Privacy notice

Current scope

FragLedger supports Steam OpenID sign-in, CS2 match tracking, and an owner-only FACEIT summary for the FACEIT account linked to a signed-in player's SteamID64. Pages labeled as demo data use sample data, never real accounts. Profiles are public by default: after you sign in, your Steam name, avatar, and tracked match stats can appear on your public profile, in player search, and on leaderboards until you set your profile to private in Account settings.

Data handled by the app

• Your SteamID64, public Steam name, avatar, profile URL, public ban summary, and Steam account creation date after sign-in.
• Steam-hosted avatar images can make a direct request to Steam's image host, which receives ordinary network details such as your IP address. FragLedger sends those image requests without a referring page URL.
• An encrypted, HTTP-only session cookie used to keep you signed in for up to 30 days.
• Search text submitted through the player and lobby forms.
• When the FACEIT connection is configured and a fresh cache entry is unavailable, visiting the private FACEIT page causes FragLedger to send your authenticated SteamID64 from its server to the FACEIT Data API. It uses the ID to locate the linked CS2 account and request provider-reported rating, lifetime, and map aggregates. FACEIT receives that identifier and ordinary server-request details under its own privacy notice. The FACEIT API key never reaches your browser.
• The FACEIT response is reduced to an allowlist of account and aggregate fields. FragLedger discards provider URLs, avatars, friends, settings, replay links, and unknown response fields.
• Steam handles sign-in on its own website, so FragLedger never sees your Steam password.
• If you enable tracking, FragLedger receives the CS2 Game Authentication Code and recent match share code you submit, validates the pair with Steam, encrypts it before storage, and never displays the saved values back to you.
• Tracking processes Steam match identifiers and replay data into match, round, roster, and player statistics linked to your account. Temporary replay files are removed after processing; verified match facts remain covered by the retention and deletion rules below.

Account storage

FragLedger uses Cloudflare D1 for authenticated Steam identities, encrypted tracking credentials, tracking state, match ownership links, and parsed match facts. Stored account records are access-controlled: no other visitor can read them directly. Your public profile is a separate, reduced view of that data. It is visible by default, and you can switch it to private at any time in Account settings. Sample demo players are never copied into this database.

Retention and deletion

Your account record is retained until you delete it or the service is closed. When a deletion request succeeds, FragLedger immediately deletes the active D1 account row and signs out that browser. D1 cascades also remove the account's encrypted tracking credential, match-receipt ownership links, and other account-scoped rows. A match receipt with no remaining owner is deleted along with its match facts. You can start this process through the account deletion page.

A match receipt shared with another account works differently: its match, roster, and performance facts stay available only to the other authenticated receipt owner or owners. Those surviving facts can include your SteamID64, match-time persona name, and statistics. They are not de-identified. Deletion removes your account association and access, but not facts that remain linked to another account.

Active deletion does not erase provider recovery history right away. Cloudflare D1 Time Travel is always on and currently retains recoverable database history for up to 7 days on Workers Free or 30 days on Workers Paid. That history expires on Cloudflare's plan window and is not used as the live application database. Cloudflare Workers Logs, when enabled, currently expire after 3 days on Workers Free or 7 days on Workers Paid. See Cloudflare's current D1 limits and Workers Logs retention for the provider's latest terms.

FACEIT cache and retention

FragLedger does not write the FACEIT summary to D1 in this release. A short-lived server process (a Cloudflare Worker isolate) can hold only the normalized public account and aggregate fields, the FACEIT player ID, and an opaque digest of the SteamID64 in a bounded in-memory cache. A successful result is fresh for five minutes. During a provider outage it can be served with an explicit stale label for no more than one hour. Expired entries are pruned during cache activity, the cache holds at most 128 accounts per process, and all entries disappear when Cloudflare discards that process. FragLedger does not expose this cache through a public or caller-selected player endpoint.

Hosting records

The hosting provider may process ordinary technical request data such as IP address, browser details, the full requested URL (including its query string), and security events to deliver and protect the website. During Steam sign-in, that query can transiently include the Steam claimed ID, response nonce, signature, and FragLedger login state. FragLedger does not put Steam profile payloads, credentials, full authentication URLs, assertions, or raw authentication failures into application logs. The private verifier processes the assertion only in memory and logs a categorical result. Provider-held technical records follow the plan windows stated above, not the active D1 deletion transaction.

Cookies, analytics, and advertising

FragLedger uses a necessary encrypted session cookie and a necessary first-party preferences cookie. Optional Analytics and Advertising are denied until you choose them. Global Privacy Control is a runtime Advertising denial even if an earlier preferences cookie recorded an opt-in. No analytics provider is currently configured. Advertising is off by default. First-party house guides and text-only direct sponsorships use no optional storage, remote creative, impression beacon, or click tracker.

A third-party advertising script can load only when Advertising consent and all provider safety gates are present, the current route is approved for public-content monetization, and Global Privacy Control is not active. A sponsor destination receives an ordinary request only after you choose its clearly labeled external link. You can review the complete inventory and change or revoke your choice on the Cookie Notice.

Carbon Ads

When Carbon Ads (BuySellAds) is operator-enabled, a single native unit may load on approved public content pages after Advertising consent. The unit is injected from Carbon's CDN on the public document only; private ledger and account pages never load Carbon. Without Advertising consent, or when Global Privacy Control is active, FragLedger shows first-party house guides instead. Carbon and its partners may set advertising cookies or pixels as described in their publisher documentation. You can review and revoke choices on the Cookie Notice.

Google AdSense

When AdSense is operator-enabled (secondary / fallback network), units load only on approved public content pages after Advertising consent, and only inside a sandboxed frame that cannot access FragLedger session cookies. Private account pages never mount advertising. The built-in preferences panel is not claimed to be a Google-certified CMP. Before serving Google ads in the EEA, UK, or Switzerland, the operator must complete Google publisher setup, update this notice with the actual provider practices and Google data-use disclosure, configure applicable regional privacy messages and opt-outs, and use a Google-certified TCF CMP where Google requires one.

Match tracking

Signed-in players can enable tracking by adding the FragLedger bot in Steam and submitting a CS2 Game Authentication Code with a recent match share code for the same account. Steam validates the pair before enrollment. FragLedger encrypts the credential with a versioned AES-GCM key before writing it to D1, indexes it only by a separate keyed digest, never displays it back to the account, and deletes the active account-scoped credential row with the account.

The tracking service polls for newer match references, downloads the associated replay into an isolated processing environment, and stores only match facts that pass parser and reconciliation checks. If a stat can't be verified, it shows as unavailable rather than a zero. Tracking can be delayed by Steam, replay availability, or processing failures.

Privacy requests and operator contact

Account deletion is available through the signed-in self-service page. FragLedger has not yet published a monitored operator privacy contact for other requests. This is a known beta limitation, and this notice will be updated when that request channel and the service operator's identity are published.