Privacy Policy

rockvel.store6 November 2026

This is a draft. The marked places will be filled in with counsel.

Who is responsible for your data

  1. People's data on Rockvel is processed by [operator: legal name, registration number, address], called "we" below. Write to [address for data questions] about your data.
  2. We collect only what deals and money can't work without. We don't sell data, and there are no ads or ad trackers on the site.

What we collect

  1. From Steam when you sign in: your Steam ID, and the name and avatar of your public profile. Your Steam password and email never reach us: you sign in on Steam's own site.
  2. What you enter: your trade link, the prices and descriptions of your listings, bargains, auto-buys and settings.
  3. Through the extension: the items in your CS2 inventory with their properties (float, pattern, stickers and the like), and the state of the Steam trade offers for your Rockvel orders. More in section 6.
  4. Deals and money: orders, deals, disputes, balance movements, deposit addresses, the addresses deposits came from, withdrawal addresses and transaction hashes.
  5. Notifications: your Telegram chat if you connect it, and, once they arrive, your browser's subscription and your email.
  6. Support tickets: the topic, your messages and screenshots, support's answers, and the number of the deal you write about. We keep a screenshot without the file's metadata, such as where it was taken.
  7. Sign-in and keys: sessions and your API key. We keep only their hashes, so even a copy of our database can't open your account.
  8. Our services don't record IP addresses or what you browse, and there is no analytics on the site. [Hosting logs: confirm with the provider what it keeps and for how long].

Why

  1. To run the market: sign-in, listings, purchases, trade offers, payouts and withdrawals. Without this we can't keep our contract with you.
  2. To protect people and money: settling disputes, banning for trade reversals and fraud, checking addresses against sanctions lists.
  3. To tell you about your deals in the channels you connected yourself. You can turn them off in your profile.
  4. To follow the law: bookkeeping, and answers to lawful requests from authorities.

What others see

  1. Everyone. While "Show my stall to everyone" is on, your stall is open at an address with your Steam ID: your name, avatar and listings. If you close it, your listings stay on the market without the seller's name.
  2. The seller and the buyer. The buyer's trade link goes to the seller's extension to make the trade offer. In a Steam trade offer each side sees the other's Steam account.
  3. Anyone on the blockchain. Blockchain addresses and transfers are open to all and stay there for good.

Who we share data with

  1. Valve (Steam): we read your public profile through the Steam Web API, and trade offers go through Steam.
  2. Telegram: the text of notifications about your deals, if you connected Telegram, and your support tickets with their screenshots, your name and Steam ID: support reads and answers them in Telegram.
  3. Blockchain nodes: the addresses and transactions we check and send. Providers: [list of node providers].
  4. Hosting:[provider and the country of the servers].
  5. Authorities, only when the law requires it.
  6. These companies work in different countries, so your data may be processed outside your own.

The extension

  1. A seller needs the Rockvel browser extension to list items and send them to buyers.
  2. It reads your CS2 inventory on steamcommunity.com and sends Rockvel only the list of items with their properties.
  3. It makes trade offers to the buyer's trade link and, while you have open sales, checks your Steam trade offers and trade history every 3 minutes. Only what concerns your orders is sent to Rockvel.
  4. The extension can't see your Steam cookies. The Steam Web API token stays in your browser's memory and never reaches us.
  5. What the extension collects is used only to run Rockvel: it is not sold, not passed on for advertising and not used to judge creditworthiness.

Cookies

  1. The site sets only cookies it can't work without, so there is no consent banner.
    CookieLastsWhat for
    rv_session30 daysKeeps you signed in
    rv_login_state10 minutesProtects sign-in through Steam from forgery
    rv_login_language10 minutesBrings you back from Steam in your language

How long we keep data

  1. Account data, for as long as the account exists.
  2. Deals and money movements, for [5] years after your last deal: for disputes, bookkeeping and anti-money-laundering checks. [Period: set with counsel].
  3. Your inventory, only as the latest copy read: each read replaces the one before.
  4. A session, for 30 days or until you sign out.
  5. Data on a blockchain can't be deleted by anyone, us included.

Your rights

  1. You can learn what data we hold about you, get a copy, correct it, have it deleted, object to its use, and take back your consent to notifications.
  2. You can change your trade link and notifications in your profile. For the rest, write to [address for data questions]. We answer within 30 days.
  3. Deletion doesn't reach what we must keep (section 8), or data on a blockchain. An account with open deals or money on its balance can be deleted once they finish and the money is withdrawn.
  4. You may complain to the data protection authority of your country.

Security

  1. The sign-in cookie is out of reach of page scripts, sessions and keys are stored as hashes, and wallet keys are kept by a separate signing service that takes no incoming connections.
  2. The site never asks for your Steam password or Steam Web API key.

Children

  1. Rockvel is not for anyone under 18. An account we learn belongs to a child is closed.

Changes

  1. We publish a new version here with its date, and give notice of material changes on the site and in the notifications you have connected. See also the Terms of Service.