Privacy Policy

1.Controller and contact

The controller responsible for the processing of your personal data is:

For all questions about data protection and to exercise your rights, please contact us at the e-mail address above. We have not appointed a data protection officer, as we are not legally required to do so.

2.Summary

• You sign in with Steam. We never receive your Steam password.
• We process your match data and Demos to create statistics and Clips. Demos also contain data about the other players in your matches.
• Your game authentication code is stored encrypted and only used to find and download your Demos.
• Payments are handled by Stripe. We never see your full card or bank details.
• We do not use analytics or tracking tools, show no advertising and do not sell your data. We only use cookies that are technically necessary.
• Our websites and databases are hosted in the European Union.

3.Visiting the website

When you open our website, your browser automatically transmits technical data to our servers, which is stored in server log files:

• IP address,
• date and time of the request,
• requested page or file and HTTP status code,
• browser type and version, operating system,
• referrer URL (the page you came from).

Purpose: delivering the website, ensuring stability and security, and detecting and defending against attacks and misuse.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and functional website).

Storage period: log files are deleted after 14 days at the latest, unless they are needed to investigate a specific security incident.

All fonts and icons are hosted on our own servers. No data is transmitted to external font or content delivery services when you visit our website.

4.Cookies and local storage

We only use cookies and similar technologies that are technically necessary to provide the Service:

• Session cookie: keeps you signed in after the Steam login. It is deleted when you log out or after it expires.
• Language setting: stores the language you have selected.
• Security cookies: protect forms and the login against misuse.

Legal basis: storing and accessing this information is strictly necessary to provide the service you have requested and therefore does not require consent (Art. 5(3) of the ePrivacy Directive as implemented in Estonian law). The subsequent processing is based on Art. 6(1)(b) GDPR.

We do not use cookies for analytics, tracking or advertising. Should this change in the future, we will ask for your consent beforehand and update this Privacy Policy.

5.Sign-in with Steam and your Account

5.1 Steam login

You sign in via the official Steam login (OpenID) on the website of Valve Corporation. Valve only tells us your Steam ID; your Steam password is never transmitted to us. Using your Steam ID, we retrieve your public Steam profile data (profile name, avatar, profile link) via the Steam Web API.

When you sign in on Steam, Valve Corporation (USA) processes your data as an independent controller under its own privacy policy.

5.2 Account data

In your account settings you can provide the following data. Apart from the username, all fields are optional:

• username,
• first and last name,
• e-mail address,
• gender and date of birth,
• country of residence and nationality.

Your username, avatar and the profile information you provide (in particular country, nationality, gender and age) are shown on your public profile. Your e-mail address and your date of birth are never shown publicly; only the resulting age may be displayed.

Purpose: creating and managing your Account and your profile, communicating with you about your Account and purchases.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract). For optional profile information: Art. 6(1)(a) GDPR (your consent, given by entering the data); you can remove it at any time.

Storage period: as long as your Account exists.

6.Connected accounts, match data and Demos

6.1 Steam accounts

For each Steam account you connect, we process the Steam ID and public profile data. To import Premier and matchmaking matches automatically, you can provide the game authentication code and a match share code. With these codes we request your match history from Valve and download the Demos of your matches.

The authentication code is stored encrypted, is never displayed again or passed on to third parties, and is only used for this purpose.

6.2 FACEIT

If you connect a FACEIT account, you sign in on the FACEIT website and authorise us to access your data. We receive your FACEIT player ID, nickname, avatar, skill level, ELO, region and your FACEIT match history including the Demos. The operator of FACEIT processes your data on its platform as an independent controller under its own privacy policy.

6.3 Uploaded Demos

When you upload a Demo, we store the file, its name and size, and the time of upload.

6.4 Analysis

From the Demos and match data we create match details and statistics, such as scoreboards, round logs, kills, ranks and rank history, highest ranks and medals. This information is shown on your profile and on the match pages.

Purpose: providing the core functions of the Service. Legal basis: Art. 6(1)(b) GDPR. Storage period: as long as your Account or the connection exists. Demo files may be deleted earlier to save storage space; the derived match data remains available.

6.5 Data of other players

Demos are recordings of entire matches. They therefore also contain data about the other participants: their Steam ID, in-game name and their in-game actions (for example kills, positions and statistics). We process this data to show complete scoreboards and round logs and to create Clips.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest, and that of our users, is the complete analysis of matches in which our users took part. The data concerned is limited to in-game data that all participants of the match can see anyway. If you are a player in such a match and object to the processing, please contact us (see section 13).

7.Clips and community features

When you use our community features, we process the content you create and the related metadata:

• Clips: video files, title or description, tags, visibility setting (public, link only, private), creation date, views and likes;
• Comments and likes on Clips, including reports of comments;
• Guestbook entries on profiles;
• Friends: friend requests and friend lists;
• Activity log shown on your profile.

Content that you make public, such as public Clips, comments and guestbook entries, can be seen by all visitors together with your username and avatar. Popular public Clips may be shown on our start page. Private Clips are only visible to you; Clips set to “link only” are visible to anyone who has the link.

Legal basis: Art. 6(1)(b) GDPR. For reviewing reported content and preventing misuse: Art. 6(1)(f) GDPR. Storage period: until you delete the content or your Account.

8.Purchases and payment

Payments for Packages and Subscriptions are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). When you click on “Buy”, you are redirected to Stripe's payment page. Stripe collects your payment details (for example card or bank data) directly; we do not receive them.

From Stripe we receive the information needed to process the order: name, e-mail address, billing country, payment status, the last digits and type of the payment method, transaction ID and the product purchased. We also store your Token balance, the Tokens credited and used, your Subscription status and term, and the confirmations you gave before the purchase (acceptance of the Terms and request for immediate supply) with date and time.

Stripe processes data partly as our processor and partly as an independent controller (for example to prevent fraud and comply with legal obligations). Stripe may transfer data to the USA; see section 10. More information: stripe.com/privacy.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract), Art. 6(1)(c) GDPR (accounting and tax obligations), Art. 6(1)(f) GDPR (fraud prevention and proof of consent).

Storage period: accounting records and invoices are kept for 7 years as required by Estonian accounting law. Other purchase data is stored as long as your Account exists.

9.Recipients and processors

We only pass on personal data where this is necessary to provide the Service, where you have consented, or where we are legally obliged to do so. Recipients are:

• Hosting providers for our web servers and databases, located in the European Union, acting as our processors under data processing agreements (Art. 28 GDPR);
• Server providers for processing Demos and creating Clips, located in various countries, also acting as our processors (see section 10);
• Stripe for payments (section 8);
• Valve Corporation and the operator of FACEIT, from whom we retrieve data on your behalf (sections 5 and 6);
• authorities, if we are legally obliged to disclose data.

We do not sell personal data and do not pass it on for advertising purposes.

10.Transfers outside the EU

Our web servers and databases are located in the European Union. To create Clips with as little delay as possible, Demos may be processed on servers in countries outside the European Economic Area. For this processing, only the data required to create the Clip is transferred (in particular the Demo file and the selected rounds and players).

Transfers to countries outside the European Economic Area only take place if the European Commission has decided that the country provides an adequate level of data protection (Art. 45 GDPR), or if appropriate safeguards are in place, in particular the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards from us.

Valve Corporation is based in the USA. Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework.

11.Contact by e-mail and support requests

If you contact us by e-mail, for example to remove a connected account, we process your e-mail address, your message and the data you provide in order to handle your request.

Legal basis: Art. 6(1)(b) GDPR if your request relates to your Account or a contract, otherwise Art. 6(1)(f) GDPR. Storage period: we delete the correspondence when it is no longer needed, at the latest 2 years after the request has been completed, unless statutory retention obligations apply.

We send you e-mails relating to your Account and purchases (for example purchase confirmations, notices of price changes or changes to our Terms). We do not send newsletters or advertising e-mails without your consent.

12.Deletion of your Account

You can delete your Account at any time. We will then delete your Account data, connected accounts, authentication codes, Clips, comments, guestbook entries and friend lists without undue delay, unless we are legally obliged to keep certain data (in particular accounting records, see section 8). Data in backups is overwritten in the regular backup cycle, at the latest after 30 days.

Match data that was imported through other users' accounts (for example a match in which you played together with another OnlyCS user) may remain in their match history; it will then no longer be linked to your Account.

13.Your rights

Under the GDPR you have the following rights regarding your personal data:

• Access to your data and information about its processing (Art. 15 GDPR);
• Rectification of inaccurate data (Art. 16 GDPR);
• Erasure of your data (Art. 17 GDPR);
• Restriction of processing (Art. 18 GDPR);
• Data portability: receiving your data in a structured, commonly used and machine-readable format (Art. 20 GDPR);
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, an informal message to the e-mail address in section 1 is sufficient. To protect your data, we may ask you to prove that you are the owner of the Account, for example by sending the request from the e-mail address stored in your Account.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence. The authority responsible for us is:

14.Obligation to provide data

You are not legally obliged to provide personal data. However, without signing in with Steam you cannot create an Account, and without connecting an account or uploading a Demo we cannot create match analyses or Clips. For purchases, the data required by Stripe for payment is necessary.

15.No automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). Statistics, ranks and medals are calculated automatically from your match data but have no such effects.

16.Minimum age

The Service is intended for persons aged 16 and over. We do not knowingly collect personal data of children under 16. If we become aware that an Account belongs to a person under 16, we will delete it.

17.Security

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. These include encrypted transmission via HTTPS (TLS), encrypted storage of authentication codes, access controls and regular backups.

18.Changes to this Privacy Policy

We will update this Privacy Policy if our Service or the legal situation changes, for example when we introduce new features or new service providers. The current version is always available on this page. If changes require your consent, we will ask for it beforehand.