01 · CONTROLLER
Who Controls Your Data
CS2FreeForAll is an independent community project operated from Romania by
Stănică Cristian, who acts as the data controller for personal data
processed directly by the platform.
Privacy and data-protection requests should normally be submitted through the
CS2FFA Contact page while signed in with the Steam account
connected to the data, so we can verify that the request concerns the correct account.
If you cannot sign in or cannot access the Contact page, you may use
[email protected] as a fallback privacy contact.
02 · DATA CATEGORIES
What Personal Data We Process
Most information processed by CS2FreeForAll is ordinary platform data such as
your SteamID, Steam display name, avatar, playtime, rewards and service status.
Some Steam profile information may already be publicly available through Steam,
but CS2FFA still processes it as part of your platform account and related services.
CS2FFA primarily identifies users through their Steam account rather than through real-world identity information. We generally do not require a legal name, postal address, telephone number or government identification to use the normal CS2FFA account and game-server services. A SteamID is nevertheless treated as personal data because it can distinguish a particular Steam account and link activity, rewards, support or service records to that account. A SteamID may therefore be pseudonymous from CS2FFA's perspective, but it is not treated as anonymous data.
Steam accountSteamID, Steam display name, avatar and account-related identifiers.
Trade informationSteam trade URL and information required to validate reward delivery eligibility.
GameplayPlaytime/session records, validations, eligibility, server activity and reward participation.
RewardsWinner records, item/reward information, claim status, trade/delivery identifiers and delivery attempts.
PurchasesPayment ID, provider, amount, product, status, provider reference and related transaction information.
SubscriptionsReserved Slot, Auto-Validation, Supporter/VIP activation and expiry information.
SupportTicket category, subject, messages, timestamps and the SteamID attached to the ticket.
Email correspondenceIf you use the fallback privacy email address, we process the sender email address, message content and related correspondence only as needed to handle the request.
SecurityIP address where needed for security/rate limiting, session identifiers, ToS acceptance metadata and anti-abuse information.
We do not ask for or store your Steam password. Do not send passwords, API keys, authentication codes, recovery codes or other secrets through support tickets.
03 · SOURCES
Where Your Data Comes From
- Steam: authentication identity and publicly available profile information returned through Steam authentication/API services.
- You: trade URL, support-ticket content, fallback email correspondence where used, and actions you perform on CS2FFA.
- CS2FFA game servers and platform: playtime, validation, eligibility, service status, reward and account activity.
- Payment providers: payment references, status updates and transaction information required to confirm a purchase or donation.
- Reward provider: reward-delivery identifiers, status updates and Steam trade information needed to complete a reward claim.
04 · PURPOSES
Why We Process Data & Our Legal Bases
Provide your account and requested servicesTo authenticate you, show account status, validate playtime, manage subscriptions, process purchases and deliver rewards. Legal basis: performance of a contract or steps requested by you before entering into one.
Operate free community systemsTo run drop eligibility, Happy Hour rewards, rankings, supporter/donor recognition and related platform functionality. Legal basis: legitimate interests in operating the CS2FFA community and, where a paid service is involved, performance of a contract.
Security and abuse preventionTo rate-limit requests, validate account/trade details, detect fraud, prevent duplicate or manipulated claims, investigate abuse and protect the platform. Legal basis: legitimate interests in security, fraud prevention and service integrity.
Support, privacy requests and dispute handlingTo answer support and privacy/data-protection requests, investigate bugs/payments/rewards and keep an auditable history where needed. Legal basis: performance of a contract, compliance with applicable data-protection obligations and/or legitimate interests in customer support and dispute resolution.
Legal complianceTo keep or disclose information where required by applicable law or a legally binding request. Legal basis: compliance with legal obligations and, where relevant, establishment, exercise or defence of legal claims.
Information required to provide a service. Public pages can generally be viewed without signing in and without providing Steam account information to CS2FFA. Public browsing may still involve limited technical data and temporary browser/server-side information needed for site operation, security and the live visitor-presence feature, as described elsewhere in this Policy. Steam authentication and a SteamID are required only for authenticated account features and Steam-linked services. A Steam trade URL is optional for ordinary account use and may be skipped; it is required only when a feature that needs Steam trading or reward delivery is used, such as claiming an eligible reward. Payment-related information is processed only if you choose to make a purchase or donation, and support or fallback-email information is processed only if you choose to contact us. If information required for a particular feature is not provided, CS2FFA may be unable to provide that specific feature, while unrelated features may remain available.
Automated processing. CS2FFA uses automated rules to operate certain platform features, including playtime calculations, reward eligibility and selection, service activation and expiry, anti-abuse controls and similar operational processes. These rules are based on defined platform criteria rather than automated profiling intended to evaluate personal characteristics. CS2FFA does not currently use solely automated decision-making that is intended to produce legal effects or similarly significant effects on users within the meaning of Article 22 GDPR. If an automated result appears incorrect or is disputed, users may contact CS2FFA through the support system so the relevant account, reward, eligibility or service record can be reviewed.
Age requirement. CS2FFA account services are intended for users aged 18 or older. Authenticated users are required to confirm that they are at least 18 years old and accept the Terms of Service before continuing to use account services. This is particularly relevant because authenticated areas may display sponsored links to independent third-party services that may include case-opening, wagering or other gambling-style features. CS2FFA does not host those third-party services. Users are shown an additional notice before following a sponsored external link and are responsible for ensuring that use of the external service is lawful and age-appropriate in their jurisdiction.
05 · STEAM
Steam Authentication & Trade Information
CS2FFA redirects you to Steam for authentication. Steam handles your login credentials directly. After successful authentication, CS2FFA may receive and store your SteamID, display name and avatar to identify your account.
If you save a Steam trade URL, CS2FFA associates it with your Steam account. The platform may validate ownership/format and may check relevant Steam account conditions needed for trading or reward delivery, such as trade restrictions, profile/inventory availability or other delivery requirements.
Steam is an independent third party and processes information under its own terms and privacy practices.
06 · GAMEPLAY
Playtime, Eligibility, Happy Hour & Rewards
CS2FFA processes gameplay-linked records to calculate playtime, validations and eligibility for daily, weekly and monthly rewards and to operate in-server systems such as Happy Hour prizes.
When a reward is won or claimed, CS2FFA may store the winner's Steam identifier, reward/item, estimated or recorded prize value, draw date, claim deadline, claim status, provider/trade identifiers and delivery status. These records are used to operate the reward system, prevent duplicate claims, support retries where allowed and maintain an auditable reward history.
Public pages may display limited winner/supporter/donor information linked to a Steam identity where the feature is designed to be public. We do not intentionally publish Steam passwords, session tokens, private payment credentials or other authentication secrets.
CS2FFA also stores gameplay session history in its database, including the player's SteamID and session join/disconnect timestamps, so playtime and related service history can be calculated and verified. These database records are separate from ordinary rotating server log files.
07 · PAYMENTS
NOWPayments, PayBy.Skin & AssetPay
CS2FFA uses separate providers for different purposes:
NOWPaymentsCrypto payment processing for supported purchases and donations.
PayBy.SkinSteam-skin payment processing for supported purchases and donations.
AssetPayCore reward sourcing and delivery for eligible reward claims.
CS2FFA may send these providers the minimum information needed to create, identify or complete the relevant transaction or reward delivery, such as an internal/payment reference, product type, amount, Steam-linked reference or trade URL where required.
Providers return status information to CS2FFA, which may include provider payment/trade identifiers, payment status, transaction hash for crypto payments, Steam trade references or reward-delivery status. CS2FFA does not receive your private Steam login credentials from these providers.
Each provider is responsible for its own independent processing under its privacy policy and terms. Depending on provider infrastructure and subcontractors, some data may be processed from locations outside the European Economic Area. Where applicable, such processing is subject to the safeguards and international-transfer mechanisms required by applicable data-protection law and by the relevant provider's privacy terms. CS2FFA does not state that a particular transfer mechanism or destination country applies unless that information has been verified for the relevant provider.
08 · SUPPORT
Support Tickets
Support is linked to your authenticated Steam account. A support ticket may contain your SteamID, category, optional subject, message history, ticket status, timestamps and staff responses.
Authorized support staff may access tickets as necessary to answer requests, investigate payment/reward issues, resolve bugs and enforce platform rules. Ticket access is permission-based.
Please include only information necessary to explain the issue. Do not submit passwords, API keys, wallet seed phrases, authentication codes or other secrets.
09 · TECHNICAL
Technical, Security & Presence Data
CS2FFA may process an IP address and request metadata for rate limiting, abuse prevention, security checks and legal/security investigation where necessary. ToS acceptance may also be recorded with information such as the accepted version, IP address and browser user-agent so acceptance can be audited.
CS2FFA game servers and related infrastructure create operational and security logs that may contain SteamID, Steam display name, IP address, network connection information, connection and disconnection timestamps, server events and moderation/security events. This means CS2FFA can normally associate a server connection with the Steam account and IP address used for that connection. These logs are used for server operation, troubleshooting, abuse prevention, moderation, fraud/security investigation and protection of the service. Ordinary rotating server logs are retained for 30 days; records isolated for a specific incident, moderation case, fraud/abuse investigation, dispute or legal claim may be retained longer where reasonably necessary for that purpose.
The website also maintains a temporary site-presence identifier used to estimate how many visitors are currently online. The server-side presence entry expires after a short inactivity period and is not intended to create a long-term browsing profile.
Sensitive authenticated API responses are configured not to be cached by browsers/proxies where appropriate.
10 · BROWSER STORAGE
Cookies & Local Storage
CS2FFA uses browser storage needed for login, security and site functionality. Current examples include:
- Access/session cookie: keeps you authenticated. The corresponding server-side web session is designed to expire after 7 days.
- CSRF security token: protects state-changing requests against cross-site request forgery.
- Cookie-notice preference: remembers that the browser has acknowledged the site notice.
- Site visitor ID: a browser-generated identifier used for the live visitor count/presence heartbeat.
- Interface/sponsor preferences: local flags used to remember certain site choices where enabled.
CS2FFA does not currently use third-party analytics or advertising-tracking technologies on the website. If optional analytics, advertising tracking or other non-essential technologies are introduced, this Privacy Policy and any required notice or consent controls will be updated before those technologies are activated where applicable.
11 · RECIPIENTS
Who We Share Data With
CS2FFA does not sell your personal data. Data may be disclosed only where needed for the platform or as legally required, including to:
- Steam, where interaction with Steam is required for authentication, profile checks or trade functionality.
- NOWPayments and PayBy.Skin for the payment methods you choose.
- AssetPay for reward sourcing/delivery and reward-trade status handling.
- Hosting, infrastructure, security and email-service providers that process data on behalf of the platform where applicable. If the fallback email channel is used, the email provider used to route or store that correspondence may process the sender address and message content.
- Authorized CS2FFA support/administrative staff on a need-to-access basis.
- Courts, regulators, law-enforcement or other competent authorities where disclosure is required by a valid legal obligation or legally binding request.
12 · RETENTION
How Long We Keep Data
CS2FFA uses defined retention periods for the main categories of account, gameplay, security, support, reward and payment data. Automated cleanup jobs remove or anonymize records when their retention period ends. A record may be preserved longer where reasonably necessary for an active security or abuse investigation, moderation case, unresolved payment or reward dispute, fraud prevention, a legal obligation, or the establishment, exercise or defence of legal claims.
Web sessionsAuthentication sessions are designed to expire after 7 days. Expired server-side session records are automatically cleaned after expiry and may remain in the database for up to a further 7 days before housekeeping removes them.
Live site presenceThe temporary server-side presence entry used for the live visitor count is removed after roughly 75 seconds without a heartbeat.
Validation anti-abuse IPIP addresses stored specifically to prevent repeated playtime validation from the same IP are cleared after the validation day has ended, normally within 24 hours.
ToS acceptance metadataThe IP address and browser user-agent stored with a Terms of Service acceptance are automatically cleared after approximately 24 hours. The SteamID, accepted ToS version and acceptance timestamp may be retained as the acceptance record for as long as needed to demonstrate acceptance and, where applicable, for a reasonable period after the account relationship ends.
Game/server logs & connection IPOrdinary CounterStrikeSharp/game-server and infrastructure logs, including SteamID, display name, IP address, network connection information, connection/disconnection timestamps and server events, are retained for 30 days and then automatically deleted. Logs isolated for a specific incident, moderation case, fraud/abuse investigation, dispute or legal claim may be retained longer where reasonably necessary for that purpose.
Gameplay/session database historyDatabase records used for playtime and service history, including SteamID and session join/disconnect information, are kept for the current calendar month plus the two previous full months, then removed from the active session-history dataset unless a specific record must be retained longer for an applicable exception.
Procedure/audit logsOrdinary database procedure-call and procedure-execution audit records are kept for the current calendar month plus the previous full month. Short-lived IP fields used within these records may be cleared sooner under the security-metadata rules above.
Current subscriptions & entitlementsCurrent Reserved Slot, Auto-Validation and Supporter/VIP status records are removed from the active-state tables after expiry once the corresponding history record exists. Historical entitlement/subscription records are retained for approximately 12 months.
Reward historyCompleted, failed, declined or expired reward/winner records are retained for approximately 12 months after the reward date, provided they are no longer actively processing. Pending or actively processing claims are not removed by the ordinary historical purge.
Processed payment-provider webhook eventsProcessed PayBy.Skin webhook-event records are retained for approximately 12 months. Unprocessed events are preserved until they are resolved.
Expired site bansExpired finite site-ban records are retained for approximately 12 months after the ban ends. Active and permanent bans are not removed by the ordinary historical purge.
Support ticketsClosed support tickets and their messages are retained for approximately 12 months after closure. Open tickets remain available while the case is active.
Privacy/contact email correspondenceFallback email correspondence is retained only for as long as reasonably needed to handle the request, verify what was requested or answered, resolve a dispute, or comply with an applicable legal obligation, and may then be deleted manually.
Failed or unfinished paymentsFailed, expired or unfinished payment records that no longer require resolution are normally retained for the current calendar month plus the two previous full months. Pending or otherwise unresolved payments are kept until they are resolved.
Completed/refunded payment recordsCompleted or refunded payment records may be retained for approximately 5 years for transaction reconciliation, accounting, fraud prevention, provider disputes and legal-claim purposes. Records tied to an active or permanent reversal restriction may be preserved while that restriction remains relevant.
Payment entitlements & reversal historyPayment-entitlement records and expired historical payment-reversal restriction records are retained for approximately 5 years. A permanent reversal restriction is retained while it remains in force.
Steam account/profile dataSteam-linked account information needed to operate the account and services is retained while the account or related service relationship remains active or while dependencies require the record. Inactive account data is reviewed against service, payment, reward, support, security and legal dependencies before deletion.
Calendar-based database retention is enforced by scheduled housekeeping. The main historical purge normally runs on the first day of each month, with a fallback run on the second day if the first run did not complete successfully. Because some long-term periods are enforced by a monthly purge, a record may remain until the next scheduled purge after its nominal retention period expires.
13 · YOUR RIGHTS
Your GDPR Rights
Where the GDPR applies, you may have the right to:
Access your personal data
Correct inaccurate data
Request deletion where applicable
Restrict processing in certain cases
Object to processing based on legitimate interests
Receive/transfer certain data where portability applies
Withdraw consent where processing relies on consent
Complain to a supervisory authority
These rights are not absolute. For example, deletion may not apply where information must be retained to comply with a legal obligation, prevent fraud, resolve a dispute or establish, exercise or defend legal claims.
To exercise a right, signed-in users should normally use /contact so the request can be linked to and verified against the relevant Steam account. If you cannot sign in or cannot access the Contact page, use [email protected]. We may need additional information to verify that the request concerns the correct account before disclosing or changing account data.
We aim to respond to valid data-protection requests without undue delay and normally within one month of receiving the request. Where permitted by applicable data-protection law, this period may be extended for particularly complex requests or multiple requests; if an extension is required, we will inform you as required by law.
14 · SECURITY
Security, Abuse Prevention & Lawful Requests
CS2FFA uses technical and organizational measures intended to reduce unauthorized access, account/session abuse and fraudulent activity. Current technical measures include server-side session records with hashed access tokens, CSRF protection, restricted cross-origin access, rate limiting and no-cache handling for sensitive authenticated endpoints.
No online system can guarantee absolute security. Users should protect their Steam account, device, browser session and trade credentials and should never send authentication secrets to CS2FFA staff.
CS2FFA may preserve or disclose relevant information where reasonably necessary to comply with applicable law, a valid court order or another legally binding request from a competent authority; to investigate fraud or security incidents; to enforce the Terms of Service; or to establish, exercise or defend legal claims.
15 · CONTACT
Privacy Requests & Complaints
For privacy questions or requests, signed-in users should normally use the CS2FFA Contact page and clearly state that the request concerns privacy/data protection. This is the preferred method because the request is already linked to the relevant Steam account.
If you cannot sign in or cannot access the Contact page, you may contact [email protected]. If you use email, your email address and message content are processed only as needed to handle the request and related follow-up.
If you believe your personal data has been processed in violation of applicable data-protection law, you have the right to lodge a complaint with the competent supervisory authority. In Romania, this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).
