we will.
Payments are arranged directly with you and handled by whatever method you choose. We do not operate a checkout and never see or store card details.
How it is protected
- The site is served over HTTPS.
- Passwords are hashed with bcrypt. They are never stored in a readable form.
- Every database query is a prepared statement, so data cannot be extracted by manipulating an input.
- Credentials for our own pool accounts are encrypted at rest with AES-256-GCM, with the key held outside the web root and never in the database. No page can return them.
- Staff access is role-based, and every action a staff member takes on an account is recorded with their name against it.
No system is perfectly secure, and we will not claim otherwise. What we can say is that a copy of our database on its own does not give up passwords or account credentials.
How long we keep it
Your rights
Depending on where you live you may have the right to see the data we hold about you, correct it, have it deleted, or object to how we use it. You can exercise any of these by opening a ticket in our Discord — we do not require a particular form of words.
One honest limit. If you ask us to delete your account, we will, but we keep the record that a free trial was claimed against your Discord ID and Steam profile. Removing it would let the same person take the free offer again, which is the one thing that record exists to prevent. It holds no email address, no password and no order detail.
Children
This service is not intended for anyone under 18, and we do not knowingly hold data about children. If you believe we have, tell us and we will remove it.
Changes
We may update this policy. The date at the top is when it last changed, and this page always shows the current version. If a change means we start collecting something new, we will say so in our Discord.
Contact
Reach us in our Discord server. You can also email contact@cs2services.com.
This policy is written and published in English. Any translation is provided for convenience; the English text is the one that applies.