Privacy Policy

Spirited.gg ("Spirited", "we", "us") is a CS2 performance analytics platform. This Privacy Policy explains what data we collect, how we store and use it, and your rights with respect to that data.

We take data seriously — it is the core of what we do. We collect only what is necessary to provide the service and do not sell or share your personal data with advertisers.

Steam account data — When you sign in via Steam OpenID, we receive your Steam ID (a public numeric identifier), display name, and avatar URL. We do not receive your Steam password.

CS2 match history — We retrieve your match history via the Steam Game Coordinator (GC) and Valve's share code system. This includes match scores, round counts, and per-player statistics (kills, deaths, assists, damage, economy).

Demo parse data — When a demo file is parsed, we extract and store granular in-match events: kill positions and distances, damage per hitgroup, grenade throws and detonations, flash blind durations, bomb events, per-round player states, clutch situations, and trade events. This data is stored at the event level in our database.

FACEIT data — If you link your FACEIT account, or if your Steam ID is found in a match alongside a FACEIT player, we retrieve your FACEIT ELO, lifetime stats, and match history from the FACEIT public API.

Game State Integration (GSI) — If you configure CS2 GSI, your CS2 client will send real-time in-game state (map, scores, round number) to our webhook. This data is cached in Redis for up to 60 seconds and is not persisted long-term.

Usage data — We may collect standard server logs including IP address, browser user agent, and page request timestamps for operational purposes.

Persistent match and player data is stored in a Supabase (PostgreSQL) database hosted on infrastructure in the EU.

Frequently-accessed data is cached in Upstash Redis with short TTLs: Steam profile data for up to 30 minutes, FACEIT data for up to 10 minutes, GSI state for up to 60 seconds. Redis caches are ephemeral — cache expiry deletes the data automatically.

The platform is served via Vercel's edge network. No data is intentionally written to Vercel's edge stores beyond what Next.js caches implicitly.

We use a single session cookie named cs2_session. It contains a signed JSON Web Token (JWT) identifying your session. It is set as HttpOnly (not accessible to JavaScript), Secure (HTTPS only), and expires after 7 days.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

Steam / Valve — Authentication and match data. Steam's own Privacy Agreement governs data Valve holds.

FACEIT — ELO and lifetime stats retrieved from the FACEIT public API. FACEIT's own privacy policy applies to data held by FACEIT.

Match and player data is retained indefinitely to power performance trend charts and leaderboards. You may request deletion of your data at any time — see the section below.

GSI state data is automatically deleted after 60 seconds via Redis TTL.

Under GDPR (if you are in the EU/EEA) and similar laws, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict processing

To exercise these rights, contact us via the contact page. We will respond within 30 days.

Spirited is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, please contact us so we can delete it.

We may update this policy as the platform evolves. Material changes will be noted by updating the effective date at the top of this page. Continued use of Spirited after changes constitutes acceptance of the updated policy.

Questions about this policy? Get in touch.