Privacy

This notice explains how GOBAD.EU currently processes personal data for the public website, Steam authentication, and community game servers, and what gameplay analytics we plan to collect before that collection starts. It is an initial community policy, not a certified legal document.

Last updated 20 September 2026.

When you sign in or use the platform, we may process your SteamID64, Steam display name, avatar, and public Steam profile URL; an internal player UUID; authentication session metadata; and server activity or records when those features are used.

Infrastructure may also process your IP address, user-agent, and operational or security logs. If you contact us, we process the contents of that support communication.

Before production collection starts, this notice describes the gameplay analytics we intend to process from GOBAD game servers. This change does not mean those analytics are already live.

Those records may include SteamID64 and related player identity; server and map identifiers; gameplay connection session start, checkpoint, and end events; connected time and map time derived from those events; population and capacity history; the normalized identifier of selected commands such as r or rank; and technical delivery or plugin-version diagnostics where they are actually collected.

We would use that information to operate and troubleshoot the service, understand server and map usage, improve onboarding, map selection, and community features, measure aggregated retention and reliability, and prevent duplicate delivery or accounting errors.

We never receive your Steam username and password. Steam authentication happens on Steam.

Raw session tokens are not stored in PostgreSQL. Only hashes are stored.

Gameplay analytics does not store command arguments, chat history, voice content, player movement or coordinates, key logging, or IP addresses in that analytics system. This change does not introduce advertising cookies.

SharpTimer timing and personal-best storage is separate from GOBAD gameplay analytics.

Personal data is not sold. This notice does not describe advertising profiling or automated decision-making.

The Steam Web API may be used to enrich public Steam profile data such as display name and avatar. That enrichment is best-effort and may be skipped or fail.

Current cookies are essential authentication and security cookies.

gobad_auth_state is a short-lived cookie used only for the Steam OpenID sign-in round trip.

gobad_session lasts until expiry or revocation, currently up to 30 days.

No advertising or analytics cookies are currently used. Gameplay analytics described here does not add advertising cookies.

Steam/OpenID and the Steam Web API authenticate and may enrich public Steam profile data.

Vercel hosts the public website.

Railway hosts the API and PostgreSQL database.

DatHost hosts the CS2 game server.

Google Workspace is used for email and support.

Session data is kept until expiry or revocation, and for necessary security retention.

Raw analytics events are kept for 90 days. Minute-level population history is kept for 400 days. Normalized gameplay, session, map, and command history is kept for the service’s operational history and player-facing statistics until it is no longer needed or a valid deletion request applies. Aggregated or anonymized statistics may be kept longer.

Game and account data is kept while needed to operate the community, preserve fair records, handle abuse, or meet legal obligations.

Operational logs are kept according to security needs and provider retention.

Some game or moderation records may need limited retention for integrity and abuse prevention.

You may request access, correction, deletion, or objection by emailing info@gobad.eu.

For support or moderation questions, email support@gobad.eu.