Privacy statement

Tim Edig
Bernwardstr. 14
66424 Homburg
Germany
[email protected]

ForceBuy keeps a ledger of your CS2 items: what you own, what you paid and what it is worth today. For that it processes your Steam account, your inventory and, if you allow it, your buying and selling history. The legal basis is performing the service you signed up for (Art. 6(1)(b) GDPR) and, wherever you are asked explicitly, your consent (Art. 6(1)(a) GDPR).

• Your Steam account: SteamID64, public display name, avatar address. They come from your Steam sign-in; ForceBuy never sees a password.
• Your ledger: items, purchase and sale prices, dates, your own notes, collections, settings and the figures worked out from them.
• Watchlist and notifications: the items you watch, your price alerts and the notifications ForceBuy shows you. Notifications appear in the app and, if you allow it, as browser notifications; nothing is sent by e-mail or through another service.
• Access you store: a Steam session or, optionally, Steam's renewal token, marketplace API keys, and a Buff163 session if you add one. They are kept encrypted, never shown again, and used only for the requests you ask for. With the renewal token ForceBuy fetches a new Steam session about once a day, and stores that session in place of the old one. The token lasts up to about seven months at Steam. Every use is logged and visible in your settings. You can revoke them at any time, and without a sign-in they expire by themselves after 30 days. When you delete your account, they are deleted at once.
• Browser extension connection: if you connect the ForceBuy Connect extension, ForceBuy stores the browser, the extension version, the time it was connected, the time it was last seen and a fixed code for the result of its last delivery. The connection key is stored only as a checksum (SHA-256). The extension reads up to three cookies in your browser: Steam's renewal token (steamRefresh_steam on login.steampowered.com), as a fallback the Steam session (steamLoginSecure on steamcommunity.com), and the Buff163 session (session on buff.163.com) only if you turn Buff163 on for that connection and allow it in the extension. ForceBuy checks a Buff163 session once with Buff163 before storing it. The extension sends the cookies only to forcebuy.net, sets and deletes no cookie and calls no other service. What it delivers is stored like access you paste. The connection ends when you disconnect, expires after 30 days without a sign-in and is deleted with your account.
• Sessions: a cookie keeps you signed in. Only a checksum of it is stored, with the time and the browser string of the sign-in.
• Logs: the server keeps technical logs (time, path, errors) to run the service. Cloudflare collects aggregate traffic figures.

Prices, the item catalogue and exchange rates describe items, not people. They are stored once for everyone and stay when an account is deleted.

No advertising, no analytics services, no recognition across sites. The cookies that are set are the ones the service needs: your sign-in and the access code of the closed test. Fonts and scripts come from ForceBuy itself; only item images load from Steam's image servers.

• Hetzner Online GmbH (Nuremberg, Germany): server and database, as a processor.
• Cloudflare: delivery, protection of the domain and the connection to the server. Data may be processed outside the EU in the course of this.
• Steam (Valve), CSFloat, Skinport, Buff163: sources for inventory, history and prices. Requests go to them either because you asked for them or because they run once for everybody. ForceBuy only ever reads from these services. If you store the Steam renewal token, requests also go to Steam's sign-in service, login.steampowered.com.

Your account and your ledger stay until you delete them. Stored access expires after 30 days without a sign-in. Notifications are deleted 30 days after you read them and after 90 days at the latest. Technical logs are overwritten after a short time.

You can ask for access, correction, deletion, restriction and portability, and withdraw a consent at any time. Deleting your account with everything in it is a button in your settings; it happens at once and cannot be undone. For anything else, a message to [email protected] is enough.

You can also complain to a supervisory authority; for the controller that is the Unabhängiges Datenschutzzentrum Saarland.