EN
EnglishDeutschTürkçePortuguês (Brasil)EspañolRomanaFrançaisРусский
EUR

PATINAAI · Privacy Notice

Last updated .

Sections12

PatinaAI is a CS2 inventory value tracker at patinaai.net. This notice covers the web app and the PatinaAI Inventory Sync browser extension, and describes how personal data is processed under the EU General Data Protection Regulation (GDPR).

Who is responsible

The controller is Albu Adrian, a private individual (not a company or a registered business) in Romania, who runs patinaai.net on his own. Write to [email protected] about anything in this notice; we answer in English or Romanian. There is no data protection officer: a one person site doesn’t need one, so the address above is the one to use. The legal notice has the same details.

Who the site is for

PatinaAI is for people 16 and over. In Romania, where we are, 16 is the age from which you can agree to an online service on your own, so please don’t sign in, follow a price or post anything if you’re younger. Pro is a paid contract: you need to be 18, or 16 or 17 with a parent’s consent. If you think a child under 16 has given us data, write to us and we delete it.

What the extension does

Its single purpose: it keeps your PatinaAI account in sync with your own Steam data. It reads the following from steamcommunity.com and api.steampowered.com inside your own browser, using the Steam session you are already signed in with, and sends the result to your PatinaAI account at patinaai.net:

  • Your CS2 inventory, every inventory context including trade-protected items (every 15 minutes, and when you click the extension’s icon).
  • Your active trade offers, sent and received, with their items, the other person’s SteamID and any message attached to them. They are read with the short-lived access token the Steam site issues to your signed-in session; the token is used only inside your browser and is never sent to PatinaAI.
  • Your Steam Community Market history: your own purchases and sales.
  • Your friends list (SteamID, name and avatar), only when you turn friends on in PatinaAI. The server then values your friends’ public inventories to show them to you.
  • Steam Market price history for the items you hold or watch, which draws your charts and is stored with PatinaAI’s shared market prices.

Optional: “Help price the whole market”. A setting in the extension’s options, off by default. Only if you turn it on does the extension also use your browser and Steam session to read public Steam Market price history pages for items other PatinaAI users hold or look up, and the public inventories of trade partners other PatinaAI users want to check (when Steam blocks our server from reading them). What it reads is public Steam data about items and those partners’ public inventories; it goes into PatinaAI’s shared price data and to the user who asked for that trade check. Other users are never shown who fetched it. You can turn it off at any time in the extension’s settings, and your own sync works either way. The extension reports your choice to the server, which keeps it (on or off, and when) and shows it in your Account tab.

The extension keeps its token (a credential), our server’s address, your sharing choice and how far its market history read got in the extension’s local storage on this browser. From version 1.5.0 none of it is synced to your Google account.

Your Steam password, cookies, session and the access token never leave your browser; only the data listed above does. The extension cannot trade, accept offers or change anything on your Steam account.

Legal bases: reading and importing your own data is necessary to provide the service you signed up for (contract, Art. 6(1)(b) GDPR). The optional sharing rests on your consent (Art. 6(1)(a) GDPR), which you give by ticking the box and can withdraw at any time by unticking it in the extension’s settings, without affecting what was done before.

PatinaAI and its extension are not affiliated with, endorsed or sponsored by Valve Corporation or Steam.

Data, purposes, legal bases, retention

DataPurpose · legal basisKept
SteamID, persona name, avatar, your trade link, your language Sign-in and showing your account · contract (Art. 6(1)(b)) Until account deletion
Inventory and its value over time, floats, cost basis, theses, watchlist, alerts, storage units The tracking service itself · contract Until account deletion; a cached copy of the Steam inventory itself goes after 7 days
Trades you accept (items, values, the other party’s SteamID) Your trade ledger and profit and loss · contract Until account deletion
Your open trade offers as the extension last read them, with the other person’s SteamID and any message in the offer Pricing your offers for you · contract Replaced on every sync; deleted 30 days after the last one
Trade board posts (items offered and wanted, your note of up to 500 characters) Posting to the shared board · contract, you choose to post 14 days, or sooner when you remove the post, trade an item in it away or delete your account; shown to other signed-in users with your SteamID, name and avatar
The scam flag SteamRep holds on a trade partner’s or a board author’s SteamID Warning you before you trade with a flagged account · legitimate interest in trade safety (Art. 6(1)(f)) SteamRep’s answer is cached 7 days, then deleted
Trade partners’ public inventories, and which partner you last checked Evaluating a trade you request · legitimate interest (Art. 6(1)(f)) 7 days after it was read, then deleted by the hourly clean up
Your friends list and your friends’ public inventory values (their SteamID, name, avatar, value and top items), only with friends turned on Showing you what your friends hold · legitimate interest in the feature you turned on (Art. 6(1)(f)) Your list is deleted the moment you turn friends off, and otherwise 30 days after its last refresh; a friend’s value 7 days after it was read, or at once when no list names that friend any more
An item’s float, pattern seed and stickers, read through the item’s inspect link (which carries its owner’s SteamID) Showing exact floats for your items and a partner’s · contract, and legitimate interest for a partner’s items (Art. 6(1)(f)) The float, seed and stickers are kept per item, without the owner’s SteamID
The arcade: your calls, plays, points and streak; your Steam name and avatar on the leaderboards Running the games you play · contract; the leaderboards are public Until account deletion
Feedback you send Improving the service · legitimate interest (Art. 6(1)(f)) Until account deletion
Your answer to the optional question after a tool result (“What were you trying to find?”): the text you type, the page, its language and the time; no account, no IP address Choosing which pages and tools to build next · legitimate interest (Art. 6(1)(f)) 12 months, then deleted; never shown publicly
Pro: your plan, whether it was granted by us, the Stripe customer and subscription ids (never your card), and, when you buy it, the exact words of the start box you ticked with the time and language Providing and billing Pro · contract; keeping the ticked box as proof · legal obligation (Art. 6(1)(c)) Until account deletion
AI analyst usage counters (counts, cost) Cost protection and quotas · legitimate interest (Art. 6(1)(f)) Until account deletion
Analyst conversations Continuing your conversation · contract Browser-only, never on the server; auto-deleted after 30 days of inactivity; Clear deletes immediately
Public inventories looked up on the inventory lookup page by profile link, trade link, custom name or SteamID64 (no account needed): the items, their prices and the profile’s SteamID64 Showing you the priced inventory you asked for · legitimate interest (Art. 6(1)(f)); public Steam data only. Nothing is kept: we read the public inventory, price it and show it, and nothing about the looked-up profile is written to our database or logged, apart from anonymous counts of how many lookups ran. A trade link’s token is cut before the lookup runs (in your browser when scripts run, otherwise the moment it reaches us) and is never stored. A share link carries the SteamID64 only after the # in the address, which your browser never sends to us. The answer about 10 minutes in memory (a custom name’s SteamID64 up to 1 hour), so a reload does not ask Steam again, then deleted; never linked to whoever asked
Shared inventory value cards: the cash and Steam totals, how many items there are and how many have a price, the names, prices and catalogue pictures of the five priciest items, a view count, a one-way hash of the delete key and the time; no SteamID, name, avatar, profile link or item ids, no IP address, and nothing that ties the card to your account Showing the card you chose to share, to whoever holds the link · legitimate interest in providing the feature you asked for (Art. 6(1)(f)). You make a card signed in with Steam, in the app, and only ever of your own inventory: we work out the value ourselves, and nobody can make a card from someone else’s profile link. 90 days, then deleted. Delete it sooner with “Delete this link” in the app or “Delete this card” on the card page, in the browser you made it with, which keeps the delete key. If that key is gone, write to [email protected] with the link and we delete it. A deleted card’s preview picture can still load from caches for up to five minutes, and a preview a chat app already made stays in that app
Trade posts made from the trade check: the item names, each item’s picture (its Steam image address), the phase, float and quantity picked for them, what each nets and on which market, the total, the optional short line you type (at most 80 characters, no links), a view count, a one-way hash of the delete key and the time; no account is needed and none is linked: no SteamID, name, avatar, profile link, item ids or IP address Showing the post you chose to make, and its pictures for link previews, to whoever holds the link · legitimate interest in providing the feature you asked for (Art. 6(1)(f)). Your line is shown publicly on the post, so please leave personal details out of it. 90 days, then deleted together with its pictures. Delete it sooner with “Delete this post” on the post page, in the browser you made it with, which keeps the delete key. If that key is gone, write to [email protected] with the link and we delete it. Anyone can report a post with the Report link on it, or by writing to [email protected] with its link, and we remove it if it’s illegal or breaks the rules. A deleted post’s pictures can still load from caches for up to five minutes, and a picture you already posted in a group stays there until you remove it
Public baskets and shared trade-ups: the name or title you gave them, the items, a view count; shown under your Steam name Showing what you chose to publish · contract Until you make it private, delete it or delete your account
Continuation links (“Send it to my PC”): the address of the page you were on and the choices made on it (the item names with the phase, float and quantity picked in the trade check, the items of a trade-up, a list’s filters), what kind of page it is and the time; no account is needed and none is linked: no email address, SteamID, trade link or IP address is stored with it, and choices that look like one are refused Opening the same page with the same choices on another device, for whoever holds the link · legitimate interest in providing the feature you asked for (Art. 6(1)(f)). Opening the link never signs anyone in. 7 days, then deleted. Opening the link does not use it up, so anyone you pass it to sees the same page and choices until then
Reports of content you send with a Report link: which content, the reason and your explanation, your name and email address (optional for some reasons), your statement of good faith, the time, and what we decided Handling notices of illegal content and rule breaks, as the EU Digital Services Act requires (Art. 16 and 17) · legal obligation (Art. 6(1)(c)) 12 months, then deleted. We never tell the author who reported them
When we remove content: what was removed, the reason we gave and whether the author was told Giving the author a statement of reasons and handling a reply · legal obligation (Art. 6(1)(c)) 12 months, then deleted
Your extension’s market sharing choice (on or off, and when it last reported it) Honouring and showing your choice · legal obligation to demonstrate consent (Art. 6(1)(c) with Art. 7(1)) Until account deletion; replaced each time the extension reports
Server logs and rate limits: our app’s log holds error and status messages and no IP addresses. To limit abuse, the rate limits, and the check that a visitor calling itself a search engine really is one, key a count or an answer on your IP address (or its network), in memory only Security and abuse handling · legitimate interest (Art. 6(1)(f)) The log is capped by size (3 files of 10 MB) and rolls over. The addresses in memory go once their window ends (a minute up to a day, checked every minute), are never written to disk or to a log, and a restart clears them all
Notification email (optional) Sending the price alerts and, if you tick their own box, the arcade’s daily mail you asked for · consent (Art. 6(1)(a)), double-confirmed: nothing is sent until you click the link we mail you. When we last asked you for an address is kept with your account, so the desk doesn’t ask too often Until you remove it or delete the account; every mail carries a one-click stop link
Price follows (no account needed): your email address or your browser’s push subscription (the address the push service gave your browser, with its keys), the items you follow with their thresholds and the price when you followed, your language and when we last wrote to you; and for every item a consent record: the exact wording you saw, in the language you saw it in, when you asked and when you confirmed. We keep each record as long as the follow it belongs to and never rewrite it: one you never confirm goes after 48 hours, the rest go when you stop, at the latest 12 months after your address or browser was first confirmed. No IP address, no SteamID, no account Telling you about the price moves you asked for, at most one alert a day, never news or offers · consent (Art. 6(1)(a)). By email, every item you add waits for your own click in a mail that names that item, so nobody can add items to your address; the confirm link only confirms and the stop link only stops. By push, only after you allow notifications in your browser. Follow mails, the confirmation and the alerts alike, load no pictures at all: no item images, not even our own mark, no tracking pixel, so opening one fetches nothing from any server. The link in an alert, by mail or push, carries a tag that says it came from an alert, never who you are. Unconfirmed: 48 hours after the last request you did not confirm. Otherwise 12 months after your address or browser was first confirmed, items you added later included, or until you stop it, then deleted. By email, the stop link in every message deletes it with one click. In the browser, press “Stop alerts” on a notification, where your browser shows that button, or “Stop notifications in this browser” in the follow dialog on patinaai.net: the follow is deleted at once and the subscription removed. Turning notifications for patinaai.net off in your browser’s site settings works too: the next time we try to send one, the push service tells us the subscription is gone and we delete the follow. After 7 failed deliveries in a row we delete it as well, and in any case it goes 12 months after you first allowed notifications.
Saved trade checks, when you are signed in and press “Save this check”: the two sides as you entered them (item names and the phase, float and quantity you picked), what each side was worth when you saved it, and the time Showing you your saved checks with today’s value next to the old one · contract (Art. 6(1)(b)), a feature you use by pressing the button Until you delete the check or your account; never shown publicly, and included in your data export
The weekly roundup by email (optional, separate): the address it goes to (the one you confirmed for a price follow, or your account’s confirmed address), the items you follow or watch, the prices the last roundup compared against, your language, when the last one went, and a consent record: the exact wording you saw, in the language you saw it in, and when you gave it. No IP address One mail a week at most, only in weeks when something you follow moved more than 5 %, never news or offers · consent (Art. 6(1)(a) GDPR, Art. 13 ePrivacy): its own unticked box on the page that confirms a price follow, which only the mail to your address leads to, or its own switch in Account for an address you already confirmed. The link in a roundup carries a tag that says it came from the roundup, never who you are, and a roundup loads no pictures Until you stop it: the stop link in every roundup opens a page where one click ends all of them and deletes the record, consent included. It also goes when you stop the follow or it expires, when you untick it in Account, change or remove the address, click the stop link for all mail, or delete the account
Server error reports (failing route, stack trace) Finding and fixing crashes · legitimate interest (Art. 6(1)(f)) 90 days, in a self-hosted tracker on our own server; cookies, request headers, request bodies and the part of every address after “?” are stripped before a report is stored, for requests to us and for the calls our server makes to other services
Visit analytics (see below): per visit the browser, operating system, device type, screen size, language, country, region and city, a visit id, the pages viewed and the named events Knowing which pages and tools get used · legitimate interest (Art. 6(1)(f)) 12 months, then deleted by a weekly job

Market price data (what items cost on which market) describes items, not people, and is shared across accounts. CSFloat listings our price checks read carry the seller’s CSFloat id and name; we keep them 60 days after we last saw the listing, to spot price manipulation (legitimate interest, Art. 6(1)(f)).

People who aren’t our users. Some rows above are about other people: trade partners, friends, board authors, the owner of a looked up profile. We only read what Steam shows publicly, only when a user asks for it, keep it for the short times above and never build a profile of anyone. If you’re one of them and want your data gone, or want to object, write to [email protected] with your SteamID.

Backups

We back up the whole database so a broken disk doesn’t lose your data. A copy is made every night on our Hetzner server in Germany, and the 3 newest are kept. One more copy is made there before each server update or release and replaced at the next one. Every day a compressed copy is also encrypted (AES-256) on the operator’s own computer and only then placed in his Microsoft OneDrive storage, where the 2 newest are kept. The key never goes to OneDrive, so Microsoft can’t read them. Deleting your account doesn’t reach into these copies, but they roll off on their own: your data is gone from every backup within 30 days. We only ever restore a backup to repair the site, and if we do, we delete again any account that was deleted after the copy was made.

Cookies and storage on your device

EU law (Art. 5(3) of the ePrivacy Directive) lets a site store something on your device without asking first only when it is strictly necessary for something you asked for. That is the only reason we store anything, and nothing below is used for analytics or advertising. The site shows no ads and loads no ad or tracking code, and no script, font or frame from anyone else.

Cookies

  • session (with session.sig): set when you sign in with Steam, holds your SteamID and when you signed in, lasts 30 days or until you sign out. Without it you can’t stay signed in.
  • Cloudflare, which carries every request to the site, may also set a strictly necessary security cookie, __cf_bm, to tell people from automated traffic; it expires after 30 minutes of inactivity. If Cloudflare shows a security check, it sets cf_clearance, which records that the check was passed and lasts 30 minutes by default. Neither cookie is used for analytics or advertising.

Local and session storage

Local storage stays on your device until you clear the site’s data; session storage goes when you close the tab. Nothing in it is sent to us unless the list says so. Each key holds only what the list below names: what you picked, typed, saved or closed yourself, and the few things the site keeps there for you. No key holds an email or IP address unless you typed one in yourself, into the analyst for example. A SteamID in a key is your own, to keep two accounts on one browser apart, or part of something you typed, like a trade link, which may be a partner’s.

  • Choices you made: your currency (only once you pick one, or pick a language, which brings its currency), the desk tab you last opened, cards or table, net or gross, the sort, the Market section, chart smoothing, the flip finder’s venues, arcade sound, and whether the analyst panel is open and how big. Each is written only when you change it.
  • Things you closed or read: that you closed the welcome tour, the first steps card, the “since your last visit” card, the trade link prompt, a notice, a game’s How to play or the one question after a result; that you pressed “later” on the extension nudge (3 days); which changelog entry and notifications you opened. A record that you closed something is what keeps it closed, and it exists only because you pressed that button.
  • Things you made, typed or saved: the trade link you typed into the trade check, your last 6 searches in Find, your analyst conversation (30 days without use, or Clear), trade checks you save while signed out (at most 20, only when you press Save; their value today is worked out by sending the item names and your picks to our server, which answers and keeps nothing), a signed out player’s arcade calls and practice round for the day, and a contract you asked to save or share before signing in (1 hour).
  • “Since you looked”: on public pages, only after you tap Remember them, the prices a page showed you and the day, for the last 12 pages, so a later visit can tell you what moved. “No thanks” stores only that you said no. “Forget what I looked at” wipes it. None of it is sent to us.
  • The sign-in hint: that the server just said this browser is signed in, so the desk starts loading sooner. It goes when the server says you’re signed out.
  • For the current tab only (session storage): the trade-up you’re building, a contract carried across the Steam sign-in you started, that you pressed “Add a storage unit”, that you closed the sign-in bar, and a one time reload marker when a code file failed to load after an update.

If you ask for price notifications in your browser, it registers our small service worker (/sw.js, which only shows the notifications, opens the item page when you click one and carries out the “Stop alerts” button) and creates a push subscription. Both happen only after you click and allow notifications, and you can remove them any time in your browser’s site settings. When you share an inventory value card in the app, the key that lets you delete it is kept in your browser’s local storage, on your device only. When you make a trade post, the key that lets you delete it is kept in your browser’s local storage in the same way. Each of these is stored because you asked for the thing it serves, which is what Art. 5(3) of the ePrivacy Directive allows without a separate consent. Nothing here rests on our legitimate interest, and clearing this site’s data in your browser removes all of it.

All pictures, Steam avatars included, come from our own server, so your browser doesn’t contact Valve’s image servers while you use the site. Links to Steam, Discord and social profiles load nothing until you click them.

Visit counting

Visits are counted with Umami, which we run ourselves on our own server in Germany: no cookies and nothing stored on your device, no advertising identifiers and no third party. For each visit it keeps the browser, operating system, device type, screen size, language, country, region and city, the pages viewed and the named events, under a visit id. That id is made by hashing your IP address and browser string together with a secret that changes regularly; your IP address itself isn’t stored, and we never join these rows to your account. Rows older than 12 months are deleted by a weekly job. The legal basis is our legitimate interest in knowing which pages and tools people use (Art. 6(1)(f) GDPR); you can object by writing to us, or block /u.js in your browser. Button clicks and tool uses, for example opening the follow dialog, running a price check or a trade-up calculation, or copying a share link, are counted the same way, as events without cookies: an event name with at most a few plain details, such as which button, which page or how many items, never your name or account. When you sign in, the server also counts each step of the Steam round trip as daily totals by device type and browser family; your browser’s identification string is reduced to those two labels on the spot and not kept.

Recipients and transfers

These services handle personal data for us, or receive it because a feature needs them. Outside the EU, a transfer rests on the basis named.

  • Hetzner Online GmbH (Germany): hosts the server, the database, the nightly backups, the visit counting and the error tracker. No transfer outside the EU.
  • Cloudflare, Inc. (USA): content delivery and security in front of patinaai.net. Every request to the site passes through it, so it sees your IP address, the address you open and what you send, only to deliver and protect the site. It also tells us which country a request comes from; we use that only to pick the language and currency your first visit opens in, and we do not store it. Your browser’s language setting, which it sends to every site, comes first: when it names one of our languages, your first visit opens in that one, and the country only decides when it doesn’t. It isn’t stored either. Cloudflare, Inc. appears on the U.S. Department of Commerce’s official list as an active participant in the EU-US Data Privacy Framework, which covers the transfer to the USA; its data processing addendum adds the EU standard contractual clauses should that certification lapse.
  • GoDaddy (GoDaddy Operating Company, LLC, USA): delivers every mail we send (confirmations, alerts, roundups, arcade mail, report receipts). It handles the address and the message in transit and may do so on servers outside the EU. Transfer basis: the EU standard contractual clauses in GoDaddy’s data processing terms; GoDaddy also says it takes part in the EU-US Data Privacy Framework.
  • Anthropic, PBC (USA): runs the AI analyst. It gets your question and what the analyst’s tools read to answer it: your inventory and portfolio, and in a trade check the partner’s public inventory and SteamRep flag. The analyst can also search the web, so search words taken from your question go through Anthropic’s search provider. Only when you ask the analyst something; under Anthropic’s commercial terms, API data isn’t used to train models. Transfer basis: the EU standard contractual clauses in Anthropic’s data processing addendum. We also send it Valve’s public news posts to summarise, which hold no personal data.
  • Microsoft (OneDrive): stores the off-site backups described above, encrypted before they get there, with the key kept only by the operator, so Microsoft holds the files but can’t read them. They may be stored outside the EU. Transfer basis: Microsoft Corporation takes part in the EU-US Data Privacy Framework, and its terms add the EU standard contractual clauses.
  • Stripe (Stripe Payments Europe, Ltd., Ireland, with Stripe, Inc. in the USA): handles the payment when you buy Pro. It gets your SteamID as a reference, the plan and when you ticked the start box, and it collects your email, card, billing address and country itself; the tax rules for the sale depend on the country. We keep the Stripe customer and subscription ids to link the payment to your account, and we never see your card. Transfers to the USA rest on the EU-US Data Privacy Framework and the standard contractual clauses in Stripe’s terms.
  • Valve/Steam (Valve Corporation, USA): the service you sign in with and the data is read from. Our server reads public profiles, inventories and friends pages from Steam, including a trade partner’s or a looked up profile’s. Steam works under Valve’s own privacy policy; it is a separate controller, not our processor.
  • SteamRep (steamrep.com): we send it the SteamIDs of trade partners and board authors to get their scam flag. It works under its own terms, as a separate service.
  • CSFloat (csfloat.com): we send it an item’s inspect link to read the float. The link carries the item owner’s SteamID, yours or a partner’s. It works under its own terms, as a separate service.
  • Your browser’s push service, only if you ask for notifications: Google (Firebase Cloud Messaging, for Chrome and most Chromium browsers), Mozilla (Firefox), Apple (Safari) or Microsoft (Edge), depending on your browser. It carries each notification to your device. The content (the item name, the prices and a link to the item page) is encrypted for your browser, so the push service cannot read it; it sees the subscription address, when each message is sent, its size and that it comes from us. It works under its provider’s own privacy policy, and some of these providers are in the USA. We only ever send to these four services: a subscription that points anywhere else is refused.

Market sites we read prices from (and the currency rate services) get item names only, never data about you. No selling, renting or sharing your data with anyone else. What you publish yourself (a board post, a trade post, a public basket or trade-up, a value card, your arcade name) is shown as each row above says, and taking it down removes it. We give data to an authority only when the law makes us.

AI assistants (the PatinaAI GPT and the MCP connector)

The PatinaAI GPT in ChatGPT and our MCP connector let an AI assistant look up public market data for you. When it does, the assistant provider’s servers (for example OpenAI’s) call us with the parameters of that one lookup: an item name, search words, trade-up inputs or a Valve post. We don’t receive your name, your account, your conversation or anything else you typed, and these calls never read or touch a PatinaAI account.

We keep a per-address counter in memory to enforce the rate limits (gone within one day) and aggregate counts per operation, with no address attached. Your conversation itself is handled by the assistant’s provider under its own privacy policy.

Your rights

  • Access & portability: the Account tab’s “Download my data” gives you one JSON file with everything the server holds about your account: your profile row with your email and consent records, holdings imports and storage units, trades and trade events, stored trade offers, theses, alert rules and fired alerts, baskets, saved trade-ups and trade checks, your friends list, arcade calls, plays, duels and points, board posts, feedback, daily action counts, analyst usage, every cache kept under your SteamID and the price follow on your confirmed address. Only the keys to your account (the extension token and similar) are left out.
  • Erasure: “Delete my account” in the Account tab deletes your account and the data about you right away, no grace period, and a Stripe subscription if there is one. Backups roll off within 30 days, as described above. Records that belong to another user, such as their own trade ledger naming you as partner, stay with that user.
  • Rectification, restriction, objection: write to [email protected]. You can object at any time to anything we do on legitimate interest.
  • Withdrawing consent: wherever we rely on your consent, you can withdraw it as easily as you gave it (the stop links, the switches in Account, the extension setting), without affecting what was done before.
  • Price follows without an account: by email, the stop link in every message opens a page where one click deletes the follow and everything stored with it, consent records included. In the browser, “Stop alerts” on a notification or “Stop notifications in this browser” in the follow dialog deletes it at once; turning notifications for patinaai.net off ends it too, as described above. A browser follow holds nothing we could match to a request, so we cannot look one up for you. For access, a copy or any other request about an email follow, write to [email protected] from the address you follow with, since there is no account to look it up by.
  • We answer within one month. No decision about you is made by automated means alone in a way that has legal or similarly significant effects.
  • Complaint: you can complain to a data protection authority. As we’re in Romania, the lead one is the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro. You can also go to the authority where you live or work. We’d like the chance to fix it first, at [email protected].

Security

TLS everywhere; per-user API keys encrypted at rest (AES-256-GCM); per-user rotatable extension tokens; the app is read-only against Steam and cannot trade.

Changes

When this notice changes, the date below changes too, and a change that matters for you is shown in the app before it applies.