Loading
What is kept, what is deliberately never kept, who else sees it, and what happens to a bot credential when you delete it.
Your email address, for sign-in codes, payment updates and alerts about your bot, your key bank and anything that stops trading.
Your Steam ID, and the Steam name and picture shown on your public Steam profile, so the site can show who is signed in. They are refreshed each time you sign in with Steam.
If you connect Telegram: your Telegram chat ID and username, so alerts can reach you there. Disconnect it from your account page and both are removed.
The Steam ID of each bot account you host or list, so we know whose bot is whose. A directory listing, its rates and its stock are public, because showing them is what the directory is for.
Adverts you submit: the banner link, where it points, and what you have spent on it.
The bot account credentials, encrypted at rest. They are decrypted only in memory, only by the process that signs the bot in, and never displayed back to anybody.
What the bot did: rates, settings and trade history. This is the record that lets you look at last year rather than last week, and it is the reason it lives in a database rather than a cache.
Sign-in records: the IP address and browser of each signed-in session and each sign-in attempt, so you can see your own devices and so guessing passwords can be stopped. Sign-in attempts and used links are removed about a day after they expire. Sessions are removed 90 days after they end.
The trade URL you give us, so keys can be sent to you.
What a listed bot answers when our checker asks its rate in chat, kept for 30 days so staff can read it.
A copy of each approved advert banner, so visitors' browsers never load it from the advertiser's server.
A sign-up whose email is never confirmed is deleted after a week.
A listed bot's name, rates, stock and Steam profile, and, unless you switch it off in Edit Bot, the Steam profile of the account that runs it.
A card supplier's name and the Discord, Telegram or Steam contact they chose to show.
If you refer somebody, you can see their Steam name and how many keys they have spent, because that is what your points are counted from.
If our staff mark a Steam account as a scammer, its Steam ID goes on a public list, which card bots download so they can refuse to trade with it. The list holds Steam IDs only: why it was marked, and by whom, stay with our staff.
No card details. We never take a card, so there is nothing to store, nothing to leak, and no payment processor holding a file on you. Payment is TF2 keys, sent as a Steam trade.
No personal main account. A bot runs on a dedicated account, so your own Steam account is never handed over and never stored.
No Steam API keys belonging to your customers. Your bot does not ask them for one, so there is never one for us to hold. If you choose to plug in a paid inventory service, that key is yours and is stored the same encrypted way as everything else here.
Credentials are encrypted at rest with a key held apart from the stored value. Reading the database alone gives you nothing usable.
They are never displayed back. Not in the panel, not in support, not to us. Once a credential is saved, the only thing that can read it is the process that logs the bot in, and the only thing it does with it is log the bot in.
If you need to change them, you replace them. There is no screen anywhere that reveals what is currently stored, because a screen that can show a secret is a screen that can leak one.
A bot you run yourself with our script talks to us to check its licence and to fetch updates. Each time it sends only the licence key, a code made from the server's machine id and the licence (so it cannot be matched across licences), the bot's version and a random number for that check. When it activates, it also says which edition it is.
It never sends your Steam accounts, passwords or secrets, its settings, stock or trades, the server's name or its other addresses, or how many bots you run. Those stay on your server.
For each licence we keep the code of the server that holds it, when that server first and last checked in, the version it last reported, and each download with its version and date for 180 days. The address a request comes from is seen only by our rate limits and our logs, as for any request to this site.
Your licence key is stored sealed. It is shown only to you, after you confirm it is you, and every time it is shown is recorded. Emails about your licence never contain it.
Features you switch on yourself, such as SteamTradeX prices or listing your bot, talk to us as their own settings describe.
Delete a bot and its credentials are destroyed along with the encryption key that protected them. That is deliberate and it is not reversible: with the key gone, what remains cannot be decrypted by us, by you, or by anybody who takes a copy of the database later.
To delete your account, ask us through support. The email address and Steam IDs go with it.
If you want a copy of your bot's trade history first, ask in the same message. Once it is deleted it is gone.
Database backups are kept for 14 days, so a deleted account is gone from them two weeks later.
Steam sees what any Steam bot makes it see: the sign in, the offers, the chat. That is the service working, and it is between your bot account and Valve.
Cloudflare carries every request to this site, as it does for a large part of the web, and protects it from attacks.
Our email provider, Spacemail, carries the emails we send you. Telegram carries the alerts, but only if you connect it.
We do not sell any of this, and we do not hand it to anybody for advertising. It goes no further than what is needed to run your bot and to reach you about it.
If you find a way to get at somebody else's account, keys or data, or anything else that looks like a security problem on this site, email [email protected] and tell us privately first. Say what you found and how to see it. We read every report, reply, and fix what is real.
Please do not test against other people's accounts, do not take or change data that is not yours, and do not slow the site down for others while looking.
SteamTradeX is not affiliated with, endorsed by, or connected to Valve Corporation. What Steam stores about your bot account is governed by Valve's own privacy policy, not by this one.