Privacy Policy

The data controller is CS2Diff, Fort Worth, Texas, United States. Privacy questions and deletion requests go to cs2diff@gmail.com.

• Account: email address and authentication identifiers from our authentication provider, plus your display name, handle and profile preferences.
• Steam link: your SteamID64, your CS2 game authentication code and the last match share code you supplied. The game authentication code is sensitive, account-linked match-tracking data. It is stored for server-side use only, is used solely to call Valve's match sharing API on your behalf, and is never sent back to your browser or included in a data export.
• Match data: maps, scores, rounds, per-match statistics and derived ratings for matches we ingest for your account.
• AI coaching: your coach messages and the generated responses and routines.
• Portfolio: skins and purchase prices you enter yourself.
• Billing: subscription status, plan and Stripe customer identifier. Card details are held by Stripe, never by us.

Your CS2Diff profile page is public by default. This means your display name, avatar, Steam profile link, rank, and recent match statistics can be viewed by anyone and may be indexed by search engines. Your email address, Steam authentication code, and match sharing codes are never shown on your public profile. You can make your profile private at any time in Settings → Privacy → Public profile. When your profile is private, your public profile page and match history are no longer available to other users.

When you ask the AI coach a question or generate an AI-assisted practice routine, your prompt plus only the CS2Diff match and telemetry context needed to answer it is sent to Lovable's AI gateway and on to the underlying model provider for inference. We do not send your email address, Steam credentials or billing data. We do not control, and make no promises about, how that provider retains or uses request data beyond serving the response — see their terms for details. If you would rather nothing leaves CS2Diff, simply do not use the coach.

We use PostHog for product analytics, to learn which parts of CS2Diff are used and where people get stuck. We record a small, fixed list of interactions rather than everything you do:

• which page you viewed, reduced to its general route (for example /match/:id, never the match itself) and without the part of the address after the question mark;
• which Getting started step you followed on the Dashboard;
• that you opened a match's details or analysis, from which page, and whether it had verified demo stats;
• that you opened a coaching drill, its broad area (aim, utility or game sense) and whether you arrived from the Dashboard;
• that the Trade-Up calculator evaluated a full contract, its contract type and rarity tier, and whether it was valid;
• which Pro plan you selected, and that a checkout was started.

Each event carries only those fixed values plus the browser and device details analytics tools normally record, such as browser and operating system type. When you are signed in, events are linked to your account by an internal random identifier, never by your email address, name, SteamID or Discord account; signing out clears that link on your device. Analytics never includes your coach messages or replies, Steam authentication code, match share codes, match IDs, skins or inventory, or any payment or Stripe details, and we do not capture what you type into forms.

Automatic click tracking and heatmaps are turned off. Like any web service, PostHog receives your browser's IP address when events are sent. PostHog stores a random analytics identifier in your browser's local storage. If our analytics key is not configured, nothing is sent at all.

Session replay. We may also use PostHog session replay to understand how pages are used, for example where a layout confuses people. When it is switched on, replay records a privacy-masked reconstruction of the page, not a video of your screen:

• all text on the page and everything you type is replaced with placeholder characters, except our own fixed navigation labels;
• links keep only their general route; images are hidden, apart from CS2Diff's own logo and icons; and labels and other page details are hidden;
• password, payment and Stripe checkout fields, Steam authentication and match share code fields, your coach conversations and generated practice routines, and the feedback form are never recorded, not even as placeholders;
• recording is paused entirely on sign-in and password reset, account settings, data sources and internal admin pages;
• network requests, browser console logs and embedded third-party frames are not recorded.

A replay is linked to the same random identifier as analytics events, never to your email address, name or SteamID. If session replay is not switched on, or our analytics key is not configured, nothing is recorded.

• Valve / Steam Web API — match sharing codes and public profile data.
• Leetify — optional third-party integration you can enable as an additional match data source.
• Lovable AI gateway and the underlying model provider — AI coach inference.
• Stripe — payment processing and subscription billing.
• PostHog — product analytics, as described above.
• Sentry — error monitoring, so we can find and fix crashes. We send the error message, the page address it happened on, and your browser and device type. We keep this to a minimum: we do not attach your account identity, we do not record your screen or track performance, request contents are not collected, and authentication, session and cookie data is filtered out of error reports.
• Our hosting and database provider — application hosting and data storage.
• Object storage provider — temporary storage of downloaded match demos for parsing.
• Skin marketplaces and pricing APIs — market prices. These calls do not include your identity.

We process account, match and coaching data to provide the service you asked for (performance of a contract), billing data to meet legal and accounting obligations, and minimal diagnostic logs and product analytics under our legitimate interest in keeping the service working and improving it.

Match, coaching and portfolio data is kept while your account exists. You can unlink Steam at any time from the Data Sources page, which clears your stored authentication code. Clearing your data in-app removes your CS2Diff application data; deleting the underlying authentication account is handled by our support team for now — email cs2diff@gmail.com and we will remove your personal data, keeping only the billing records we are legally required to retain.

Depending on where you live, you may request access, correction, export or deletion of your data, and object to processing. Contact cs2diff@gmail.com; we respond within 30 days.

We use cookies and local storage to keep you signed in and to cache catalogue data for speed, and local storage for the random product-analytics identifier described above. We do not run advertising trackers.