Privacy Notice

Current scope

FragLedger currently supports Steam OpenID sign-in and uses fictional players and match fixtures for its public statistics preview. Signed-in players can also request an owner-only FACEIT summary for the FACEIT account linked to their SteamID64. Match-token onboarding and personal match ingestion remain disabled.

Data handled by the app

• Your SteamID64, public Steam name, avatar, profile URL, public ban summary, and Steam account creation date after sign-in.
• Steam-hosted avatar images can make a direct request to Steam's image host, which receives ordinary network details such as your IP address. FragLedger sends those image requests without a referring page URL.
• An encrypted, HTTP-only session cookie used to keep you signed in.
• Search text submitted through the player and lobby preview forms.
• When the FACEIT connection is configured and a fresh cache entry is unavailable, visiting the private FACEIT page causes FragLedger to send your authenticated SteamID64 from its server to the FACEIT Data API. It uses the ID to locate the linked CS2 account and request provider-reported rating, lifetime, and map aggregates. FACEIT receives that identifier and ordinary server-request details under its own privacy notice. FragLedger never sends its FACEIT API key to your browser.
• The FACEIT response is reduced to an allowlist of account and aggregate fields. FragLedger discards provider URLs, avatars, friends, settings, replay links, and unknown response fields.
• FragLedger never receives your Steam password. Steam handles authentication on its own website.
• No Game Authentication Code, match token, or real match history is requested while tracking is disabled.

Durable account storage

FragLedger now has a Cloudflare D1 database reserved for authenticated Steam identities. Account records are private by default and contain only a SteamID64, public Steam profile details, public ban summary, and account timestamps. Fictional preview players are not copied into this database. Signing in does not publish your account or add it to search, leaderboards, lobby results, or the fictional preview dataset.

Retention and deletion

Your account record is retained until you delete it or the service is closed. When a deletion request succeeds, FragLedger immediately deletes the active D1 account row and signs out that browser. D1 cascades also remove the account's encrypted tracking credential, private receipt ownership links, and other account-scoped rows. A receipt with no remaining owner is deleted with its match facts. You can start this process through the account deletion page.

A receipt shared with another account is different: its match, roster, and performance facts remain available only to the other authenticated receipt owner or owners. Those surviving facts can include your SteamID64, match-time persona name, and statistics. They are not de-identified. Deletion removes your account association and access, but not the shared facts. Real receipt ingestion is disabled in this deployment, so FragLedger does not currently create real shared receipts.

Active deletion does not erase provider recovery history immediately. Cloudflare D1 Time Travel is always on and currently retains recoverable database history for up to 7 days on Workers Free or 30 days on Workers Paid. That history expires on Cloudflare's plan window and is not used as the live application database. Cloudflare Workers Logs, when enabled, currently expire after 3 days on Workers Free or 7 days on Workers Paid. See Cloudflare's current D1 limits and Workers Logs retention for the provider's latest terms.

FACEIT cache and retention

FragLedger does not write the FACEIT summary to D1 in this release. A Worker isolate can hold only the normalized public account and aggregate fields, the FACEIT player ID, and an opaque digest of the SteamID64 in a bounded in-memory cache. A successful result is fresh for five minutes and can be served with an explicit stale label during a provider outage for no more than one hour. Expired entries are pruned during cache activity, the cache holds at most 128 accounts per isolate, and all entries disappear when Cloudflare discards that isolate. FragLedger does not expose this cache through a public or caller-selected player endpoint.

Hosting records

The hosting provider may process ordinary technical request data such as IP address, browser details, the full requested URL (including its query string), and security events to deliver and protect the website. During Steam sign-in, that query can transiently include the Steam claimed ID, response nonce, signature, and FragLedger login state. FragLedger does not put Steam profile payloads, credentials, full authentication URLs, assertions, or raw authentication failures into application logs. The private verifier processes the assertion only in memory and logs a categorical result. Provider-held technical records follow the plan windows stated above rather than the active D1 deletion transaction.

Cookies, analytics, and advertising

FragLedger uses a necessary encrypted session cookie and a necessary first-party preferences cookie. Optional Analytics and Advertising are denied until you choose them. Global Privacy Control is a runtime Advertising denial even if an earlier preferences cookie recorded an opt-in. No analytics provider is currently configured. Advertising is off by default; first-party house guides and text-only direct sponsorships use no optional storage, remote creative, impression beacon, or click tracker.

A third-party advertising script can load only when Advertising consent and all provider safety gates are present, the current route is approved for public-content monetization, and Global Privacy Control is not active. A sponsor destination receives an ordinary request only after you choose its clearly labeled external link. You can review the complete inventory and change or revoke your choice on the Cookie Notice.

Future AdSense use

The built-in preferences panel is not claimed to be a Google-certified CMP. If AdSense is activated, the operator must first complete Google publisher setup, update this notice with the actual provider practices and Google data-use disclosure, configure applicable regional privacy messages and opt-outs, and use a Google-certified TCF CMP where Google requires one, including for users in the EEA, UK, and Switzerland.

Match tracking remains off

Production enrollment and ingestion are currently disabled, so this deployment does not accept new Game Authentication Codes or match tokens. The storage boundary is ready for a future controlled launch: credentials are encrypted before D1 persistence with a versioned AES-GCM key, indexed only by a separate keyed digest, never displayed back to the account, and its active account-scoped row is deleted with the account. Tracking will stay disabled until the demo parser and ingestion service pass the published release checks. Do not submit real match-history credentials while enrollment is unavailable.

Privacy requests and operator contact

Account deletion is available through the signed-in self-service page. FragLedger has not yet published a monitored operator privacy contact for this preview. A monitored request channel and the service operator's identity must be published here before real match ingestion is enabled.