Privacy Policy

This is what LFCounter, operated by NoSaaS LLC, a Texas limited liability company, collects about you, why, and what we do with it. We never sell your personal data. Questions or requests about your data go to privacy@lfcounter.com.

What we collect, and why

Account identity. If you sign in with Steam, we store your SteamID64, your Steam display name, and your Steam avatar image, so we can show who you are on the site and seat you correctly in a match. We never see your Steam password; Steam's own sign-in page handles that, and hands us back only a signed confirmation of who you are.

Email account identity. If you sign up with email instead, we store the email address and a password hash, using Argon2id, a one-way hash designed to resist cracking even if our database were stolen. We cannot recover your password from it. We also send a one-time link to confirm you own the address, and, if you ask to reset your password, a separate one-time reset link.

Linking a Steam profile to an email account. Matches are seated by SteamID64, so an email account needs one linked before it can play. You can link it by signing in with Steam directly, or by giving us your profile and entering a short code we give you into your profile's About Me box. Steam only publishes that box when your profile is set to Public, so this second method asks you to make your profile public temporarily, and only for as long as it takes us to read the code back. You can set your profile back to private once it is linked.

Subscription and billing status. We store your subscription tier, and, if you have paid a subscription through Stripe, identifiers Stripe uses to recognize you (a Stripe customer ID and subscription ID), the subscription's status, which price you are on, when your current paid period ends, whether it is set to cancel, and the status of your last invoice. For display on your account page, we also store your card's brand, its last four digits, and its expiry month and year. We do not receive, and cannot store, your full card number: Stripe's own checkout page collects that directly.

Match history and rating. We keep a record of matches you have played, and a skill rating (a Glicko rating, with its deviation and volatility) built from your wins, losses, and draws. This is what matchmaking uses to place you against players of a similar skill.

What happened during a match. We record who actually connected to the match server, so a cancelled match can tell apart the people who showed up from the people who didn't, and we count team kills per match so repeat offenders can be given a queue cooldown.

Party invitations. If you invite someone to a party, we store that pending invitation so it can be shown to them and accepted. We do not keep a friends list of our own. The list you see on the site is read from Steam when you look at it and is not stored here, because Steam is where you add and remove friends and a copy here could only go out of date.

Weapon skin loadout. If you use the in-match skin changer (a Premium Plus feature), we store your chosen knife and per-weapon skins so they carry over between matches, since each match server is destroyed once the match ends.

Promotions, gifts, and free play. If you redeem a promo or gift code, or play during a promotional free-play window, we record that redemption and, for gift codes, who issued it, so we can enforce limits like how many a subscriber can give out in a month.

Support messages. If you email us, we store the message: the address you sent it from, the name your mail program attached to it, the subject, the text of the message, and the full original as it arrived. We keep that on our own server rather than in a personal mailbox, so that a request to see or delete your correspondence with us has one place to reach. If you attach a file, we record its name and do not keep the file itself. Anything you put in a support message is stored, so please do not send us your password, and never send us a card number.

Session and security records. We keep a server-side session record while you are signed in, and short-lived records of Steam-linking attempts and email-confirmation or password-reset tokens, so those flows can be completed securely and cannot be replayed.

IP addresses. Our web server and game servers log IP addresses as part of normal operation. When you join a match, you connect directly to the game server we provisioned for it, and that server sees your IP address the way any Counter-Strike server does when a player connects to it. We use these logs for security, abuse prevention, and diagnosing problems, not to track you across other sites.

Cookies

We use two cookies, both required for the site to work and neither used for advertising or analytics: a session cookie that keeps you signed in, and a CSRF token cookie that protects forms on the site from being submitted by another site on your behalf. We do not use advertising or analytics cookies or trackers.

Who else sees your data, and why

Valve, through Steam. Signing in with Steam and displaying your profile involves Valve's servers (api.steampowered.com, steamcommunity.com). Steam provides your identity, display name, and avatar, and, where relevant to friend features, your Steam friends list.

Stripe. If you subscribe, Stripe (api.stripe.com) processes your payment and is the one holding your full card details. We only ever receive a summary back from them.

DigitalOcean and OVH. These are the cloud providers whose machines we use to run match game servers on demand and to host the Service. Data that passes through a match server, including your IP address as noted above, passes through infrastructure run by these providers.

Cloudflare. Cloudflare sits in front of lfcounter.com, so requests to the site pass through it before reaching our servers.

A future email delivery provider. We do not yet send bulk email and have not yet chosen a provider to do it. When we do, sending you service email or, if you have opted in, announcement email, will involve handing your email address to that provider for delivery. We will update this policy when that happens.

Legal requests. We are a U.S. company with all our infrastructure located in the U.S. We do not respond to a request for your data from a government authority unless we are compelled by valid legal process, such as a warrant, subpoena, or court order, or in limited circumstances involving an emergency threat to someone's safety. Where we are not legally barred from doing so, we will try to notify you before disclosing your data in response to such a request.

We do not sell your personal data, and we do not share it with third parties for their own advertising purposes.

Service email vs. announcement email

We send two kinds of email, and they are not the same thing.

Service email is necessary to hold an account: confirming your address, resetting your password, and notices about your billing or account. You cannot opt out of this while keeping an account, because it is how the account works. Accepting our Terms of Service covers it.

Announcement and marketing email is separate and optional. It is off by default; we only send it if you tick a box to turn it on. You can turn it off again at any time from your account page, and every announcement email carries an unsubscribe link that does the same thing.

How long we keep it

We keep account, billing, and match data for as long as your account is open, since it is what your account and your matchmaking rating are built from. Short-lived records, like email confirmation links, password reset links, and Steam-linking codes, expire on their own within a short window, typically under a day, and are not usable after that whether or not you asked us to delete them. Web and game server IP logs are kept only as long as needed for security and abuse investigation, and are not kept indefinitely.

We keep support messages for 24 months after the conversation ends, so that we can follow up on a recurring problem and answer a later question about what we told you. You can ask us to delete your support messages sooner, and we will, unless the conversation is evidence in an open billing dispute or abuse case.

When you delete your account, we delete the data described in "Getting a copy of your data, or deleting it" below within a reasonable time, generally within 30 days, except where we must keep something longer to comply with a legal obligation, resolve a dispute, or enforce these policies.

Your rights

Wherever you are, you have the following rights over your personal data, subject to the limits your local law places on them:

• Access. Ask what personal data we hold about you.
• Correction. Ask us to correct data that is inaccurate.
• Erasure. Ask us to delete your personal data. Deleting some data, like your account identity, may mean closing your account, because the Service cannot work without it.
• Restriction. Ask us to limit how we use your data while a request or dispute is resolved.
• Objection. Object to our use of your data for a particular purpose.
• Portability. Ask for a copy of your data in a format you can take elsewhere.
• Non-discrimination. We will not charge you more, or give you worse service, for exercising any of these rights.

To exercise any of these, email privacy@lfcounter.com. We may need to verify your identity, for example by confirming the email or Steam account tied to the request, before acting on it.

GDPR: European Economic Area and United Kingdom

If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation, or the UK GDPR, gives you the rights listed above, plus the right to withdraw consent at any time where we rely on your consent, without affecting anything we did with your data before you withdrew it. This section adds the detail GDPR requires.

Legal basis for processing. We rely on the following bases, depending on the purpose:

• Performance of a contract. Account identity, Steam linking, subscription and billing data, match history and rating, and match connection records: we need these to provide the Service you signed up for.
• Legitimate interests. IP address logging, session and security records, and abuse prevention, including team-kill counting for queue cooldowns: we have a legitimate interest in keeping the Service secure and fair, balanced against your privacy.
• Consent. Announcement and marketing email: we only send it if you opt in, and you can withdraw that consent at any time from your account page.

International transfers. NoSaaS LLC is a U.S. company, and our infrastructure, including the cloud providers listed above, is located in the United States. If you are in the EEA or UK, your data is transferred to and processed in the United States, which has not received an adequacy decision from the European Commission. We rely on the data processing agreements our processors publish, which is where the Standard Contractual Clauses for these transfers sit. Stripe, Cloudflare, DigitalOcean and OVH each publish one. If you want to know the position for a particular provider, ask us at privacy@lfcounter.com and we will tell you.

Right to complain. You have the right to lodge a complaint with your local data protection supervisory authority, or with the UK Information Commissioner's Office if you are in the UK, regardless of what we do in response to a request you send us directly.

California residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), gives you the rights listed above and the additional disclosures below.

We do not sell or share personal information, as those terms are defined in the CCPA, and we have not done so in the 12 months before the effective date above. We do not use or disclose sensitive personal information for any purpose that would require us to offer a right to limit it.

Getting a copy of your data, or deleting it

Email privacy@lfcounter.com to ask for a copy of the personal data we hold about you, or to have your account deleted. Deleting your account removes your personal data: your identity, contact details, payment references, and saved loadout. Match results that involved other players are kept, but only in aggregate as part of match history and other players' ratings; they are not personally identifying once your account is gone.

Your support messages are erased separately, by the email address you wrote to us from. They are kept apart from your account on purpose: most people who write to us have no account here, and closing an account should not silently destroy the record of a billing dispute that is still open. Ask us to erase them and we will, whether or not you have an account, and whether or not you are deleting it.

Children

The Service is not directed at children under 13, and you must be at least 13 to use it, as described in our Terms of Service. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has an account, contact privacy@lfcounter.com and we will look into it.

Changes to this policy

We may update this policy as our practices change or the law requires. When we make a material change, we will show you the new version and ask you to accept it before you can keep using the Service. The version and effective date at the top of this page tell you which version you last agreed to.

Contact

NoSaaS LLC, operating LFCounter. Privacy questions and data requests: privacy@lfcounter.com. General questions: support@lfcounter.com. Our registered business address is available on request at either address.

Portions of this document are adapted from the Basecamp open-source policies, used under CC BY 4.0.