Privacy policy

CSMIX is run by a private individual in Latvia. For any question about your data, write to [email protected].

• From Steam: your SteamID and the name and avatar of your public profile. We never receive your Steam password: you sign in on the Steam website.
• On the game servers: statistics (experience, level, kills, deaths, assists, shots, hits, headshots, rounds, playtime, join dates), your IP address when you connect, punishments (type, reason, duration, who issued and removed them), your chosen skins and menu language.
• On the website: your session after sign-in (a random identifier, IP address and browser), site settings, skin collections and likes, and technical web server logs (IP address, time, page, browser).

We do not collect your name, email, phone number or payment details, and we do not use advertising or analytics tracking.

• Running the website and servers (sign-in, profile, statistics, skin changer, collections, settings) - performance of a contract, i.e. our Terms (Art. 6(1)(b) GDPR).
• Fair play (anti-cheat, punishments, preventing ban evasion) - legitimate interest: fair games for everyone (Art. 6(1)(f)).
• Security (protecting accounts, preventing attacks and abuse) - legitimate interest (Art. 6(1)(f)).
• Public profiles, the leaderboard and punishments shown in profiles - legitimate interest: competition and transparent moderation (Art. 6(1)(f)).
• Legal compliance (requests from authorities) - legal obligation (Art. 6(1)(c)).

You can object to processing based on legitimate interest - see "Your rights".

Your name, avatar and SteamID, level, statistics, leaderboard position, punishments with reason and duration, equipped skins and public collections. Profiles of players who have not played for a long time or have played very little are hidden from search engines.

The anti-cheat on our servers automatically detects signs of cheating and can issue a ban. You have the right to have the decision reviewed by a person, to explain your point of view and to contest it - write to [email protected].

We do not sell data. It is shared only with the providers the Service cannot run without:

• OVH - hosting of the website and database (EU);
• Cloudflare - attack protection and content delivery (EU and USA; transfers under the EU-US Data Privacy Framework and EU Standard Contractual Clauses);
• our game server provider - hosting of the CS2 servers;
• Valve (Steam) - Steam sign-in and profile data; Valve is responsible for data in Steam under its own policy. When the site shows avatars, your browser loads them from Steam servers, so Valve sees your IP address.

Data is disclosed to authorities only where the law requires it.

• website session - 30 days after your last sign-in;
• technical sign-in cookies - 10 minutes;
• web server logs - 14 days;
• statistics, settings and collections - while you use the Service; after 24 months of inactivity they may be deleted or anonymised;
• punishments - while active and for 12 months after they end; permanent bans for cheating - for as long as the ban applies;
• correspondence - until the matter is resolved and for 12 months after.

We only use strictly necessary cookies, so no consent banner is required:

• csmix_sid - your session after Steam sign-in, 30 days;
• csmix_state and csmix_ret - protect the Steam sign-in and return you to the right page, 10 minutes;
• NEXT_LOCALE - your chosen site language, 1 year;
• in browser storage (csmix.modeview, csmix.favorites) - server list filters and favourite servers.

Cloudflare may set a technical bot-protection cookie (for example __cf_bm, up to 30 minutes). There are no advertising or analytics cookies. You can delete cookies in your browser settings, but without csmix_sid you cannot sign in.

You can find out what data we hold about you and get a copy, correct it, ask for it to be erased or for processing to be restricted, receive it in a machine-readable format, object to processing, and ask for a human review of an automated decision.

Write to [email protected] and include your SteamID. To make sure the request is yours, we may ask you to sign in on the site through Steam. We reply within one month, free of charge. Active punishments are not deleted while they apply - otherwise a rule breaker could evade a ban.

If you believe we are violating your rights, you can complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija, dvi.gov.lv) or to the data protection authority of your EU country.

The Service may be used from the age of 13; under 18 with your parents' knowledge. If a child under 13 uses the Service, parents can write to us and we will delete the data.

The website works only over HTTPS, and session cookies are not accessible to page scripts. The website's access to the database is limited: it can only read statistics and punishments and change only skin settings. Keys and passwords are stored only on the server. We will report a serious data breach to the supervisory authority within 72 hours, and to players if there is a high risk.

We update this policy when the Service changes. We will announce significant changes on the website.