Privacy Policy

1. Who runs this extension

The Pulse (CS2 Stats for Steam) browser extension is a free project maintained by an individual developer under the alias ahake. The source code is public for transparency and auditing at github.com/ahakexd/cs2-stats-extension (source-available; see the LICENSE file).

Contact for privacy questions: open an issue on GitHub.

2. What the extension does

When you visit a Steam Community profile page (steamcommunity.com/id/<name> or steamcommunity.com/profiles/<id>), the extension reads the SteamID64 from the page and fetches publicly available statistics about that profile:

• Leetify: AIM rating, K/D, winrate, matches analyzed, recent form, and optionally reaction time and pre-aim if you switch on the advanced tiles
• Faceit: ELO, level, recent matches, headshot percentage, and any bans on the account together with their reason and dates, which Faceit publishes openly
• Steam: CS2 in-game Private Rank, XP progress, Friend Code, Premier rating and per-map ranks
• Public lists we host: the pro-player database, the supporter-badge list and, if the pill is enabled, an inventory value estimate (see section 5)

The extension then renders these stats in a panel injected into the Steam profile page you're already viewing. Nothing is sent back to any server we operate.

The "trust check" verdict is computed in your browser out of the numbers already listed above. It is arithmetic on public stats, not a lookup: no profile is ever submitted anywhere to be scored, and no verdict is stored or shared.

3. Data we collect from you

None, as long as you only use the extension. It does not:

• collect personal identifiers (name, email, IP address, location)
• track your browsing history or which Steam profiles you view
• use cookies of its own
• run analytics scripts
• send crash reports or error telemetry
• fingerprint your browser
• create user accounts

We have no way to know which Steam profiles you look at, when, or from where, because no such logs are kept anywhere.

Buying a supporter badge is the one thing that does involve your personal data, because a payment cannot work without it. That is covered separately in section 6, and it happens on this website rather than in the extension.

4. Data the extension stores locally

The extension uses the standard storage permission to save only optional configuration in your browser:

• Your preferred display currency for the inventory value badge
• Your panel accent choice (default / custom color / adaptive)
• Which badges you want next to Steam nicknames, and how many map ranks to show
• Whether the advanced Leetify tiles (reaction time, pre-aim) are switched on
• Which panel sections you have collapsed

These values are stored via chrome.storage.sync, which means they live in your browser profile and may sync to your other signed-in browsers: through your Google account in Chrome, or your Mozilla account in Firefox. Both are run by those vendors, not by us, and we never see those settings.

The extension also keeps a short-lived cache in chrome.storage.local so that re-visiting a profile doesn't hit the same services again: in-game CS2 stats for 60 minutes, the inventory value estimate for 30 minutes, Faceit stats for 15 minutes, and the public pro-player list for 24 hours. This cache only holds data about the profiles you open, it stays in your browser, and clearing it is as simple as removing the extension.

No API keys, tokens, or personal data are stored. The extension has no such fields.

5. Third-party data sources

When you view a Steam profile, the extension makes HTTPS requests to the following services to fetch the stats it displays:

• api-public.cs-prod.leetify.com and api.cs-prod.leetify.com: public Leetify APIs
• ahake.pl: our Cloudflare Workers: Faceit stats proxy, CS2 in-game data (Private Rank, XP, Commendations), inventory value estimate, and the public supporter-badge list
• *.steamstatic.com / steamuserimages-a.akamaihd.net: the profile's own avatar/background images, downloaded solely to compute the "adaptive accent" color locally in your browser; nothing is sent anywhere
• cspulse.pl and flagcdn.com: static images only (per-map rank icons and country flag icons); these are plain image downloads that carry no data beyond the icon being requested

These services receive only the SteamID64 of the profile you're currently viewing. The one exception is the inventory value estimate: to price the items, your browser sends the item names of that profile's public CS2 inventory (fetched from Steam by your own browser) to our Worker together with the SteamID64. None of these services receive any information about you personally. Each service has its own privacy policy, which we do not control, so check each site directly for their current terms:

• leetify.com
• faceit.com
• steamcommunity.com

The Faceit proxy at ahake.pl/faceit-proxy is a Cloudflare Worker that forwards requests to Faceit's API. The Worker keeps a short-lived (5 minute) cache of responses keyed by SteamID64 to reduce load on Faceit's API. It enforces a per-IP rate limit (30 requests per minute) to prevent abuse, which means Cloudflare temporarily sees your IP address for that purpose. The proxy does not write logs that associate IPs with the SteamIDs being queried.

6. If you buy a supporter badge

Everything above is about the extension, which is free and asks nothing of you. The one place where real personal data enters the picture is the optional supporter badge, and that happens on this website, never inside the extension. If you have never bought one, this section does not apply to you.

The payment itself is handled by Stripe, under their privacy policy. Full card numbers never reach us. What we can see in our Stripe dashboard is the ordinary record of a sale:

• your email address, and the name on the card
• the card brand and its last four digits, and the billing country
• the amount, the date, and which tier you bought
• the SteamID64 you typed in before paying, so the badge can be granted to the right profile
• technical details recorded by Stripe's fraud checks, including your IP address. That part is Stripe's own processing, not ours

What we store ourselves is far less than that. Our own storage holds one thing: a list of SteamID64 to tier, so the extension knows which nickname gets a heart. That list has no email addresses, no names and no payment data in it, and it is the same list every copy of the extension downloads. If you linked your Discord account, we also store the pairing of your Discord user id to your SteamID64, so supporter roles can be kept in sync.

The sale record stays with Stripe for as long as accounting rules require, which is not something we can shorten. The badge entry stays until you ask for it to be removed, or until a refund, which removes it automatically. To see, correct or delete what we hold, ask on the Discord or open a GitHub issue. None of it is sold, shared with advertisers, or used to contact you about anything other than your own order.

7. Permissions we request

Your browser shows you a list of permissions when you install the extension. Here's what each one is actually used for:

• storage: to remember the display settings listed in section 4, and to keep the short-lived stats cache described there. This is the only permission the extension asks for beyond the hosts below. There are no API key or token fields anywhere in the extension
• steamcommunity.com/*: to inject the stats panel into Steam profile pages
• Leetify, Faceit, Steam, ahake.pl hosts: to fetch the stats listed above. ahake.pl is our API domain and stays separate from the website at cspulse.pl: moving it would force every existing install to re-accept permissions

The extension does not request access to your tabs, your browsing history, your downloads, your camera or microphone, your clipboard, or any other permission outside what's listed above.

8. Cookies

The extension does not set or read cookies.

The companion website at cspulse.pl also does not use cookies, analytics, or third-party tracking scripts.

9. Children's privacy

Counter-Strike 2 has an ESRB rating of Mature 17+ and a PEGI rating of 18. This extension is intended for users who are old enough to use Steam and CS2, which Valve's own terms restrict to age 13+. We do not knowingly collect any information from anyone. The extension simply collects no information at all.

10. Changes to this policy

If we change the way the extension handles data, we'll update this page and the "Last updated" date above. Substantial changes will also be noted in the extension's GitHub repository changelog.

11. Source available

The full source code of the extension is published on GitHub at github.com/ahakexd/cs2-stats-extension. You can read and audit every line, which is the most reliable way to verify that the claims above match the actual behavior of the extension. The code is source-available for review, not open source: it may not be copied, modified for redistribution, or reused in other products without permission (see the LICENSE file).