Privacy Policy
- We know your public Steam identity, your trade URL, what you trade, and the crypto addresses you use - what's needed to run your account.
- No advertising, no analytics trackers, no selling your data. One login cookie.
- Site statistics we publish are totals only - never anyone's individual trades or balance.
1. Who's responsible
TradeRust runs traderust.com and is responsible for your personal data. Contact: [email protected].
2. What we collect
- From Steam when you sign in: your SteamID, public profile name and avatar. We never get your Steam password.
- What you give us: your Steam trade URL, and the crypto coin and address you choose for each cash-out.
- Your activity: balances and every change to them, orders, trades, Steam trade offers (including the items in them), crypto deposits and cash-outs, and the API keys you create (we store only a fingerprint of each key, never the key itself).
- Two-factor sign-in, if you turn it on: the secret your authenticator app shares with us, stored encrypted, and a fingerprint of each backup code (never the codes themselves).
- Your Steam inventory: read from Steam when you open a page that shows it, so you can deposit or sell from it. It's kept for about a minute to avoid reloading it on every page.
- Technical data: your IP address, used to limit how many requests one address can make (counters last about 90 seconds) and in short-lived server logs used for security and fixing problems.
We don't use analytics or advertising trackers.
3. How we use it
- To run your account: sign-in, your balance and inventory, orders and trades, Steam trade offers, deposits and cash-outs.
- To keep TradeRust secure and fair: rate limits, preventing fraud, stolen items and abuse, and investigating problems.
- To meet legal obligations, such as keeping financial records and responding to lawful requests.
- To answer you when you contact support.
We use this data because it's needed to provide the service you signed up for, because we have a legitimate interest in keeping TradeRust secure, and where the law requires it.
4. What's public
- Order books show prices and amounts, not who placed them.
- Recent trades show the skin, price, amount and time, not who traded.
- The Stats page shows site-wide totals only: volume, users, money in and out, fees, and what the vault holds.
- Our Steam trade offers to you appear in your own Steam account's trade history, as with any Steam trade.
6. If you use TradeRust through another site
Some sites use TradeRust behind the scenes through business accounts. If you connect your Steam account to one of them - including through TradeRust's "Connect" page - we store your Steam ID, trade URL, your public Steam profile (name, avatars, privacy and trade-ban status, member-since) and the history of your trades and crypto transfers with that site, on that site's behalf. That site can see this data and is responsible for it; it can ask us to erase it, and your requests about it should go to that site first. We don't use it for anything else and we don't share it with other businesses. Your Steam password is only ever entered on Steam.
8. How long we keep it
- Financial records - balance changes, trades, orders, transfers and crypto transactions - are kept as long as we need them for accounting, fraud prevention and legal obligations. Our ledger is append-only by design, so records can't be silently edited.
- Account details (name, avatar, trade URL) are kept while you have an account.
- Short-lived data: rate-limit counters about 90 seconds, cached Steam inventories about a minute, server logs a short period.
9. Your rights
Depending on where you live, you can ask for a copy of your data, have it corrected, object to some uses, or have it deleted. Some records - mainly financial ones - may have to be kept even after you ask, for as long as the law requires; we'll tell you if that applies. To make a request, email [email protected] from - or tell us - the Steam account it's about. You can also complain to your local data protection authority.
10. Security
Logins are signed cookies sent only over HTTPS. API keys are stored only as fingerprints. The vault bot's credentials are kept separately from the website's servers. No system is perfectly secure, so keep your Steam account protected with Steam Guard.
11. Children
TradeRust is for people aged 18 and over. We don't knowingly collect data from anyone younger; if you think a child is using TradeRust, contact us and we'll close the account.
12. Changes and contact
We'll update this policy when how we handle data changes; the date at the top shows the latest version, and we'll flag important changes on the site. Questions: [email protected].