Privacy policy

Last updated: 2 November 2026

Who we are

C$GOAT, powered by the Quant Engine, runs this website (www.csgoat.co.za). It tracks the value of Counter-Strike 2 items on the Steam Community Market and publishes a daily market paper and forecasts. For anything to do with your personal information, write to [email protected].

What we collect, and why

If you sign in with Steam:

• Your Steam ID, which Steam confirms to us when you sign in. It identifies your account.
• Your public Steam profile name, avatar and profile country, to show who is signed in and to suggest a wallet currency.
• A copy of your public CS2 inventory, so we can value your items. If your inventory is private we cannot read it.

If you create a website account instead: a username, an email address and a password. We keep only a scrypt hash of the password, never the password itself.

Things you add or choose: your watchlist, vaulted items, items you add by hand, paper-trading entries, your preferred currency, and your layout and look settings for the site and the paper. These are saved with your account so they follow you between devices.

Sessions: when you sign in we create a random session token. We store only a SHA-256 hash of it and an expiry (30 days). Signing out removes it.

Your country: your browser tells us the country of its time zone so we can suggest a currency. We save the currency, not a location.

We use this information only to run the service: to sign you in, value your items, remember your settings and show you forecasts. We do not run advertising and we do not build advertising profiles.

Where it is stored

• Account data is stored in Google Cloud (Firestore), in the europe-west1 region (Belgium).
• Market price history, which is not about any person, is stored in Google BigQuery.
• The website runs on Google Cloud Run. DNS and traffic pass through Cloudflare.
• Like most hosting, our infrastructure providers keep technical request logs (for example time, address requested and the connecting network address) for security and fault finding.

Who can see it

You can. We do not sell or share personal information, and we do not show anyone else your items: the public pages never display a person’s inventory or account. Our infrastructure providers (below) process data on our behalf to run the service. We may disclose information if the law requires it.

Cookies and local storage

We do not use advertising or tracking cookies. The site stores a few things in your browser’s localStorage so it works: your session token (so you stay signed in), your display preferences and theme, and some convenience data such as your watchlist and saved settings. Clearing your browser’s site data removes them and signs you out on that device.

Third parties

• Steam (Valve Corporation). You sign in through Steam OpenID on steamcommunity.com. We read your public profile and public inventory from Steam, and item images load from Steam’s servers, so Steam sees that request. Steam’s own privacy policy applies to Steam. See how sign-in works.
• Google Cloud. Hosting, database (Firestore) and analytics storage (BigQuery).
• Google Fonts. Our pages load their fonts from Google, so Google receives your browser’s request when a page loads.
• Cloudflare. Domain name (DNS) and traffic routing.

How long we keep it

We keep account data for as long as your account exists. Sessions expire after 30 days. When you delete your account we delete the data stored with it. Backups and provider logs may keep copies for a short time afterwards before they expire.

Your rights: access, correction and deletion

You have the right to access the personal information we hold about you, to have it corrected, and to have it deleted. You can change your display settings and currency in the app. You can delete your account yourself from Settings, using “Delete my account”. For a copy of your information, or anything you cannot do in the app, email [email protected] from the address on your account (or tell us your Steam ID) and we will reply.

If you are in South Africa, the Protection of Personal Information Act (POPIA) gives you these rights, and you may complain to the Information Regulator. If you are in the European Economic Area or the United Kingdom, the GDPR gives you similar rights, including the right to object and to complain to your data protection authority. Our information contact for all of these is [email protected].

Children

C$GOAT is not for children under 13, and we do not knowingly collect their information. Steam has its own age rules, which also apply to your Steam account. If you think a child has given us personal information, email us and we will delete it.

Changes to this policy

We will update this page when what we do changes, and change the date at the top. If a change affects how we use your information in a significant way, we will say so in the app.