Privacy

• Your SteamID if you sign in with Steam, or the username you chose. For a username account, your password and recovery code are stored only as scrypt hashes, which nobody — including us — can read back.
• Your Steam trade link.
• The addresses you give us to cash Septim out to.
• Your deposits, withdrawals, orders, trades and balance.
• The address your requests come from, briefly, to limit repeated sign-in attempts and to stop abuse. Our server logs record it too, for troubleshooting.

Signing in with Steam tells us your SteamID and nothing else — we never see your Steam password or Steam Guard codes. With your SteamID we read, from Steam, only what Steam already makes available:

• Your public display name and avatar, to show on your account page.
• Your inventory, to show what you can deposit and to confirm the items are there before a bot asks for them.
• Whether Steam would hold a trade with you, or has restricted your account from trading, so we can warn you before a trade that would stall.

No email address, no real name, no phone number, no payment card details. We do not run advertising, analytics or tracking scripts, and no third party can follow you here.

Two for signing in, and none used for tracking:

• A session cookie that keeps you signed in. Your browser’s scripts cannot read it, and it expires after a week or when you sign out. “Sign out everywhere else” on your account page ends every other one.
• A short-lived cookie while you sign in with Steam, which ties Steam’s answer to the browser that asked. It lasts ten minutes.

Orders on the book are public as prices and quantities, and the trade history shows what has filled and when. Neither shows who: no SteamID, no username, no avatar. Somebody can see that four keys are offered at $1.71 and cannot see whose they are.

Your Septim deposit address is on a public blockchain, where anyone watching can see what arrives at it. That is how public blockchains work and not something we can undo.

To settle your trades, keep accurate books, and investigate fraud or disputes. Trade and payment records are kept for as long as we are required to keep accounts. Sign-in attempt records expire within an hour; sessions after a week.

• Our payment gateway receives the amount and a reference for each Septim deposit and cash-out, to process it.
• Steam sees the trade offers we send you, because Steam delivers them.
• Blockchain transactions are public by nature.
• When a page or one of our servers hits an error, a report goes to the error-tracking service we use: what broke and where, the page’s address without anything after the path, and your browser’s name and version. It carries no account, no IP address, no cookies and nothing you typed.
• Nobody else. We do not sell your data or share it for marketing, and we disclose it to authorities only where the law requires us to.

Ask support for a copy of what we hold about you, or for it to be deleted where we are not required to keep it. A deletion cannot reach a public blockchain, and cannot remove trades that other people’s records also describe.

When what we keep or why changes, this page changes and the date at the top moves.