Privacy Policy

1. Controller and contact

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is the operator of ratecs.com. For all privacy questions and requests, contact us at business@ratecs.com.

2. Hosting, security and delivery

The website runs on servers of Ryzehosting (Hauptstraße 43, 2563 Pottenstein, Austria) in data centres within the European Union (Germany and the Netherlands). Requests pass through Cloudflare, Inc. (content delivery, DDoS and bot protection). Cloudflare processes your IP address and technical request data to deliver the site and block attacks. Cloudflare Turnstile may check expensive actions (e.g. lobby checks, removal requests) for bots.

Legal basis: Art. 6(1)(f) GDPR (secure and stable operation). Cloudflare may process data in the USA; transfers rely on the EU–US Data Privacy Framework and standard contractual clauses.

We do not store IP addresses in our database or logs. For rate limiting, your IP address is converted into a hash with a salt that changes daily and is kept only for the duration of the respective limit window (seconds to 24 hours).

Check statistics: when you open a profile and use the page, we count this as a check (crawlers and scripts are not counted). Together with the checked SteamID we store the time, the type of check (profile, comparison, Discord bot, API), a short visitor code, a coarse browser description such as “Chrome · Windows” (never the full user agent) and the country reported by Cloudflare. The visitor code is derived from your IP address with a salt that changes daily: it cannot be reversed and cannot link your visits across days. We use this only to count real users and to detect automated abuse.

3. Public player data (Steam, FACEIT, Leetify)

When a profile is checked, we retrieve publicly available data from the official interfaces of Steam (Valve), FACEIT and Leetify: e.g. SteamID, name and name history, avatar, account age, Steam level, CS2 playtime, VAC/game bans, friend list (only to calculate the share of banned friends), FACEIT level/ELO/bans and Premier rating.

For the estimated inventory value we read the public CS2 inventory from Steam (only item names and counts, kept in a cache for 24 hours, not stored in our database) and price it with the public Skinport price list. Private inventories are not read. The value is not part of the Trust Score.

From this we calculate an explained Trust Score. It is a statistical estimate based on public data, not an accusation and not a decision with legal effect.

We store Steam and FACEIT data in our database (profile data, ban status, name history, score snapshots for history charts, ban events) so that the service stays fast and within provider limits. Leetify data is only displayed live and never stored.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest and that of our users is transparency and fair play in online matches, based on data the players themselves made public. You can object at any time (see “Removal and objection”).

4. Match and demo data (all players of a match)

When a signed-in user connects their match history, we load their matchmaking matches: the scoreboard via Valve's Game Coordinator and the demo file from Valve's replay servers. We analyse the demo automatically and delete it right afterwards.

We store statistics of all 10 players of the match, including players who never used RateCS themselves: SteamID, in-match name, team, kills, deaths, assists, damage and derived values (e.g. kill types, clutches, utility), round history and kill feed, as well as the match's in-game chat. When displaying chat we mask links, email addresses, phone numbers, IP addresses and slurs.

From the demo we also store, for every player: positions four times per second for the 2D replay, grenade throws and landing points, aim and reaction values (e.g. time to damage, crosshair offset), ping and the Valve data centre of the match. These values describe play and are not proof of anything. Replays, grenade data and in-game chat are deleted 12 months after the match; if you object, we also hide you in replays. From all stored matches of a player we also calculate overall statistics (e.g. rating, KAST, averages and their spread) and store them for their profile; they are recalculated after every new match and deleted if you object. For checked players with a FACEIT account we also store the scoreboards of their recent FACEIT matches for all 10 players (kills, deaths, assists, damage, headshot rate, multi-kills, MVPs, result; no names) as a basis for these statistics.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest and that of our users is analysing and understanding matches played together; the data comes from matches that Valve provides to all participants as a demo.

Retention: in-game chat is deleted 12 months after the match. Scoreboard and statistics data are kept as long as the match is shown on the participants' profiles. You can object at any time (Art. 21 GDPR, see “Removal and objection”): we then hide you in all matches and delete your chat messages.

5. Account (Sign in through Steam)

Signing in is optional and uses Steam OpenID. We never receive your Steam password. We store your SteamID, sign-in times, active sessions (only a hash of the session token plus a rough device description such as “Chrome · Windows”, no IP address), your watchlist, in-app notifications and an activity log (e.g. checks, imports).

If you enable automatic match import, we store your Steam match history authentication code encrypted (AES-256-GCM) and the imported matches.

Legal basis: Art. 6(1)(b) GDPR (providing the functions you requested). Sessions expire after 7 days; the activity log is deleted after 90 days; all account data is deleted when you delete your account.

6. Stream overlay

If you create a stream overlay, we store a cryptographic hash of your overlay token (never the token itself) and your display settings with your account. When your overlay is loaded (e.g. by OBS), we show your own public statistics; the page is not indexed by search engines and sends no referrer. You can renew or switch off the overlay at any time; switching it off or deleting your account removes the stored token hash.

Legal basis: Art. 6(1)(b) GDPR (providing the feature you requested).

7. Lobby checks

If you paste the output of the CS2 console command “status” or a FACEIT room link, we extract player names, SteamIDs and connection values (ping, loss) and store the resulting lobby for 24 hours so that the result link works. The pasted text itself is not stored.

8. Discord bot

If you use the RateCS Discord bot, Discord transmits your Discord user ID and your command input to us. The user ID is only used in hashed form for rate limiting; inputs are processed to answer the command and are not stored.

9. Cookies and similar technologies

Necessary cookies (session, sign-in, language) are used without consent. Advertising cookies are only set after your consent. Details: see our Cookie & Ads Policy.

10. Advertising (Google AdSense)

To finance the free service we may show ads from Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on selected pages. Advertising scripts are only loaded after you consent in our consent dialog (Google “Privacy & messaging”, IAB TCF 2.2). Google may then set cookies and process device and usage data to deliver, measure and, if you allow it, personalize ads. The consent dialog itself is provided by Google and stores your choice in your browser.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent). You can withdraw or change your consent at any time via “Privacy settings” in the footer. Google may process data in the USA (EU–US Data Privacy Framework). More: https://policies.google.com/technologies/ads

11. Partner links

Some links to skin marketplaces (Skinport, CSFloat) are partner links and marked as such. If you buy something there, we may receive a commission; the price does not change for you. We do not set cookies for this. Once you follow the link, the privacy policy of the respective marketplace applies.

12. Removal and objection

Players can have their profile hidden from RateCS via the removal page (/removal). Hidden profiles are no longer displayed anywhere on RateCS (profile, lobby, matches, API, bot, sitemap, feeds). We delete stored profile data, histories and your chat messages; in other players' scoreboards you are hidden. We verify ownership by signing in through Steam. Alternatively, you can object by email to business@ratecs.com.

13. Your rights

Contact for all requests: business@ratecs.com.

• Access to your data (Art. 15 GDPR)
• Rectification (Art. 16) and erasure (Art. 17)
• Restriction of processing (Art. 18) and data portability (Art. 20)
• Objection to processing based on legitimate interests (Art. 21)
• Withdrawal of consent at any time with effect for the future (Art. 7(3))
• Complaint to a data protection supervisory authority (Art. 77)

14. Children

RateCS is not directed at children under 16. Signing in requires a Steam account in accordance with Steam's own age rules.

15. Changes

We update this policy when our services or legal requirements change. Last updated: 2026-11-01.