Effective 13 October 2026

Privacy Policy

We collect only what's needed to run your Portfolio. No ads, no analytics, no tracking, and we never sell data.

1. 01As a guest

   Your Portfolio and preferences are stored only in your browser's local storage. To price your items, the app sends their market names (not who you are) to our server. Clearing site data deletes the guest Portfolio.

2. 02With an account

   We store, on Cloudflare D1:

   • your email address and a salted hash of your password;
   • your positions, notes, preferences and tracked Steam profiles;
   • inventory snapshots of tracked profiles, so a later sync can show what changed;
   • active sessions with their IP address and browser user agent.

3. 03Cookies

   Signed-in users get a session cookie that is strictly necessary to keep them signed in. We set no advertising or analytics cookies.

4. 04Third parties

   The app runs on Cloudflare, which processes requests and IP addresses to deliver and protect it. Our server fetches public inventories from Steam when you import or sync, and prices from Steam, Skinport and CSFloat; none of your personal data is sent to them. Item images load from Steam's image servers, so your browser contacts Steam directly.

5. 05Security & abuse protection

   Passwords are hashed with PBKDF2 and never stored in plain text. Account requests are rate-limited per IP address, so we keep a small counter per address: the IP, a request count and the time of the last request.

6. 06Your rights

   You can export everything you entered as JSON or CSV, and deleting your account on the Account page immediately and permanently removes your account, Portfolio, tracked profiles and sessions. Shared, anonymous price history is not personal data and is kept.

7. 07Changes

   If this policy changes, we'll update the effective date above. Material changes will be noted in the app.

Questions or feedback? Email contact@csportfolio.net. See also the Terms of Service.