CaseFramesPrivacy
Last updated: 11 October 2026
Who is responsible
CaseFrames is an unofficial, fan-made CS2 container opening simulator with virtual currency only; it currently earns no revenue and shows no ads. The controller of your personal data is Juan de Dios García de Ves, a private individual based in Spain who operates CaseFrames personally. Privacy requests: contact@caseframes.com. See also the legal notice.
In short
- Playing as a guest needs no account; your save stays in your browser. Each opening also sends a separate anonymous report for the public activity counter: it contains a random ID for that opening, but not your save, account or any persistent device identifier.
- Steam sign-in is optional, for people aged 18 or older (self-declared). It keeps a private cloud copy of your virtual progress.
- CaseFrames receives your public SteamID64 from Steam, never your Steam password.
- A CaseFrames Steam account includes a public player profile and leaderboard participation. It becomes public only after you acknowledge this, and you can make it private again at any time.
- Your public profile shows your Steam display name and avatar and selected CaseFrames progress; never your SteamID, balance, inventory, history or cloud save.
- CaseFrames does not sell personal data or use it for advertising. You can download or delete it yourself.
Steam sign-in
Signing in uses Steam's official OpenID login. You enter your details on Steam's own website, operated by Valve Corporation (United States), which processes them as an independent controller under its own privacy policy. Steam then tells CaseFrames your SteamID64, and the CaseFrames server confirms that answer directly with Steam. CaseFrames never receives your password, Steam Guard codes, e-mail address, friends, inventory or payment information, and nothing in your Steam account is changed.
To show your Steam display name and avatar, the CaseFrames server requests your public profile summary from Steam's Web API, sending your SteamID64, and fetches your public avatar image; your browser does not contact Steam's image servers for it.
Steam accounts are for people aged 18 or older. After signing in you confirm this yourself. CaseFrames does not verify your age and never asks for a date of birth or an identity document; it stores only that you confirmed, when, and which version of the rules. If you say you are under 18, you are signed out and nothing about your age is stored. You can still download or delete data already linked to your Steam account.
Signing in sets cookies that are strictly necessary for the feature you request: an HttpOnly session cookie (30 days without use, at most 90 days), a 10-minute cookie that protects the sign-in from being forged, and a cookie that only tells the page that you are signed in. They are not used for analytics or advertising.
What is processed, why, on which basis and for how long
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Guest progress (virtual balance, items, history, statistics, achievements) in your browser's local storage | Lets you play without an account | None needed: CaseFrames does not process it (it stays in your browser and is never uploaded) | Until you reset it or clear site data |
| SteamID64; public Steam display name, avatar and profile link; account creation and last sign-in times | Your Steam-linked cloud account | Providing the account you request (Art. 6(1)(b) GDPR) | Until you delete the account; profile details refreshed at sign-in |
| 18+ declaration: that you confirmed, when (UTC) and which version of the rules | Applying the 18+ rule for Steam accounts | Legitimate interest in applying our account rules (Art. 6(1)(f)) | Until you delete the account |
| Cloud save (virtual progress) and up to five earlier versions taken at most every 15 minutes | Continuing on other devices; recovering from a bad save | Providing the account you request (Art. 6(1)(b)) | Until you delete the account; earlier versions are replaced over time |
| Lifetime ranking statistics: totals imported once from your cloud save when your account is first set up under the leaderboard system (openings, weapon cases, gold drops), and a record of each opening the server performs for you afterwards (container, number opened, rewards, time) | Your public profile and the leaderboards | Providing the Steam account service you accepted (Art. 6(1)(b)); keeping rankings fair and duplicate-free (Art. 6(1)(f)) | Until you delete the account; the copy of an opening's rewards kept to answer a repeated request, 7 days |
| A summary of your cloud save's achievements (number unlocked, up to three of them) | The achievements summary on your public profile | Providing the Steam account service you accepted (Art. 6(1)(b)) | Replaced with every save; until you delete the account |
| Your acknowledgment of the public-account conditions (version and time) and a random public profile ID | Showing your profile only after you acknowledged the conditions, and keeping its address stable | Providing the Steam account service (Art. 6(1)(b)); being able to show what you acknowledged (Art. 6(1)(f)) | Until you delete the account |
| Case Battles: rooms you create or join (room name, settings, ordered cases, and for private rooms only a one-way hash of the room password), your seat, team and readiness, the server-drawn result of every round (item, quality, value used for scoring) with the final standings, and the version and time of your confirmation of the Case Battles notice | Running the battles you take part in and showing their results | Providing the Steam account service you accepted (Art. 6(1)(b)) | Waiting rooms expire about 30 minutes after their last activity. Room records are deleted about 30 days after the room expired, was cancelled or ended (hourly cleanup; longer only while community-counter delivery is pending). Notice confirmation: until you delete your account. Items, history and verified statistics: until you delete your account, as for other openings |
| Sessions: one-way hash of a random sign-in token, with creation, last use and expiry times | Keeping you signed in securely | Providing the account (Art. 6(1)(b)) and security (Art. 6(1)(f)) | 30 days without use, at most 90 days; records deleted about 30 days after expiry |
| Hashed sign-in attempts (no SteamID) and save operation IDs | Preventing forged, replayed or duplicated requests | Security (Art. 6(1)(f)) | Sign-in attempts up to about one hour; operation IDs 7 days |
| Deletion record: a keyed code identifying a deleted account record, and the deletion time (no SteamID, name or save) | Keeping a deleted account deleted if a backup is restored | Giving effect to your erasure request (Art. 17) and data integrity (Art. 6(1)(f)) | 70 days after deletion |
| Anonymous opening reports, sent separately from your save for each opening (container, items received with rarity, StatTrak/Souvenir, a random ID for that opening; no account, balance, inventory or persistent device identifier) | The public opening counter and latest rare drops | Legitimate interest in showing aggregate activity (Art. 6(1)(f)) | Opening IDs 90 days; the 500 latest high-tier drops |
| Connection data in the hosting provider's server and network logs (such as IP address, browser and requested page) | Delivering and protecting the website | Security and operation (Art. 6(1)(f)) | Set by the hosting provider; no confirmed duration (see below) |
| Analytics and advertising data handled by Google's tags, when enabled for the site | Measuring how the site is used; advertising | Consent, where the law requires it (Art. 6(1)(a) GDPR, art. 22.2 LSSI-CE) | Set by Google under its settings and policies |
Cloud saves are private synchronization of virtual progress without real-world value. Selected progress is shown on your public profile and in the leaderboards once you have acknowledged the public-account conditions (see below). There are no automated decisions with legal or similarly significant effects.
Public profiles and leaderboards
Linking a Steam account to CaseFrames includes a public player profile and leaderboard participation. Before you go to Steam, you tick an acknowledgment of this; once Steam has confirmed your sign-in, we record with your account that you acknowledged it, when, and which version of the account terms. Your profile is public only after that and after your separate 18+ confirmation. An account without a recorded acknowledgment, including every account that existed before leaderboards launched, stays private and is asked again; until then its cloud play waits and its data stay intact.
Your public profile can be seen by anyone, including visitors who are not signed in: your Steam display name and avatar, your CaseFrames level and rank, lifetime XP, weapon cases opened and gold drops, your positions in the three leaderboards, a summary of your achievements and the month you joined. Each leaderboard shows the top 50 players with their display name, avatar and ranked value. The profile address uses a random public ID, not your SteamID. Your SteamID, virtual balance, inventory, opening history, cloud save and sign-in details are never shown.
Rankings use lifetime totals. The first time your account is set up under the leaderboard system (usually the next time you sign in, which may be after leaderboards launched), the totals already recorded in your cloud save are copied once (openings, weapon cases opened and knives and gloves unboxed from cases); this history was generated in the browser and is shown as imported, not as verified. Some very old openings were saved without enough detail to tell which container they came from or what they contained: they still count toward your lifetime XP, but not as weapon cases or gold drops. From then on, the CaseFrames server performs your openings and records each one, so they are counted exactly once.
We process this to provide the Steam account service as described, which includes the public profile (Art. 6(1)(b) GDPR). Acknowledging the conditions is not a consent to anything else. You can make your account private at any time on your profile page: your profile and leaderboard entries disappear within seconds and your data are kept, but cloud play pauses until you accept again, because the public profile is part of the account. If you prefer not to have a public profile, you can play as a guest, and you can download or delete your account data at any time. If you decline the conditions, you are signed out and your account stays private.
While your profile was public, others may have seen or copied it; the pages ask search engines not to index them, and these pages are not stored by shared caches. Deleting your account removes your public profile, leaderboard entries and ranking statistics. The rankings show what was recorded for each account; they do not prove that a person played without automation or uses only one Steam account.
Case Battles
Case Battles are rooms in which Steam players open the same cases together, round by round. Only Steam accounts that have confirmed 18+ and accepted the public-account terms can create or join one; guests can only look at public rooms. In a battle, the other players and, for a public room, any visitor can see the room name and settings, each participant's Steam display name and avatar (linked to their public profile), their team, who is ready, and, as each round is revealed, the item each player received (the item, its quality and the value used for scoring), then the final result. Your SteamID, virtual balance, inventory and cloud save are never shown in a battle. A private room is not listed and can only be viewed by its participants; its password is stored only as a one-way hash.
The CaseFrames server decides every player's items for every round when the host starts the battle and charges each player's virtual balance at that moment; it then reveals the rounds one by one. Your items, with the opening history, statistics, XP, achievements and leaderboard totals that come with them, are added to your own cloud save only once the battle has ended (normally within seconds of the last round), so nothing about a round can be seen before it is revealed, including in your inventory, your data download, your public profile or the leaderboards. While your battle is in progress, other changes to your cloud progress wait; if a technical problem delays the delivery, they are allowed again about 10 minutes after the battle ended and the items are delivered as soon as the problem is resolved, added to your progress as it is then without undoing anything you did in the meantime. Battle openings count like other server-verified openings for XP and the leaderboards, and each one is added to the anonymous community opening counter and rare-drop feed on the homepage once its round has been revealed (container and item only, with a random report ID that is not linked to the room or to any account). Nothing is transferred between players and there are no prizes; items and values are virtual.
Before your first battle, CaseFrames shows a short notice about how battles work and records that you confirmed it (the version of the notice and when). This is information about the service, not a request for consent.
A room that never starts expires about 30 minutes after its last activity, and nobody is charged. The records of a room (its settings, seats and round results) are deleted automatically about 30 days after the room expired or was cancelled, or after the battle ended. The cleanup runs about once an hour, so deletion can happen a little later, and a room is kept until its contributions to the community counter have been delivered. Deleting room records does not affect what you received: the items in your cloud save, your opening history and your verified opening statistics and leaderboard totals stay with your Steam account until you delete it, as for any other opening. The anonymous community counter and rare-drop feed are kept separately under their own rules (see the table below) and are not removed with the room records.
You can delete your account at any time, including during a battle. If you do, your name, avatar and profile link disappear from battle records at once (your seat is shown as “Deleted player”), you leave any room that has not started, your notice confirmation is deleted, and the items of a battle that had not ended are not delivered to you; the other players still receive theirs. The round results of your seat stay with the room, no longer linked to any account, so the other players' battle stays complete until the room records are deleted. Your data download includes the battles you took part in (rounds already revealed) and your notice confirmation. We process this to provide the battles you choose to take part in (Art. 6(1)(b) GDPR).
Analytics, advertising and cookies
When enabled for the site, CaseFrames uses Google Analytics 4 and the Google AdSense script. Google Privacy & Messaging, Google's consent management platform, shows a consent message where Google's settings require one, records your choice in a cookie and lets you change it later. For visitors in the European Economic Area, the United Kingdom and Switzerland, CaseFrames does not load Google Analytics or the AdSense script until that message reports your consent: before a choice, and after a refusal, they are not loaded and send nothing. If you withdraw consent later, CaseFrames removes their cookies from this site and reloads the page without them. The consent message itself is loaded for everyone so that the choice can be offered and recorded. As the website operator, CaseFrames is responsible for configuring these tools and the consent message appropriately; once loaded with your consent, Google processes the data it receives under its own policies. Where consent is required, it is the legal basis for analytics and advertising.
With your consent, analytics records page views (the page path without query strings) and bounded gameplay events, such as the type of container opened, the number opened at once, rarity counts, sales, achievements unlocked and Trade Up results. CaseFrames never sends your SteamID, account, balance or save to Google. CaseFrames does not currently show ad units. Google may process data outside the European Economic Area under its own safeguards; see Google's privacy policy. You can review or change your choice at any time:
Deletion and backups
On your profile page you can delete your cloud account after confirming with Steam. This immediately removes the account, its cloud save and earlier versions, its sessions and save operation records, its ranking statistics, public profile and leaderboard entries from the CaseFrames database and signs you out on all devices. It does not affect your Steam account or the guest save in your browser.
The hosting provider keeps its own backups of the databases, so deleted data can remain in those copies until they expire in the provider's cycle, which it describes as daily backups kept for about 7 days and weekly backups for up to 6 weeks. We cannot promise an exact date by which every copy is gone. Backups are used only to recover from a failure.
So that restoring a backup does not bring a deleted account back, deletion also stores, in a separate database, a keyed code that identifies the deleted account record and the time of deletion. While this entry exists, a copy of the deleted account that reappears is refused and deleted again instead of being used. The entry is removed after 70 days, longer than the provider's described backup cycle; copies of it can remain in the provider's backups of that database for a limited time. You can sign in again later and start a new, empty cloud account.
Where data is stored and who processes it
The website and its databases are hosted by Hostinger, which processes the data on our behalf under its Data Processing Addendum. The servers are in France and backups in Lithuania. Hostinger uses sub-processors, some based outside the European Economic Area, and its addendum provides EU Standard Contractual Clauses for transfers outside the EEA; we therefore do not state that all processing takes place in the EU. Steam (Valve, United States) and Google are described above. CaseFrames does not sell personal data or pass account data (SteamID, cloud save) to Google or advertisers.
Hostinger's servers and network record connection information, such as IP address, browser and requested page, in their own logs to deliver and protect the website. Hostinger determines how long these logs are kept; its published terms do not state a duration and CaseFrames has not received a confirmed one, so we cannot give an exact period. CaseFrames does not use these logs to identify players or link them to accounts. CaseFrames' own application logs record error codes only, never SteamIDs, tokens or saves.
Your rights
You can ask for access to your personal data and for its correction or deletion, and for processing to be restricted. You can receive the data you provided for your account in a portable format, object to processing based on legitimate interests, and withdraw consent at any time where processing relies on it (without affecting earlier processing).
- Signed-in players can download their account data (account details, the 18+ confirmation, session dates, the list of earlier save versions and the current cloud save, ranking statistics and your public-account acknowledgment) and delete their cloud account themselves on their profile page.
- For anything else, including full copies of earlier save versions, write to contact@caseframes.com. We may ask you to confirm the request by signing in through Steam, so that only the account holder can exercise it. We answer within one month, or tell you why we need longer.
- You can lodge a complaint with the Spanish Data Protection Agency (AEPD) or the supervisory authority where you live or work.
Security
Sessions use random tokens stored only as hashes, in secure HttpOnly cookies; changes require same-site requests; cloud saves are validated before they are stored; account and deletion data are kept in separate databases with separate credentials. No system is perfectly secure. If a breach affects your data and the law requires it, we will inform you and the AEPD.
Changes
We will update this page and its date when our processing changes, and highlight material changes here.