Privacy Policy

This Privacy Policy explains how Crate.tf ("Crate.tf," "we," "us," or "our") collects, uses, and shares information when you use crate.tf and related services (the "Service").

This Policy should be read together with our Terms of Service.

1) Who is responsible for your data

For the purposes of applicable data protection laws, Crate.tf is the controller of personal data processed in connection with the Service.

Contact: privacy inquiries can be sent to [email protected].

2) Information we collect

A. Information from Steam (when you sign in)

When you authenticate via Steam (Steam OpenID), we receive and/or access information such as:

• SteamID (SteamID64 or equivalent identifier)
• Steam display name (persona name)
• Avatar image URL / profile image
• Profile-related metadata needed to operate sign-in

We do not receive your Steam password.

B. Trading information (to execute trades)

To operate the Service and execute item-for-item trades, we may collect and process:

• Your Steam trade URL (required to send trade offers)
• Inventory information needed to quote and validate a trade (e.g., TF2 item identifiers/SKUs and counts)
• Trade Offer IDs, trade status, and related transaction metadata
• Items you selected to give/receive and the resulting planned/executed offers

C. Technical and usage data

We may collect:

• IP address
• Device identifier (or similar client identifier)
• Browser/device information (e.g., user agent)
• Timestamps, logs, diagnostics, and security-related events
• Basic usage events (e.g., page views, actions within the Service)

D. Cookies and similar technologies

We use cookies or similar technologies for:

• Essential functions (session, authentication state, security/CSRF protection)
• Preferences (where applicable)
• Analytics (where required by law, we use analytics only with appropriate consent)

You can control cookies through your browser settings and, where available, through cookie preference tools on the Service.

E. Support communications

If you contact us (email or Discord), we receive the content you send (messages, attachments, and identifiers used to respond). If you contact us via Discord, Discord's own privacy practices also apply.

3) How we use information (purposes)

We use the information above to:

• Provide and operate the Service
• Authenticate you via Steam
• Show inventory-based trade options
• Create, send, and track Steam Trade Offers via bots
• Enforce "single active transaction" and manage item reservation/locking

Security, abuse prevention, and integrity

• Detect and prevent automation, scraping, fraud, exploit attempts, and account abuse
• Rate limit and defend against attacks
• Maintain logs necessary for troubleshooting and incident response

Improve and maintain the Service

• Debug issues and improve reliability
• Monitor performance and service stability
• Understand aggregate usage patterns (e.g., which pages/features are used)

Support and communications

• Respond to support requests and resolve trade issues
• Send operational messages (e.g., important account or transaction-related notices)

Compliance

• Comply with legal obligations and respond to valid legal requests where required

4) Legal bases (for EEA/UK-style frameworks)

Where applicable, we rely on one or more of the following legal bases:

• Contract / performance of a contract: to provide trading features and execute Transactions you request (Steam login, trade planning, sending offers, transaction status).
• Legitimate interests: to secure the Service, prevent abuse, maintain logs, and improve reliability.
• Consent: for non-essential cookies/analytics where consent is required.
• Legal obligation: where we must retain or disclose information to comply with law.

5) How we share information

We do not sell personal data.

We may share information in limited circumstances:

With Steam/Valve (trade execution and authentication)

Trades occur through Steam Trade Offers; Steam necessarily processes the trade data to complete the exchange.

Service providers (processors)

We may use vendors to host infrastructure, store data, deliver email, provide monitoring/analytics, and run operational tooling. These providers process data on our behalf under contractual restrictions.

Support channels

If you contact us via email or Discord, your communications are processed through those platforms.

Legal and safety

We may disclose information if we believe it is required by law or necessary to protect the rights, safety, and security of Crate.tf, users, or others (e.g., responding to lawful requests, enforcing Terms, investigating abuse).

Business changes

If the Service is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction (subject to appropriate protections).

6) International transfers

Your information may be processed in countries other than where you live, depending on where we and our service providers operate. Where required, we use appropriate safeguards for cross-border transfers (such as standard contractual clauses or equivalent mechanisms).

7) Data retention

We retain data only as long as reasonably necessary for the purposes described in this Policy, including security and operational integrity. Typical retention examples:

• Account identifiers and core account data (SteamID, display name, avatar reference): kept while your account remains active and for a reasonable period afterward for security and operational needs.
• Transaction and Trade Offer records (including offer IDs and status): kept for recordkeeping, dispute handling, abuse prevention, and service integrity.
• Security and access logs (IP/device identifiers, timestamps): retained for security monitoring, fraud prevention, and troubleshooting, then deleted or anonymized.

You can request deletion (see Section 9). Some information may be retained where necessary for security, abuse prevention, or legal compliance.

8) Security

We use reasonable administrative, technical, and organizational measures designed to protect information from unauthorized access, loss, misuse, or alteration. However, no internet service can guarantee absolute security.

You are responsible for maintaining the security of your Steam account and device.

9) Your rights and choices

Depending on where you live, you may have rights such as:

• Access to your personal data
• Correction of inaccurate data
• Deletion of data (subject to certain exceptions)
• Restriction or objection to certain processing
• Data portability (where applicable)
• Withdrawal of consent (for processing based on consent, such as certain analytics cookies)

To exercise rights: contact [email protected]. We may need to verify your request (for example, by confirming control of the Steam account).

Cookies: You can typically block cookies via your browser; blocking essential cookies may prevent the Service from working.

10) Children's privacy

The Service is intended for users 16 and older. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has used the Service, contact [email protected] so we can take appropriate steps.

11) Third-party links and services

The Service may interact with third parties (notably Steam/Valve) and may include links to third-party sites. We are not responsible for third-party privacy practices; please review their policies.

12) Changes to this Privacy Policy

We may update this Policy from time to time. We will post the updated version on the Service and update the "Effective date." Your continued use of the Service after an update means you accept the updated Policy.

13) Contact

For privacy questions or requests: [email protected]