Privacy

Short version: no tracking cookies, no ad trackers, and signing in is optional. We count page views without identifying you.

Who is responsible

Autobot Inc.
Contact: contact.pingchwi@gmail.com

What we collect

Page views. When a page opens, your browser sends the page path, the site that referred you (its host name only), the size class of your screen (for example "phone" or "desktop") and whether you use the light or dark theme. We store each view with these, your country as reported by our network provider, and the kind of device and browser (never the full user-agent), plus daily totals per page and per referring site. View records are deleted after 35 days.
An anonymous daily visitor count. To count visitors without tracking them, our server computes a one-way hash from your IP address, your browser's user-agent and a secret that changes every day. The hash cannot be reversed, cannot be linked from one day to the next, and is deleted after two days; the views of that day then keep only a random label, made from nothing about you, so that one visit still counts as one visit. Your IP address and user-agent are never stored.
How the site is used and how fast it is. While a page is open, it counts how long it was visible, how far it was scrolled, how many clicks or key presses it got, how fast it loaded and responded (the standard web speed measures), any error in its scripts (the message and the file), and the use of its tools, for example that a trade-up contract was evaluated or which filter was picked. What you type is never sent, with one exception: a search made in the site's search box, kept for 35 days and only to improve search results. These records carry the same daily hash as page views and nothing else.
Returning visits. Your browser keeps one date in its local storage: the day you last visited. It tells us how many days ago that was (for example "3"), which lets us count unique visitors per week and month without any identifier. It never contains an identifier, starts over after 13 months, and is not used when your browser sends Global Privacy Control or Do Not Track.
Outbound clicks. When you follow a marketplace or sponsor link we record which marketplace, which page and your country as reported by our network provider. No identifier is attached.
If you sign in with Steam. Steam tells us your public Steam ID; nothing else, and never your password or e-mail address. We then read your public Steam profile: your name, avatar, profile link and, only if your profile shows it, your country. We store these with the times you signed in and were last active, how many pages you opened while signed in, the kind of device, your country as reported by our network provider, and how your visit that day began (for example a search engine or a link) when our anonymous page-view count for that day shows it. See Signing in.
The browser check. To keep automated scrapers off the site, a visitor may be asked once a day to let their browser prove it is not one: it solves a small puzzle, or completes a Cloudflare Turnstile check shown in a frame from Cloudflare. We keep no record of it; the result is one cookie in your browser (see the cookie policy).
Your inventory, if you open the Inventory page while signed in. We read your Steam inventory the way anyone can read a public one, to price your items. Our server keeps that copy in its memory only, for at most 30 minutes, so the page can show it again without asking Steam; it is never written to disk, never logged and never shared. We only count how many inventories are read, without saying whose. See Your inventory.
Messages you send us through the contact form: what you typed, kept until your request is handled.
Server and security logs kept by our hosting and network providers for security and abuse prevention, for a limited time.

What we do not do

No tracking cookies. Our only cookies are the browser check's clearance, when that check runs, and the sign-in cookie, only if you sign in (see the cookie policy).
No analytics, advertising or social-media scripts from third parties.
No fingerprinting, no cross-site tracking, no profiles.
No sale or sharing of personal data.

Stored in your browser, not by us

Your theme and a few display choices (a chart layer, a tab, a saved view) are kept in your browser's local storage so they survive a reload. If you use the Inventory page, the same storage keeps your inventory's value over time and which skins you own, so a skin page can say "You own 2". None of it leaves your device. The date of your last visit is kept there too; only the number of days since it is sent (see Returning visits above). Signing out removes the inventory parts; clear your site data to remove everything.

Signing in with Steam is optional. Your sign-in lasts 30 days from your last visit on that browser. Uitloggen at any time from the header (your name, then Sign out): that ends the session on that browser. Your account and its sign-in history are kept while you use it; the history of sign-ins is deleted after 400 days. Staff see sign-in and sign-out events of site accounts (the Steam name, profile link and country described above) in a staff-only place. To see what we hold about you or to have your account and its history deleted, send a privacy request with your Steam profile link.

Your inventory

The Inventory page reads your Steam inventory only when you open it while signed in, and at most once every five minutes; the Refresh button shows when the next read is possible. Steam shows a public inventory to anyone, so we ask it without your password or any Steam login; a private inventory cannot be read, and the page tells you so. Items inside a storage unit are not part of a Steam inventory, and an item received in a trade in the last 7 days can be hidden by Steam for a while. The copy we read lives in our server's memory for at most 30 minutes and then disappears; restarting the service also removes it.

Providers

The site is served through Cloudflare (network and security) and hosted with Hetzner in the EU. Skin images load from Steam's content delivery network, which therefore sees your IP address as it would on any site showing Steam images.

Legal basis and your rights

We process the limited data above on the basis of our legitimate interest in running and securing the site (GDPR Art. 6(1)(f)); the data of a sign-in, to provide the session you asked for (Art. 6(1)(b)). You may ask for access, correction, deletion or restriction, object to processing, and complain to your data protection authority. If you have not signed in, we hold no identifier for you, so we usually cannot tell which records, if any, relate to you.

Changes

Laatst bijgewerkt op 28 September 2026.