Skip to content
CS2.Madness

Privacy policy

Last updated: October 15, 2026

This is an English translation provided for convenience. The legally binding version is the Polish original; if the two differ, the Polish version prevails.

1. Controller

The site is operated by: [fill in: site owner's name / company]. Privacy contact: [fill in: contact e-mail address].

2. What data we process

  • The builder works without an account. If you don't log in, you don't give us any personal data.
  • Account (Steam login) — optional. You enter your password only on Steam's (Valve's) site; we have no access to it. After you log in we store: your Steam account number (SteamID64), nickname and avatar URL from your public Steam profile, the date your account was created and your last login, a hash of the session token, your saved loadouts (name and list of skins) and the most recently loaded list of skins from your public CS2 inventory (so we don't have to ask Steam on every visit). Purpose: running your account and the features you use while logged in (Art. 6(1)(b) GDPR). We keep the data until you delete your account; sessions expire after 30 days. You can delete your account and all related data yourself on the Your account page. The data is stored by a database and hosting provider acting on our behalf.
  • Your loadouts are saved only in your browser's storage (localStorage) when you're not logged in, so they're available on your next visit — they don't reach our server. After you log in, we move them to your account. You can remove them with the “Clear loadout” button or by clearing the site's data in your browser.
  • A loadout link contains only the list of selected skins. When it's opened, the server reads that list to generate the preview image.
  • Points and contests (Giveaways) — optional, after you log in. We store your points history (what you earned or spent points for, and when), who invited you and whom you invited, the nickname and style of graphics you downloaded from the avatar generator, your contest entries (the chosen loadout and the Steam trade URL we'll send the prize to), and your rewards shop redemptions (the reward, its status and your Steam trade URL). When you click “Check” on a task, or someone logs in through your invite link, we read the public Steam profile (nickname, avatar, account creation date, whether the account is limited or public). The winner's nickname and avatar are shown publicly on the contest page. Purpose: running the points program and the contests you take part in (Art. 6(1)(b) GDPR) and preventing abuse (Art. 6(1)(f) GDPR). The data is deleted together with your account.
  • "Recently built loadouts" strip. When you build a loadout of at least 3 skins, we save it anonymously: just the list of skins (without what you already own), the time and a hash of a random browser identifier (so one person counts once a day). We don't store your account, nickname or IP address. The loadouts are shown to others on the home page and deleted after 7 days. Purpose: showing real activity on the site (Art. 6(1)(f) GDPR).
  • Inventory value. When you're logged in, we save your inventory's total value once a day (date, currency, amount) to show a chart; it is deleted together with your account. When you check someone else's public inventory, we fetch it from Steam and keep it only briefly in server memory (up to 10 minutes) — it isn't stored in the database. The visitor's IP address is used only to limit the number of checks and isn't stored either.
  • Price alerts and notifications — optional, after you log in. We store your alerts (skin, wear, currency, target price, when it was set and when and at what price it dropped). If you turn on browser notifications, we store the address your browser assigns with its notification service (e.g. Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). We send that service only a "there's a notification" signal with no content; your browser fetches the content directly from us. You can turn notifications off in your browser settings. Purpose: sending the alerts you ask for (Art. 6(1)(b) GDPR). The data is deleted together with your account. You can also turn on the daily deals notification without an account — then we store only the notification service address, language, currency and the date of the last send; it's deleted when you turn notifications off (on the Deals of the day page or in your browser).
  • Chat (after you log in). Your messages and attached loadouts are public — every visitor sees them, together with your Steam nickname and avatar. We store them with the date, and also message reports (who reported), to moderate the chat. You can delete a message at any time; the administrator can review reported or deleted messages. Purpose: running the chat and preventing abuse (Art. 6(1)(b) and (f) GDPR). Messages are deleted together with your account.
  • Online counter — your browser stores a random identifier (localStorage) and reports it to the server once a minute with the time of your last visit, so we can count people on the site. The identifier isn't linked to your account or IP address; entries older than a day are deleted.
  • Server logs — the hosting provider may, as standard, record the IP address, date and requested URL to keep the service secure and running (Art. 6(1)(f) GDPR).

3. Cookies, ads and analytics

The site does not use its own tracking cookies or analytics tools. Browser storage (localStorage) is used only to remember your loadout and chosen currency, which is necessary for the features you use. After you log in we set one technical session cookie (madness_session, valid for 30 days), without which login doesn't work. If you switch the site language manually, we remember that choice in the lang cookie (valid for one year). If you arrive through an invite link, we remember who invited you until your first Steam login in the madness_ref cookie (valid for 30 days), and in the madness_ref_seen cookie that your visit has already been counted in the inviter's stats (just a click count, with no data about you). None of these cookies is used for tracking, and they don't require consent.

Ad banners on the site are plain links — they don't load scripts from external ad networks or set cookies.

4. External resources

  • Skin thumbnails load directly from Steam's (Valve's) servers. Your browser then connects to those servers and shares, among other things, your IP address with them.
  • When you click a link to an external market (e.g. Steam, Skinport, Waxpeer, Market.CSGO, LIS-SKINS), you go to that party's site, where its own privacy policy applies.

5. Your rights

To the extent we process your personal data, you have the right to access, rectify and erase it, to restrict processing, to object, and to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO) or your local data protection authority.