Privacy Policy

1. Who is responsible

Pulse, meaning the Pulse (CS2 Stats for Steam) browser extension, this website and the services behind them, is run by an individual developer known as ahake, who decides how the data described here is used and is its controller under the GDPR.

Contact for anything about privacy, including every request in section 14: [email protected]. You can also ask on the Pulse Discord, but you never have to: email works for everything. The source code is public for transparency at cspulse.pl/source (source-available; see the LICENSE file).

2. What the extension does

When you visit a Steam Community profile page (steamcommunity.com/id/<name> or steamcommunity.com/profiles/<id>), the extension reads the SteamID64 from the page and fetches publicly available statistics about that profile:

• Leetify: AIM rating, K/D, winrate, matches analyzed, recent form, and optionally reaction time and pre-aim if you switch on the advanced tiles
• Faceit: ELO, level, recent matches, headshot percentage, and any bans on the account together with their reason and dates, which Faceit publishes openly
• Steam: CS2 in-game Private Rank, XP progress, Friend Code, Premier rating and per-map ranks
• Pulse match history: if the player appears in matches tracked by Pulse users (section 7), their recent Pulse matches and averages
• Public lists we host: the pro-player database, the badge lists (supporter, server booster and reviewer) and, if the pill is enabled, an inventory value estimate (see section 5)

To get these numbers, the extension sends the SteamID64 of the profile you are viewing to our Workers (section 5). They pass it on to the sources above and return the stats, which the extension renders in a panel on the Steam page you are already viewing. We do not store which profiles you view.

The "trust check" verdict is computed in your browser out of the numbers already listed above. It is a heuristic built from public stats, not cheat detection, and not proof of anything. No profile is ever submitted anywhere to be scored, and no verdict is stored or shared.

3. What reaches us when you use the extension

Using the extension does not create an account, and you never give us your name, email or anything else about yourself. What still reaches us technically:

• The SteamID64 of each profile you view, sent to our Workers to fetch its stats (section 5). It identifies the profile, not you, and we keep no record linking it to your IP address and no list of the profiles anyone viewed.
• Your IP address, which every website you load sees. Our Workers use it to count requests for rate limits (section 5). Those counters expire within an hour at most and are not logs.
• A security alert, only when an IP address goes over a rate limit of our match history service or calls that service without the extension. The alert records the IP address, its country, its network (the ISP or hosting company), the browser name it reports, and the address it called, without any SteamID. It is posted to a private staff channel on our Discord server and used only to stop abuse (section 13 says how long it stays).
• Two page visits on this website: the welcome page the extension opens once after you install it, and the "what's new" page after a feature update, with the two version numbers in its address. They are ordinary visits, no different from typing the address yourself.

The extension does not:

• track your browsing history, or which Steam profiles you view
• set or read cookies of its own (section 9 lists the Steam requests your browser sends with its usual session)
• run analytics or tracking scripts
• send crash reports or error telemetry
• fingerprint your browser
• create user accounts

Buying a supporter badge (section 6) and turning on match tracking (section 7) are the two optional things that do involve data about you, and neither happens while you are simply browsing profiles.

4. Data the extension stores locally

The extension uses the standard storage permission to save optional configuration in your browser:

• Your preferred display currency for the inventory value badge
• Your panel accent choice (default / custom color / adaptive)
• Which badges you want next to Steam nicknames, and how many map ranks to show
• Whether the advanced Leetify tiles (reaction time, pre-aim) are switched on
• Which panel sections you have collapsed (this one in chrome.storage.local, so it stays on this device)

These values are stored via chrome.storage.sync, which means they live in your browser profile and may sync to your other signed-in browsers: through your Google account in Chrome, or your Mozilla account in Firefox. Both are run by those vendors, not by us, and we never see those settings.

The extension also keeps a short-lived cache in chrome.storage.local so that re-visiting a profile doesn't hit the same services again. The full list, with how long each entry lives:

• In-game CS2 stats: 60 minutes
• Leetify and scope.gg stats: 15 minutes
• Faceit stats: 15 minutes
• Peak Faceit ELO: 24 hours, keyed by the viewed player's public Faceit id
• The inventory value estimate: 30 minutes
• The public pro-player list: 24 hours
• A price catalogue used as a fallback for items the main source does not price: 12 hours. This one is a plain price list and holds nothing about any player
• A note that Steam has asked us to slow down on inventory requests: 5 minutes, so that a refresh does not walk into the same wall
• Your chosen sort order for the inventory grid, kept until you change it
• The SteamID64 of the Steam account you are signed in to, read from Steam's own page data, so the supporter form in the options can be filled in for you
• If you turned on match tracking: the random token our server gave your browser, so it can show the tracking status and disconnect, kept until you disconnect; the latest match token it sent us; and the status itself for 30 seconds. The match history code is not stored in the browser

No API keys are stored. Apart from the cached stats of the profiles you open, the only data about you the extension keeps in your browser are your own SteamID64 and, if you turned on match tracking, its token, the latest match token and the status, all listed above. They leave the browser only when you start a badge purchase yourself (section 6) or use match tracking (section 7). Removing the extension clears all of it.

5. Hosts the extension talks to

When you view a Steam profile, the extension makes HTTPS requests to the following hosts:

• ahake.pl: our Cloudflare Workers, the only hosts the extension sends stats requests to. They stand in front of Leetify (aim, K/D, winrate, headshots, Premier rating), scope.gg (used only as a fallback, when Leetify has nothing for that player), Faceit (ELO, level, recent matches, peak ELO), our own Game Coordinator bot (Private Rank, XP, Commendations), our match history service (for every profile you view, that player's Pulse matches and averages), the inventory value estimate, and the public supporter and pro-player lists. The stats services receive the SteamID64 of the profile you are viewing, and for the peak-ELO lookup that profile's Faceit player id; the public lists are downloaded whole and receive nothing. When you click a match to open its scoreboard, the Worker also receives that match's public Leetify, FACEIT or Pulse match id
• *.steamstatic.com / steamuserimages-a.akamaihd.net: the profile's own avatar/background images, downloaded solely to compute the "adaptive accent" color locally in your browser; nothing is sent anywhere
• cspulse.pl, this website: the welcome and "what's new" pages (section 3), and images only: per-map rank icons, and Steam level backgrounds on the options page
• flagcdn.com: country flag icons, plain image downloads that carry no data beyond the icon being requested
• steamcommunity.com and, only with match tracking, help.steampowered.com: the Steam pages and data listed in section 9

These services receive only the SteamID64 of the profile you're currently viewing, its Faceit player id for the peak-ELO lookup, and the match id of a scoreboard you choose to open. The one other exception is the inventory value estimate: to price the items, your browser sends the item names of that profile's CS2 inventory as Steam shows it to you (fetched from Steam by your own browser) to our Worker together with the SteamID64. None of these services receive any information about you personally. Leetify, FACEIT and scope.gg are asked by our Worker, not by your browser, so they do not see your IP address. Each service has its own privacy policy, which we do not control: leetify.com, faceit.com, Steam.

Rate limits. Each Worker counts requests per IP address in a short window, from one minute to one hour, to stop abuse; the Faceit proxy, for example, allows 30 requests per minute. These counters are not logs and expire with their window. The Faceit proxy also keeps a short-lived cache of responses keyed by SteamID64 to reduce load on Faceit's API: 30 minutes for a profile it found, and up to 6 hours for the answer "this SteamID has no Faceit account". No Worker writes logs that associate IP addresses with the SteamIDs being queried. The only place an IP address is recorded is the security alert of the match history service (section 3).

6. If you buy a supporter badge

Everything above is about the extension, which is free and asks nothing of you. The one place where real personal data enters the picture is the optional supporter badge. You can start it either here on the website or from the extension's own options page. In both cases the profile link or nickname you type, and the tier you pick, are sent to our server so the badge lands on the right account. If you have never bought one, this section does not apply to you.

The payment itself is handled by Stripe, under their privacy policy. Full card numbers never reach us. Giving your email and card details is required to buy a badge, because without them Stripe cannot take the payment. What we can see in our Stripe dashboard is the ordinary record of a sale:

• your email address, and the name on the card
• the card brand and its last four digits, and the billing country
• the amount, the date, and which tier you bought
• the SteamID64 of the profile you named before paying, so the badge can be granted to the right profile
• technical details recorded by Stripe's fraud checks, including your IP address. That part is Stripe's own processing, not ours

What we store ourselves is far less than that. Our own storage holds one thing: a list of SteamID64 to tier, so the extension knows which nickname gets a heart. That list has no email addresses, no names and no payment data in it, and it is the same list every copy of the extension downloads. If you linked your Discord account, we also store the pairing of your Discord user id to your SteamID64, so supporter roles can be kept in sync.

Supporters are also thanked on this website. The "Wear the heart" section of the homepage shows each supporter's Steam avatar, Steam nickname, a link to their Steam profile, their tier and that tier's price, taken from the public Steam profile named at purchase. If you would rather not be shown there, email [email protected] and we will remove you from the website; the heart next to your nickname in the extension stays.

The reviewer badge follows the same shape, without any payment. It is free and open to anyone. If you claim it on Discord, the bot opens a channel just for you, you send a screenshot of your review in the store, and a human checks it. Approving it adds your SteamID64 to the same public list the extension already downloads, in a separate array. The claim channel is deleted once the decision is made. The screenshot you sent stays in the moderation channel, where only the server owner can see it, and you can ask for it to be deleted at any time. No review text, store account or email is stored, because none of it is needed: the badge is granted to a SteamID64 and nothing else.

None of this is sold, shared with advertisers, or used to contact you about anything other than your own order. How long each part is kept is in section 13.

7. If you turn on match tracking

In one sentence: match tracking stores your matches, including the game statistics of the other nine players in each of them, and anyone using the extension can see stats from our database on a player's Steam profile. The details follow.

Match tracking is optional and off until you switch it on. It can only be started from your own Steam profile, with the "Track matches" button next to Edit Profile, after a window that explains it and asks you to agree. If you never click it, the parts of this section about your own account do not apply to you.

What the extension reads. With your permission, it opens Steam's own support page for CS2 game authentication codes (help.steampowered.com) and reads two things from the "Access to Your Match History" section: your match history authentication code and your latest match token. You can also type both in yourself instead. Nothing else on that page is read or sent. Right after you connect, the extension also reads the list of your own recent Premier and Competitive matches from your Steam "Personal Game Data" page on steamcommunity.com, which it can already access, and sends us the replay links of matches from the last 30 days, so those are analyzed too. If tracking pauses because your latest known match is more than a month old, the extension reads only your latest match token from Steam's support page again (when you open your own Steam profile, and every few hours in the background) and sends it to us, so tracking resumes after your next match.

What we store about you. Your SteamID64, the authentication code (encrypted with AES-256-GCM, with the key kept apart from the database), your latest known match token, the date you connected, and a fingerprint of a random token that only your browser holds. The code itself is never kept in your browser.

What we do with it. Our server asks Steam whether you played a new Premier or Competitive match, more often the more recently you played: every 5 minutes while your public Steam status shows you in CS2 and for two hours after a match, about every 15 minutes if you played in the last day, and every 30 minutes to 6 hours after a longer break; right away when you open your own Steam profile. To see whether you are in CS2 it reads the game shown in your public Steam profile summary every 5 minutes; that is kept only in memory and never stored. For each new match it asks the Steam Game Coordinator, through our own bot, for the replay link and the scoreboard, downloads the replay through our Cloudflare Worker, analyzes it, and deletes the replay right after the analysis, in every case within 48 hours. To show who queued together, it also reads the public Steam friend lists of the ten players: teammates who are Steam friends are shown as a party. Those lists are kept in memory for at most a day for this and are never stored; only the party marker stays with the match. Once a day it also checks the public Steam ban status (VAC and game bans) of the players from matches of the last 90 days, so a match can be marked when someone in it was banned afterwards; we keep only the number of bans and the estimated date of the latest one. The code is read-only: it lets us see your match history and nothing more. It gives no access to your account, password, inventory or trades.

What we keep from each match. The map, date and score, and per-player statistics for all ten players: the nickname they had in that match, kills, deaths, assists, damage, MVPs, multi-kill rounds, Premier rating before and after, and aim figures such as headshot accuracy, time to damage, preaim, spray and counter-strafing accuracy. The other nine players are in it because a match only makes sense as a whole; these are game statistics tied to a SteamID64, the same kind public CS2 stats sites publish.

Who can see it. The recent matches of any player in our database appear in the Form strip of the panel on that player's Steam profile, and clicking one opens its scoreboard, the same way Leetify and FACEIT matches are shown. A player with no Leetify data, or with 30 or more matches in our database, gets a Pulse section with averages from their recent matches. Players banned after a match are marked on that match, and if you turned on match tracking, your own profile tells you when someone from your recent matches was banned. Once a match you played after connecting has been analyzed, a "Pulse Tracking" badge appears next to your nickname for other Pulse users; it disappears when you disconnect or revoke the code. If you also linked that Steam account on the Pulse Discord server, our bot gives you the Pulse Tracking role there and can send you a private summary of each tracked match, including the scoreboard; one button under any of those messages turns them off. Before the bot does this, you prove the Steam account is yours: you sign in through Steam at cspulse.pl/link (Steam tells us only your SteamID64) and type the one-time code you get there into Discord. The code works once and expires after 15 minutes; we keep nothing from the sign-in except the link between your Discord user id and that SteamID64.

Cards after FACEIT matches. With match tracking on, the bot can also send you that card after a FACEIT match. For this our server looks up your FACEIT account by your SteamID64 through FACEIT's official Data API and checks your public FACEIT match history: every few minutes while your public Steam status shows you in CS2, and less often otherwise. We store your FACEIT player id and the ids and end times of FACEIT matches you played after connecting; the scoreboard and your ELO change come from FACEIT's public data when the card is sent and are not stored on our server. FACEIT matches are not analyzed and do not count towards your Pulse statistics. Two switches under Match history in the extension's options, Premier and Competitive, and FACEIT, turn the cards on or off for each connected account; both are on by default, and the bot's "Stop match messages" button turns both off.

If you are one of the other players. You can see what we hold about your account, remove it, and stop us from storing it, at cspulse.pl/data-request: you sign in through Steam, which proves the account is yours and gives us only your SteamID64, never your password. You can also email [email protected]. After a removal we keep only your SteamID64 on an exclusion list, so your statistics are left out of every future match as well. Turning on match tracking for that account later is your own choice and lifts the exclusion.

Where it lives. On our server in the European Union (OVH, Poland), reached through Cloudflare. It is not sold, not shared with advertisers, and not used to contact you.

How long. Match history is kept for as long as Pulse runs, so statistics can cover a whole history, unless you disconnect, remove it as described above, or ask us to delete it. Once a night an encrypted copy of the database goes to Cloudflare R2 storage in the EU, in case our server fails; daily copies are deleted after 30 days and monthly copies after a year, so anything deleted also disappears from the copies within a year at the latest.

How to stop it. Click "Disconnect and delete data" in the extension's options. That removes the stored code, your pending matches and your own statistics rows; the matches themselves stay with the other players' statistics, without yours. You can also revoke the code on Steam's support page at any time: we notice and stop on our own, but note that revoking disconnects every site that uses the same code, Leetify included. Without either step the data stays while the connection is active.

8. Permissions we request

Your browser shows you a list of permissions when you install the extension. Here's what each one is actually used for:

• storage: to remember the display settings listed in section 4, and to keep the short-lived stats cache described there
• alarms: to wake the extension every few hours in the background. It only does something when match tracking is on and paused, to resume it (section 7)
• steamcommunity.com/*: to inject the stats panel into Steam profile pages, and to read the Steam data listed in section 9
• *.steamstatic.com/* and steamuserimages-a.akamaihd.net/*: Steam's own image hosts, for item icons and avatars
• ahake.pl/*: our API domain, and the only host we operate that the extension sends requests with data to. cspulse.pl is only opened as pages and image downloads (section 5). ahake.pl stays separate from the website at cspulse.pl: moving it would force every existing install to re-accept permissions
• help.steampowered.com/* (optional): asked for only when you click "Allow and connect" to turn on match tracking (section 7), and used only to read your match history codes from Steam's support page. Disconnecting gives it back. In Firefox the same click also asks for the "authentication information" data permission, because the code is sent to our server

storage and alarms are the only permissions beside the hosts above. There are no API key fields anywhere in the extension, and it does not request access to your tabs, your browsing history, your downloads, your camera or microphone, your clipboard, or anything else.

9. Cookies and requests made with your Steam session

The extension does not set or read cookies itself. A few requests to Steam are sent by your browser with your existing Steam session attached, exactly as when you open those pages yourself:

• The viewed profile's CS2 inventory, for the inventory estimate. Steam only answers it for an inventory that is visible to you, so on a friend's profile the extension reads an inventory the public cannot see, and on your own profile it reads yours. What leaves the browser afterwards is the list of item names, so they can be priced
• steamcommunity.com/my/?xml=1, only on Steam pages under /my/, whose address carries no profile id: it tells the extension which account that is. Nothing from it is sent anywhere
• With match tracking only: Steam's support page with your match history codes (help.steampowered.com), read when you connect and again while tracking is paused (section 7)
• With match tracking only: your "Personal Game Data" page on steamcommunity.com, read right after you connect to import your recent matches (section 7)

No other request carries cookies. The website at cspulse.pl does not use cookies, analytics, or third-party tracking scripts.

10. Age

Counter-Strike 2 has an ESRB rating of Mature 17+ and a PEGI rating of 18. Pulse is meant for people old enough to use Steam and CS2, which Valve's own terms restrict to age 13 and up, and we do not knowingly collect data of anyone younger. Match tracking relies on your consent, and under the GDPR consent given by someone under 16 (in some EU countries the age is lower, but never under 13; in Poland it is 16) counts only with a parent's approval: if you are under that age, ask a parent before you turn it on.

11. Why we may use this data (legal bases)

12. Who processes data for us, and transfers

• Cloudflare: hosts this website and our Workers, enforces rate limits, and stores the encrypted database copies (in the EU)
• OVH: our server in Poland, with the match history service and our bots
• Stripe: payments for supporter badges
• Discord: the Pulse server, our bot's messages, and the private staff channel with security alerts
• Valve (Steam), Leetify, FACEIT and scope.gg: the sources our Workers ask for public stats, with the SteamID64 of the viewed profile (section 5)

Cloudflare, Stripe and Discord are US companies, so some data may be processed outside the European Economic Area. Those transfers rely on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses, as set out in each provider's terms. We do not sell data and do not share it with advertisers.

13. How long we keep it

14. Your rights

You can ask us for access to the data we hold about you, to correct it, to delete it, to restrict how we use it, to receive it in a portable format (for data based on your consent or a contract), and you can object to any use based on legitimate interest. Where we rely on your consent, you can withdraw it at any time, which does not affect what happened before. Write to [email protected]; for match statistics you can also use cspulse.pl/data-request, and for match tracking of your own account the "Disconnect and delete data" button. We may ask you to prove that a Steam account is yours, for example by signing in through Steam.

You also have the right to lodge a complaint with a data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl; you can also turn to the authority in your own EU country.

15. Changes to this policy

If we change the way Pulse handles data, we'll update this page and the "Last updated" date above, and note the change here:

• October 22, 2026: linking a Steam account to Discord for match cards now needs a Steam sign-in at cspulse.pl/link and a one-time code, so nobody can receive someone else's match cards by typing their SteamID.
• October 18, 2026: cards after FACEIT matches for accounts with match tracking, with your FACEIT player id and FACEIT match ids stored while you stay connected, and two switches for the cards in the extension's options.
• October 12, 2026: rewritten to describe every place data reaches us, including the IP address in security alerts and the requests sent with your Steam session; added the controller's email, legal bases, recipients and transfers, retention periods and your rights; described the supporters shown on the website; added the page for other players to remove their match statistics (cspulse.pl/data-request); added a Polish translation.
• October 8, 2026: match tracking checks paced by how recently you played, and the public Steam status read to see whether you are in CS2.

16. Source available

The full source code of the extension is published at cspulse.pl/source. You can read and audit every line, which is the most reliable way to verify that the claims above match the actual behavior of the extension. The code is source-available for review, not open source: it may not be copied, modified for redistribution, or reused in other products without permission (see the LICENSE file).