Privacy & Security Policy
1. What data we collect
- Account data: email, display name, country (optional), SteamID (when logging in with Steam).
- Bot data: the Steam credentials you add for your bots and their settings.
- Payment data: transaction identifiers from PayPal / crypto.com (we do not store card numbers).
- Technical data: IP address and the actions performed (audit log), for security and abuse prevention.
2. How we protect data
- Your account password is stored only as a bcrypt hash — we cannot see it.
- Steam bot credentials are stored encrypted (AES-256-GCM), in separate per-user containers (a dedicated file for each account).
- Sessions use httpOnly cookies; Steam Guard codes are not stored.
- Access to your data is limited to your account; other users cannot see your bots.
3. How we use data
- To provide the Service (connecting bots, farming, notifications).
- For billing and support.
- For security (rate-limiting, auditing, fraud prevention).
- We do not sell or rent your data to third parties.
4. Third-party services
We use: the Steam network (connecting bots), PayPal and crypto.com (payments), Discord (notifications — only if you configure a webhook). Each has its own privacy policy.
5. Cookies and local storage
We use three cookies and two local-storage entries. All of them are strictly necessary to run the Service you asked for — none is used for analytics, advertising or profiling. Under the ePrivacy Directive (2002/58/EC, Art. 5(3)) strictly necessary storage does not require consent, which is why you see no cookie banner here. Information, however, is still owed to you, so here is the complete list.
| Name | Purpose | Lifetime |
|---|---|---|
esf_session | Keeps you signed in. Without it, every page would ask for your password again. | 30 days, or until you sign out |
esf_csrf | Stops another site from performing actions on your account without your knowledge. | Session |
esf_root | Administrator sign-in. Set only for staff accounts. | Session |
esf_lang | Local storage. Remembers the interface language you picked, so it survives a refresh. | Until you clear it |
esf_ref | Local storage. Holds a referral code from the link you arrived through, so credit reaches the right person. | 30 days |
All three cookies are set with HttpOnly (unreadable by scripts), SameSite=Lax (not sent from other sites) and Secure (HTTPS only).
What we do not use: no Google Analytics, no advertising pixels, no tracking cookies of any kind, no cross-site profiling. We have never installed any, and nothing on this site loads a third-party tracker.
You can delete these at any time in your browser settings. Deleting the session cookie signs you out; deleting the language entry resets the interface to English. Nothing else is affected.
6. External requests
Some content is fetched from other companies' servers as you browse. Those requests reveal your IP address to them, which is why they are listed here even though none of them sets a cookie or tracks you:
- Steam CDN (
cloudflare.steamstatic.com) — game artwork shown in the panel and behind the sign-in card. - flagcdn.com — the small country flags in the language picker.
- Google Fonts — two typefaces. We are in the process of serving these from our own servers to remove the request entirely.
None of these receives your name, e-mail address, Steam credentials or any account data.
7. Your rights
- You can access, correct, or delete your profile data from the dashboard.
- Deleting a bot removes its credentials from your encrypted container.
- You can request full deletion of your account by contacting the administrator.
8. Data retention
Account data is kept for as long as the account exists. Audit logs and payment records are kept in accordance with legal billing obligations.
9. Contact
For any request regarding your data, contact the platform administrator using the details shown in the dashboard.