SteamDB Privacy Policy

Last updated: 1 September 2026

SteamDB is operated by Meshwood Gaming Ltd, trading as SteamDB.

Meshwood Gaming Ltd is the controller responsible for the personal data described in this Privacy Policy.

1. About this policy

This Privacy Policy explains what personal data SteamDB processes, why we process it, how long we keep it, who we share it with, and the rights available to you.

Where applicable data-protection law requires us to identify a lawful basis for processing, including under UK GDPR and EU GDPR, the lawful bases we rely on are described below.

SteamDB is primarily an informational service built around data made available through Steam and Valve services. Most of the game, application, package, pricing and technical information displayed by SteamDB is not personal data.

Some Steam information does relate to identifiable users, however, such as SteamIDs, public profile information, avatars, owned games and leaderboard entries. Public availability does not, by itself, prevent that information from being personal data.

This Privacy Policy also applies where SteamDB processes identifiable information obtained from Steam or Valve about a person who has not signed in to SteamDB. In those cases, the information is obtained indirectly from sources such as Steam's public APIs, public Steam profiles and Steam Community services. The relevant sections below explain the categories of information used, why we use it and how long it is retained.

SteamDB does not sell your personal data.

2. Information we collect when you use SteamDB

Website and security logs

When you use SteamDB, our systems may process information including:

• The URL or page requested
• Your IP address
• Browser user-agent
• Referring URL
• Timestamps and related request information

We use this information to operate and secure SteamDB, investigate abuse, troubleshoot problems and improve reliability.

SteamDB's production server access logs are retained for up to 6 days (the current day plus 5 retained days) and are then automatically deleted. These server logs are not included in SteamDB backups, so there is no additional backup-retention period for them.

Cloudflare may retain associated request and security logs for up to 30 days.

Our legal basis is our legitimate interest in operating, securing and protecting SteamDB and its users.

Cookies

SteamDB uses a small number of cookies and similar storage for authentication, preferences and security. These currently include:

• The __Host-steamdb cookie maintains your SteamDB login session and keeps you signed in between visits. It has a maximum lifetime of 90 days and is deleted when you log out or delete your SteamDB account.
• The __Host-cc cookie remembers your selected currency between visits. It has a maximum lifetime of 90 days and is deleted when you log out or delete your SteamDB account.
• Temporary cookies may be set by Cloudflare for security, anti-abuse and bot protection.

See our Cookie Policy for further information.

Where applicable data-protection law requires a lawful basis, we rely on performance of a contract where processing is necessary to provide account functionality you request, and on our legitimate interests in maintaining sessions, remembering user preferences, operating the service and protecting SteamDB against security and abuse risks. Separate rules may require consent before certain non-essential cookies or similar technologies are stored or accessed.

SteamDB previously used Google Analytics for a limited analytics experiment. Google Analytics has now been removed from the SteamDB website and is no longer used to collect new SteamDB usage information.

Historical analytics information collected before its removal is retained for up to 1 year for the limited purpose of understanding historical usage patterns and informing improvements to SteamDB. It will be deleted at the end of that retention period.

Where applicable data-protection law requires a lawful basis, we rely on our legitimate interest in understanding historical usage of SteamDB and using those insights to improve the service.

3. Steam sign-in and your SteamDB account

SteamDB uses Steam's official OpenID service to authenticate users.

When you choose to sign in, your browser is redirected to Steam's website. Steam handles the login process on its own service under its own privacy and cookie terms. SteamDB does not control the cookies or other browser storage that Steam uses while you are on Steam's website.

After you successfully authenticate, Steam redirects you back to SteamDB and SteamDB receives your SteamID. We do not receive your Steam password or Steam login credentials.

For some account features, SteamDB sends your SteamID to Valve's Web API to retrieve information associated with your Steam account. Where your Steam profile settings permit it, this can include public profile information and information returned by services such as GetPlayerSummaries and GetOwnedGames.

Depending on the SteamDB features you use, account-related information may include:

• SteamID
• Public persona/profile name
• Avatar information
• Steam level
• Publicly available owned-game information
• Account and session information
• Preferences and settings
• Records of certain account actions

We use this information to authenticate you, provide account functionality, remember your preferences, provide SteamDB features and protect the service.

Where applicable data-protection law requires a lawful basis, we rely on performance of a contract with you where processing is necessary to provide the account functionality you request, and on our legitimate interests in operating and securing SteamDB.

4. Discord and GitHub accounts

If you choose to connect a Discord or GitHub account to SteamDB, we store the relevant numeric account identifier so that we can provide the connected functionality.

You can disconnect these accounts through your SteamDB settings.

GitHub identifiers may also be used in connection with GitHub Sponsors and SteamDB supporter entitlements.

We process this information to provide the connection or supporter functionality that you request and to maintain appropriate records of supporter entitlements. GitHub identifiers held in sponsorship records are removed by a weekly cleanup process 365 days after the sponsorship expires.

Where applicable data-protection law requires a lawful basis, we rely on performance of a contract where processing is necessary to provide connected-account or supporter functionality you request, and on our legitimate interests in administering account connections and supporter entitlements.

5. Calculator, public profiles and leaderboards

SteamDB's Calculator and related features use information available from Steam's public APIs and public profiles. You do not need to have signed in to SteamDB for public Steam profile information to appear in these features where the relevant Steam data is publicly available.

Information used or stored for these features can include:

• SteamID
• Public persona name
• Avatar
• Steam level
• Badge information
• Publicly available ownership information

Some information retrieved during a calculator lookup is cached only temporarily, generally for up to approximately two hours.

SteamDB also retains some public-profile information where it is relevant to features such as Top Levels and badge leaderboards.

Badge leaderboards retain up to the top 2,000 public profiles per badge and are recalculated regularly.

Where SteamDB detects that a profile has become private or is no longer relevant to these features, associated stored information is removed in accordance with our retention rules.

You can prevent SteamDB and other third parties from retrieving most Steam profile information by changing the relevant privacy settings on Steam.

Our legal basis is our legitimate interest in providing SteamDB's public informational and statistical features using information made publicly available through Steam.

6. Token Dumper contributions

SteamDB operates the Token Dumper to allow Steam users voluntarily to contribute app tokens, package tokens and depot keys that their Steam accounts are entitled to access.

When you make a submission, SteamDB processes information needed to verify the contribution and prevent abuse. This can include:

• Your SteamID during submission processing
• Your IP address
• Submission timestamps
• App, package or depot identifiers
• Submitted tokens or keys
• Other identifiers necessary to process or investigate the submission

For unverified submissions, the raw SteamID and IP address are retained for no more than approximately one week. The weekly cleanup process removes the IP address and replaces the raw SteamID with a one-way hashed value that can be used to recognise repeated suspicious or invalid submissions without retaining the original SteamID.

Once a submission is approved, the approved token or key is stored separately from the submitter information used during verification.

SteamDB may also generate restricted internal operational or security alerts for suspicious or unusual submissions. These notifications do not include the submitter's SteamID or another submitter identifier. They may include the submitted app, package, depot, token or key information relevant to the alert.

We do not publicly identify Token Dumper contributors merely because they submitted a token or key.

Our legal basis is our legitimate interest in operating, improving and protecting SteamDB's database where users voluntarily choose to contribute information.

7. Supporters and sponsorships

SteamDB may process information relating to donations or sponsorships in order to recognise supporter status and provide associated SteamDB or community benefits.

Depending on the method used, this can include:

• SteamID
• GitHub numeric ID
• Supporter or sponsorship status
• Amount
• Dates associated with the sponsorship or entitlement

We may retain limited records where necessary to evidence or restore supporter entitlements. GitHub identifiers held in sponsorship records are removed by a weekly cleanup process 365 days after the sponsorship expires.

Where applicable data-protection law requires a lawful basis, we rely on performance of a contract with you where processing is necessary to provide supporter functionality you request, on our legitimate interests in administering and restoring supporter benefits, and on compliance with legal obligations where specific record-keeping laws require us to retain particular information.

8. Error monitoring, performance and security

We use technical monitoring services to detect errors, investigate failures and maintain SteamDB.

Where applicable data-protection law requires a lawful basis, we rely on our legitimate interests in maintaining the security, reliability and performance of SteamDB, diagnosing faults and protecting the service.

Bugsnag

Bugsnag remains in use for backend error reporting.

We minimise the information sent to Bugsnag. Sensitive request headers and browser user-agent information are removed from the backend error payload. Raw IP addresses and SteamDB account identifiers are not intentionally sent as part of backend error reports. A pseudonymous identifier derived from network information may be used to help identify repeated errors from the same source.

We use this information for debugging, reliability and security.

Bugsnag error-reporting data may be retained for up to 6 months.

Datadog

We use Datadog for infrastructure and application-performance monitoring.

For backend request traces, SteamDB may send technical information such as browser user-agent information and minimised request paths. SteamDB does not intentionally send SteamDB account IDs, IP addresses or other account identifiers in these traces. URL parameters are removed or replaced with placeholders before being recorded, for example /app/? or /calculator/?.

Approximately 0.01% of ordinary requests are traced, with additional traces collected where an application error occurs.

Datadog trace data is retained for approximately 15 days. SteamDB's Datadog telemetry is processed through Datadog's US service. International transfers are covered by Datadog's contractual safeguards, including the applicable Standard Contractual Clauses and UK International Data Transfer Addendum.

9. Search and images

Algolia

SteamDB uses Algolia to provide instant search and search suggestions.

Search requests are made directly to Algolia and may include technical request information such as IP address, browser information and search queries.

Algolia search logs are generally retained for approximately 7 days.

Where applicable data-protection law requires a lawful basis, we rely on our legitimate interest in providing and maintaining effective search functionality.

weserv.nl

Some third-party images displayed by SteamDB are proxied through images.weserv.nl.

The service may receive the requested image URL and your IP address when delivering or caching the image.

Associated service logs are currently understood to be retained for approximately 7 days.

Where applicable data-protection law requires a lawful basis, we rely on our legitimate interests in efficiently delivering, caching and proxying images used by SteamDB and maintaining service performance.

Steam and Valve

SteamDB obtains data and assets from Valve and Steam, including through Steam APIs, Steam Community services and Steam's content-delivery infrastructure.

Valve processes information under its own privacy terms when you interact directly with Steam services. Where SteamDB's use of Steam or Valve services involves personal data, the purposes and lawful bases for our processing are described in Sections 3 and 5.

10. Embedded content

Some SteamDB pages may embed third-party content, such as YouTube videos using the privacy-enhanced youtube-nocookie.com service.

If you choose to interact with embedded third-party content, that provider may process information about your interaction under its own privacy policy.

11. Hosting and backups

SteamDB's current production infrastructure is hosted using Hetzner.

SteamDB currently maintains two database backup paths:

• A separate Hetzner database backup copy, retained for 1 day
• Database dumps created using SimpleBackups and stored with Backblaze, retained for 7 days

This means that information deleted from the live SteamDB database may remain in backup copies until the relevant backup automatically expires.

Backups are used for service resilience, disaster recovery and restoration.

Where applicable data-protection law requires a lawful basis, we rely on our legitimate interests in protecting SteamDB, maintaining service resilience and enabling disaster recovery. Personal data contained in backups also remains subject to the purposes and lawful bases that apply to the underlying information.

12. Service providers and group companies

We use third parties where necessary to operate, protect and provide SteamDB.

Current relationships include services such as:

• Hetzner, for hosting and backup infrastructure
• SimpleBackups and Backblaze, for database backups
• Cloudflare, for security, caching and abuse protection
• Algolia, for search
• The weserv.nl service, for image proxying and caching
• Bugsnag, for backend error reporting
• Datadog, for infrastructure and application monitoring
• Valve/Steam, for authentication, public Steam data and Steam-hosted assets
• Discord and GitHub where you choose to connect those services
• YouTube/Google where third-party embedded content is used

Black Tree Gaming Ltd and Chosen ApS also provide personnel and services to Meshwood Gaming Ltd under contract and may process SteamDB personal data on Meshwood's behalf where necessary to provide those services.

Meshwood Gaming Ltd remains responsible for determining the purposes of SteamDB's processing. Service providers acting on our behalf process personal data for the purposes described in this Privacy Policy and under the lawful bases applicable to those activities. Where another organisation acts as an independent controller, its own privacy terms also apply to its processing.

13. SteamDB and Nexus Mods

Black Tree Gaming Ltd operates Nexus Mods and also provides contracted services to Meshwood Gaming Ltd.

SteamDB account-level personal information is not matched with Nexus Mods accounts, and SteamDB account identifiers are not combined with Nexus Mods account-level personal data for analytics, advertising or profiling.

Any new processing involving SteamDB and Nexus Mods will be assessed and documented if it is introduced.

14. International transfers

Some of our service providers process personal data outside the United Kingdom.

Some processing takes place in the European Economic Area, including services hosted or operated in Germany and Denmark. The United Kingdom recognises the EEA as providing an adequate level of data protection, so additional transfer safeguards are not required for those transfers.

Some providers process personal data in the United States. Depending on the provider, we rely on an applicable UK adequacy arrangement, including the UK Extension to the EU-U.S. Data Privacy Framework, or on contractual safeguards such as Standard Contractual Clauses together with the UK International Data Transfer Addendum where required.

Current US-based processing includes services used for security and delivery, connected Discord and GitHub functionality, Steam/Valve API requests, backend error monitoring, application monitoring, and database backups. We have reviewed the current transfer mechanisms used for these services.

You may contact us for further information about the safeguards applicable to a particular transfer.

15. How long we keep information

We retain personal data only for as long as reasonably necessary for the purpose for which it is processed. Some records use a fixed retention period, while others are retained only while they remain relevant to a particular SteamDB feature or continuing entitlement purpose.

Current retention periods include:

Certain records may need to be kept longer where necessary for security, legal obligations, supporter entitlement history or historical attribution.

Token Dumper submission retention is described separately above. Submitter identifiers are not included in Token Dumper Discord notifications.

16. Deleting your SteamDB account

If you have a SteamDB account, you can delete your account and associated account data through the SteamDB account/sign-out page.

Deletion removes the core SteamDB account and associated account-level information, subject to:

• Short-lived backups
• Security or audit records that still have a valid retention purpose
• Supporter or entitlement records that continue to be retained for the purposes described in Sections 7 and 15
• Other records we are legally required or permitted to retain

We do not claim that every copy of every historical record disappears immediately when an account is deleted.

17. Your privacy rights

We believe that people should have meaningful control over their personal data regardless of where they live. We therefore provide the following privacy rights to all users, subject to reasonable verification and any legal restrictions that apply.

You can:

• Ask whether we process personal data about you and request access to or a copy of that data
• Ask us to correct or update personal data that is inaccurate or incomplete
• Ask us to delete personal data about you
• Ask us to restrict how we use your personal data
• Object to certain uses of your personal data
• Request a portable copy of personal data you have provided to us, where reasonably possible
• Withdraw consent at any time where we rely on your consent. Withdrawal does not affect processing that took place before consent was withdrawn.
• Ask us for information about how we collect, use, retain and share your personal data

We will not discriminate against you or provide you with a lower level of service because you exercise your privacy rights.

There may be circumstances where we cannot fully comply with a request, for example where we are required to retain information by law, where retaining limited information is necessary for security or fraud prevention, where fulfilling a request would adversely affect the rights of another person, or where another exemption permitted by applicable law applies. If we cannot fulfil a request, we will explain why where we are legally permitted to do so.

We may need to verify your identity before acting on a request. Where applicable law allows you to use an authorised representative to exercise your rights, we may also need to verify their authority to act for you.

To exercise your privacy rights, use the contact details in the Contact us section below.

You may also have additional rights under the privacy or data-protection laws that apply to you. These may include rights relating to the sale or sharing of personal data, targeted advertising, profiling, automated decision-making, appeals against decisions about privacy requests, and complaints to a privacy or data-protection regulator.

You have the right to make a complaint to the privacy or data-protection regulator that is responsible for enforcing the law that applies to you. In the United Kingdom, this is the Information Commissioner's Office (ICO).

18. Browser extension

The SteamDB browser extension has a separate privacy notice describing the processing specific to the extension.

The extension notice and this Privacy Policy should be read together where you use both SteamDB and the extension.

19. Changes to this policy

We may update this Privacy Policy when SteamDB's features, service providers or legal obligations change.

The date at the top of this page will show when the policy was last updated.

20. Contact us

For privacy questions, to exercise your privacy rights, or to contact our Data Protection Officer, email support@steamdb.info.

You can also write to us at:

Meshwood Gaming Ltd
Southernhay Studios, Dean Clarke House
Southernhay East
Exeter
EX1 1AP
United Kingdom