Privacy Policy

One person runs Postplant: Anthony Loukinas, operating Postplant, Ohio, United States. That person decides how your data is used, so under data protection law they are the controller. Write to support@postplant.org about anything in this policy.

• Your name and email address, and a hash of your password if you sign in with one. We never store the password itself.
• If you sign in with Steam or FACEIT, or link those accounts: your SteamID or your FACEIT account ID. When you sign up with one of them, we copy your display name and avatar from it.
• If you turn on Steam match sync: your match history authentication code, which lets us find your new matches.
• Each time you sign in: a session record with your IP address and your browser's user agent.
• How you found us: the site that sent you and any campaign tags in the link, from your first visit, and your answer if you tell us where you heard about Postplant.
• The demos you upload or import, and what we make from them: match pages, replays and stats.
• What you add: team names, review notes, lineups, drawings, strategies, training routines and results, and reactions in the feed.
• Your plan and its status. Every account also gets a customer record at Polar when it is made, even if you never buy a plan. Polar holds your payment details, so we never see them.
• If you start a game server: its settings and how long it ran.
• The emails you send us.

A CS2 demo records everyone in the match, so we hold data about players who have never used Postplant:

• their SteamID, the name they played under, and what they did in each match, such as positions, kills and damage;
• for FACEIT league play, team names and rosters and the matches those teams played.

This comes from demos our users upload or import, and from public FACEIT league data. We use it to show match pages and player profiles. Anyone with the link can open a player profile or a match page. We ask search engines not to crawl them.

If this is you and you want your profile hidden or your data erased, write to support@postplant.org with your SteamID. We may ask you to show that the Steam account is yours. We answer within 30 days.

• To run your account, your matches and your plan. We need this to provide the service you signed up for.
• To show match pages and profiles, including those of players who never signed up. Our users have a legitimate interest in reviewing the matches they played, and so do we in providing that.
• To keep Postplant secure and working: stopping abuse, fixing bugs and keeping backups. This is our legitimate interest in running a safe service.
• To learn which sites and links bring people to Postplant. This is our legitimate interest in knowing where users come from.
• To send account email, such as the message that confirms your address.
• If we ever send news by email, it will be only to people who opted in, and every one will have a link to stop them. You can withdraw your consent at any time.
• To meet legal duties, such as keeping records the law requires.

We don't sell your data, we don't show ads, and we don't build advertising profiles of you.

• Anyone with the link can see match pages and player profiles. There is a profile for every SteamID that appears in a demo on Postplant, whether or not that player has an account or has linked it.
• Members of a team you join can see your name, the matches added to the team, and the notes, drawings and strategies you add there. They don't see your email address.
• People who follow you can see your new matches in their feed.
• Other users can't see your email address.

Our servers, database and file storage run on hardware we operate ourselves, in the United States. These services handle some data for us, each only for its own part:

• Polar sells our plans as the merchant of record and handles payment, tax, invoices and refunds. When you make an account, we create a customer record for you at Polar with your name, email address and Postplant user ID, whether or not you buy anything. If you buy a plan, Polar also sees your billing address and payment details. We never see your card number.
• Resend delivers our email, so it sees your email address and the messages we send you.
• Cloudflare runs our domain names and may carry traffic to the site. When it does, it sees IP addresses and the requests your browser makes.
• Valve runs Steam sign-in and supplies your match history, the demos of your Steam matches and player avatars. It sees your SteamID, and your IP address when your browser loads an avatar.
• FACEIT runs FACEIT sign-in and supplies match imports, league match lists and team avatars. It sees your FACEIT account ID. League team avatars, and your own avatar if you signed up with FACEIT, load straight from FACEIT's servers, so FACEIT sees your IP address when your browser loads one.
• DatHost runs the game servers you start from Postplant. It sees your server's settings, and the IP address and SteamID of each player who joins.

We don't share your data with anyone else unless the law requires it.

We use no analytics, no ads and no third-party scripts. These are the cookies Postplant sets:

• __Secure-better-auth.session_token keeps you signed in. It refreshes once a day while you use Postplant and expires 7 days after the last refresh.
• steam_redirect, faceit_redirect, faceit_verifier and faceit_state carry a Steam or FACEIT sign-in through, for 10 minutes.
• pp_nav_collapsed (1 year), pp_link_snooze (7 days) and pp_steam_reclaim_dismissed (1 year) remember that you collapsed the sidebar or dismissed a reminder.
• pp_ref is set when you arrive from another site or from a link with campaign tags. For 7 days it remembers where you came from, so that if you sign up we can count which sources bring new users. It is the one cookie the site doesn't need in order to work, and we are replacing it with a method that uses no cookie.

Your browser's own storage keeps your light or dark theme, and some screen state for as long as the tab is open.

When Cloudflare carries our traffic, it may set a cookie of its own to tell people from bots. Player avatars load straight from Steam's servers, so Valve sees your IP address when your browser fetches them. League team avatars, and the avatars of people who signed up with FACEIT, load straight from FACEIT's servers, so FACEIT sees it too.

• Raw demo files: about 14 days, or 30 for league matches, once the match has been processed. We may keep one longer while we reprocess matches after an update, and a file we could not process may stay until we clear it.
• Match pages, replays and stats: kept. We remove them when the uploader deletes them or on request.
• Sign-in sessions, with your IP address and browser: until a day or two after they expire, which is about a week after you last used Postplant.
• Uploads that never finished: 1 day.
• Server logs: no longer than 30 days.
• Database backups: 30 days.
• Copies of uploaded files in our backup store: kept until we clear them. We are adding a 30-day limit.
• Your account: until you delete it. The next section says what stays after that.

You can ask us for a copy of your data, to correct it, to delete it, or to send it to you in a form you can take elsewhere. You can also object to how we use it, or ask us to limit it. Deleting your account and downloading your data from Settings are coming. Until then, write to support@postplant.org from the email address on your account, and the operator handles your request by hand. If you signed up with Steam or FACEIT, your account may not have a real email address. In that case, write from any address with your SteamID or your FACEIT nickname, and we may ask you to show that the account is yours. We answer within 30 days.

When we delete an account, we delete your sign-in details and sessions, your linked Steam and FACEIT IDs, your follows and your own settings. Matches stay, because they belong to every player in them. We remove the link between your account and the matches you played in, and the matches you uploaded stay on Postplant. Copies in our backups are kept for the times listed above.

If you own a team, deleting your account deletes the team and everything in it, such as its lineups, routines, strategies and reviews. If the team should carry on without you, ask us to make another member the owner before you delete your account. Strategies you made are deleted on every team. On teams you only belong to, the team keeps your notes and drawings.

Your personal lineups, personal routines and training history are not deleted with your account yet. We are adding a step that removes them. Until then, ask us to remove them when you write to us.

If you think we got something wrong, please tell us first. You can also complain to the data protection authority where you live.

Postplant is not for children under 13. If we learn that an account belongs to someone younger, we delete it. Parents who think this has happened can write to support@postplant.org.

In some EU countries you must be 16 to give consent online on your own, for example to news email. Below that age, a parent has to agree for you.

Postplant runs in the United States. If you use it from another country, including the EU or the UK, your data is sent to the United States so that we can provide the service to you. Some of the services listed above may also handle it in other countries.

Traffic to the site is encrypted, and passwords are stored only as hashes. Access to the servers is limited to the operator and the tools used to run and maintain the service. No system is perfectly secure. If something goes wrong that affects your data, we will tell you as the law requires.

When this policy changes, the date at the top changes too. If a change matters, we will tell you by email or in the app. The Terms of Service and the Refund Policy share this version.