What this site does with data.

When you type a profile, your browser asks this server, and this server asks Steam. The Steam Web API key is mine and stays here; your browser never sees it, and Steam never learns who was asking.

What comes back is what the profile already publishes to anyone: the display name, the avatar, the games, the hours, the achievements, and - where the profile publishes it - the trading cards sitting in its inventory, which is how a page can say what finishing a badge would cost instead of what a whole set costs. If a profile hides its game details, Steam returns nothing and the page says so. An inventory set to private is not read. Nothing private is unlocked here.

The answer is held in memory for fifteen minutes, so that a reload does not spend the key twice, and then it is gone. It is never written to disk. The one exception is a game's key art, cached as a plain JPEG at /art/<appid>.jpg - a picture of a game, with nobody's name on it.

Everything this server keeps once the request is over, with nothing left out:

• The messages you send. If you write on the feedback page, the text, the kind and the contact you chose to type are stored so I can read and answer them. Whatever I accept goes on the public board. Do not put anything in there you would not want read.
• A salted hash of your address. Not the address - a one-way digest of it, salted with a secret that never leaves this server, which cannot be turned back and is useless anywhere else. It counts one vote per person on the board, it holds the rate limit, and it is the handle a shut-out address needs for an appeal to be matched to the block it is about. This secret never changes: a ban that expires because a secret was rotated is not a ban.
• A count of visits, for seven days. A second digest of your address, under a different secret that is replaced every seven days. While it stands, a visit of yours is recognisable as "the same one again"; when it is replaced, the previous digests are deleted and only totals remain. Kept with it: how many requests, the first and the last time, the region, and a guess at what kind of visitor it was. Deliberately not kept with it: a record of each day you came - because a day on this side and a day on the lookup side would be exactly the join the two counts are built to not have.
• Your country and region. They arrive in a header that Cloudflare adds, already resolved. This server never needs your address to know them, never works them out itself, and never writes one down.
• The language you picked. One entry in your browser's localStorage, sp-lang, holding "en", "pt" or "ru". It also decides which Steam shop a price is read from, so a request for a price carries a country code derived from it - and that lands in the server log, which has no address in it. That is the only thing the choice sends anywhere.
• What you looked up, in your browser. A second localStorage entry, sp-recent, holding the last five profiles you looked up from the home page and nothing else about them - no times, no personas, no count. It is a shortcut back into the field, it never reaches this server, and the button beside the list on the home page erases it.
• A server log with no addresses. The web server writes one line per request: the time, the path, the status code, the browser string. No IP address in it, deliberately - the format was changed to drop it, precisely so the log is not a record of who looked up whom.
• Game prices and genres. A local cache of Steam store data, filed by game, not by person.

• Counting of my own, and no tracker. No Google Analytics, no pixel, no fingerprinting, no third-party script of any kind - the page loads code from this domain and nowhere else, and the Content-Security-Policy the server sends makes your browser enforce that. What does exist is counting done here, by me: how many visits came back, from what region, and how many times each profile was looked up. It is an experiment, and the section on those is below.
• No cookies. Not one, not even a "necessary" one. There is no consent banner because there is nothing to consent to.
• No account and no sign-in. This site never asks for your Steam credentials. Anything that does is not this site.
• Nothing joins who looked to what was looked at. There are two separate counts: one says a visitor came back, the other says a profile was looked up. They share no column, so the join does not exist - it is not that I choose not to run it, it is that there is nothing to run it on. What one visitor asked for is still held in memory for an hour, because that is how the rate limiter tells a reader from a scraper, and it is never written down.
• No ads and nothing for sale. No data goes to anyone, for money or otherwise. There is no business here to have a business model.

This site changes often, and some of what is here is an experiment. That word means one specific thing here: it is switched on to see whether it is any use, and if it gets in the way of the people using the site, it goes back off. While one is on, all of this holds:

• It gets no new data quietly. If an experiment needs a kind of information this policy does not already describe, the policy changes first, in the same revision, and the history says which one it was.
• It gets no longer to keep it. The period stated for a thing is the period, whether the thing is being tested or not.
• When it ends it leaves nothing behind. If I switch one off, what it collected is deleted, not kept in case.
• It decides nothing about you. No page changes because of it, no lookup is refused because of it, nothing is ranked by it, and none of it leaves this server.
• Your rights are the same. "Experimental" is about how good a number is and how long a feature lasts, not about how much I owe you. Everything under your rights, further down, applies exactly as written.

What is in this condition today is the counting of visits and of lookups described above - the first thing here to be, which is why this section exists at all. It is imprecise by nature, and worth knowing how: addresses get recycled, so a carrier network behind one shared address makes many people look like one, and the same person on wifi, on a phone and behind a VPN looks like several. The guess at what kind of visitor something is comes from how it behaved, and it gets it wrong. Expect this list to change, and when it does, it will be in the history.

A site that draws from Steam cannot be a closed room. These are every outside party involved and exactly what each one sees. Only the first four are reached while you wait; the rest run on this server's own clock:

• Valve. The lookup leaves this server for the Steam Web API under my key, and opening a game page also asks the Valve shop your language belongs to - the American, the Brazilian or the Russian one - what that game costs there today. Steam prices each region separately, so nothing here is converted: the number shown is the one that shop quotes. Both go out from here, so Valve sees this server asking and never you. The price block links out to the store, but nothing from Valve loads until you follow that link.
• Steam's image CDN. Avatars and key art load straight from Valve's servers into your browser, because mirroring a thousand images per lookup does not hold up. That means Valve's CDN sees your address, the same way it would if you opened the Steam store. It is the one place where something of yours reaches a third party.
• Cloudflare. The site is published through a Cloudflare tunnel, so your request travels through their network and is subject to their handling on the way here. They are also the ones who report the country and the region, so besides carrying the request they locate it - which is how this server can count where traffic comes from without ever holding an address.
• Ko-fi, only if you click it. The support page links out; nothing of theirs loads until you follow the link, and from there you are on their site under their terms. The crypto addresses involve nobody at all.
• The exchange rate source. Once a day this server fetches the day's dollar rates from a public currency file, so a card price quoted in cents of a dollar can carry an approximation in your money beside it. It runs on a timer and never on your request, so that source sees this server on a schedule and never learns that anybody visited.
• SteamSpy. Once a week this server reads the catalogue of who published and who developed every game on Steam, which is what the publisher and developer screens are built from. What goes out is a page number - no appid, no profile, no address - and it runs on a timer, so that source cannot tell this site has a visitor, let alone which one.
• ProtonDB. The Deck screen asks whether a game runs on Linux, and the people who ran it are the ones who know. Opening that screen puts the appids of that library on a queue here; a worker drains it later, one game every couple of seconds, mixed in with every other library queued since. So what goes out is an appid and never a profile or an address, and it goes out at a time that says nothing about when anybody looked. A verdict is a fact about a game, so one answer serves everybody who owns it and is kept for a month.

This site can look up any public Steam profile, which means it can draw a page about someone who never came here. That page holds only what Steam already shows to anyone with the link, it is built fresh on every visit, and it is neither indexed nor stored here.

If the profile is yours and you would rather it could not be drawn here, there are two ways: set your game details to private on Steam, and this site can no longer read anything - or write to me and I will block the profile by hand.

This is a hobby project run by one person on a server at home, and I am the one answerable for what it does with data. The legal basis for the little that is processed is legitimate interest in keeping the service running - answering lookups, stopping abuse, reading feedback, and measuring whether the site is used at all - under Brazil's LGPD and, where it reaches, the GDPR.

You can ask what is stored about you, ask for it to be corrected, or ask for it to be deleted, and I will do it. In practice the honest answer is almost always that there is nothing to delete, unless you left a message.

Write to me through the feedback page. If this policy changes, the date above changes with it.