/// Plain terms
Read only. Nothing to sign.
What Vault reads, what it keeps, for how long, and how to take a vault down.
//// 01
What we read
Public Steam profiles and public CS2 inventories. Nothing behind a login.
We never ask for your password, Steam API key or trade link. If Steam shows an inventory to strangers, Vault can read it. If it is private, Vault can't, and it stores only that the inventory was private.
//// 02
What we store
For each vault someone opens, one record keyed by the SteamID64.
- SteamID64
- The 17-digit public ID of the account.
- Profile
- Display name, avatar image URL and profile URL, as Steam shows them publicly.
- Inventory snapshot
- The public list of CS2 items: names, asset IDs, rarity, wear, float values, pattern seeds, stickers and charms, image URLs and inspect links. Items that left the inventory are kept as the vault's archive.
- Derived facts
- The vault's name, archetype, item counts and scores, so leaderboards and percentiles can be computed.
- Status and times
- Whether the inventory was ready, private or not found, and when it was built and last refreshed.
//// 03
If you claim a vault
Claiming uses Steam sign-in. Steam tells us which SteamID64 you own and nothing more.
- Claim settings
- Hide the value, the featured item, the color, leaderboards opt-in (off by default) and, only if you opt in, a country code.
- Session cookie
- A signed cookie holding your SteamID64, valid for 30 days. No password and no Steam token.
- In your browser
- Hide the total and the featured pick are also kept in your browser's local storage. Clearing site data removes them.
//// 04
About visitors
We never store a visitor's IP address.
- Salted IP hash
- A one-way hash of the IP address with a secret salt. It counts one reaction per visitor per vault and keeps rate limits fair. Rate limit counters live in server memory only.
- Events
- Event names such as vault_viewed or share_clicked, with a few small details (the SteamID64 of a vault that was built, an item tier, a share format). No IP, no cookie ID.
- Removal requests
- The SteamID64 and the note you write, nothing else.
//// 05
How long we keep it
A vault is kept until it is removed. Its snapshot is refreshed from Steam when someone opens it after six hours.
Private and not found results are checked again after ten minutes. Item prices are cached per item name, not per person. When a vault is removed, its record and its reactions are deleted. The SteamID64 stays on a blocklist with the date and the reason (owner or request), which is what stops anyone from rebuilding it.
//// 06
Removal
Owners remove instantly. Everyone else asks.
//// 07
Who else is involved
Four services, each for one job.
- Steam
- Valve's public profile and inventory endpoints, and Steam sign-in for claims.
- Skinport
- Price estimates come from the public Skinport API: recent sale prices, used as estimates only. Nothing about you is sent to Skinport.
- Vercel
- Hosts the site and serves the pages and images.
- Supabase
- Stores the records listed above.
//// 08
Independence
Not affiliated with or endorsed by Valve or Steam.
Prices are estimates, not offers and not advice. Vault is made by SkinsVault.