Privacy Policy

This document is a draft pending review by a qualified lawyer. It describes what SteamLevelForge actually does with your data, accurately and in detail, but it has not been reviewed as binding legal language. Do not rely on it as legal advice.

SteamLevelForge sells complete Steam trading card sets and delivers them through Steam's own trade system. This policy explains exactly what we collect, why, who else sees it, and what you can make us do about it.

SteamLevelForge, based in Norway, is the data controller. You can reach us at [email protected], or through our Discord — linked throughout the site.

[REVIEW: EEA consumer law requires a trader selling at a distance to publish a geographical address, not just a country and an email. A lawyer should confirm what must appear here — and in the Terms — before these pages go live.]

What we collect

When you sign in with Steam. We never see or ask for your Steam password — sign-in runs through Steam's own login page, and Steam tells us only your SteamID64, your persona name and your avatar image URL. That is the whole of it.

Your trade URL, if you save one. This is the address Steam gives you so other people can send you trade offers. It contains a token. We need it to deliver an order, and you can change or clear it at any time from your Account page.

Your Steam level and badge progress, read from Steam's public API so the calculator can work out how many card sets you need.

Orders and payments. The target level you asked for, the sets reserved for you, the price, the payment method, the status and the timestamps. If you pay with PayPal we store the PayPal order and capture identifiers — we never see or store your card details; PayPal handles those. If you pay in TF2 keys or Steam Gems we store the identifiers of the specific items involved, so we can verify the right items actually arrived.

Loyalty points and referrals. Your points balance and the history of how it changed; your referral code; who referred you, if anyone; and how many people signed up or ordered through your link.

Notification preferences. Including a Discord webhook address, but only if you choose to provide one.

Administrative notes. If our staff record a note about your account — for example the reason for a refund or a restriction — that note is stored and is visible to staff.

Technical data. A session cookie that keeps you signed in; a referral cookie if you arrived through someone's link; and server logs containing your IP address and browser user-agent, which we use to apply rate limits and investigate abuse.

What we deliberately do not keep

Inventory scans are never saved to our database. When you use the inventory scanner, we read your public Steam inventory, compute the answer, hold it in memory for about fifteen minutes so a repeat visit is instant, and then it is gone — a restart clears it sooner. It is never written to our database, and we never build a record of what you own over time.

We do not use advertising trackers, we do not profile you for marketing, and we do not sell or rent your data to anyone. Ever.

Why we are allowed to hold it

Under the GDPR we rely on:

• Performing our contract with you — everything needed to quote, take payment for, reserve and deliver an order, and to run loyalty points and referrals.
• Our legitimate interests — preventing fraud and abuse, applying rate limits, keeping the service secure and working, and producing aggregate business statistics.
• A legal obligation — retaining records of transactions for the periods accounting and tax law require.
• Your consent — Discord notifications, which you switch on yourself and can switch off at any time.

Who else sees it

• Valve (Steam) — unavoidably. Sign-in goes through Steam, we read your public inventory and badge data through Steam, and delivery happens as a real Steam trade offer. Your use of Steam is governed by Valve's own privacy policy.
• PayPal — if you pay with PayPal. They receive what they need to process the payment and are an independent controller of it.
• Discord — only if you configure a webhook, and only the notification content.
• Our hosting and infrastructure providers, who process data on our instructions.

Two things worth stating plainly. We use a third-party service (SteamSets) for the "where does your level rank" figures — we send it our own reference account, never yours, and it never learns anything about you. And our card-price data is a bulk file we import ourselves; no user data is sent anywhere to produce it.

Data leaving the EEA

Valve (Steam) and PayPal are US companies, so using this service necessarily sends some of your data outside the EEA. The GDPR allows that only on a recognised legal footing, and which one applies is not ours to assert casually:

• Both are, at the time of writing, certified under the EU–US Data Privacy Framework, which is the usual basis for transfers to US providers.
• For anything not covered by that, the fallback is Standard Contractual Clauses.
• Sign-in and delivery, specifically, are also necessary for the performance of your contract with us — we cannot deliver a Steam trade offer without involving Steam.

[REVIEW: a lawyer should confirm which basis actually applies to each provider, verify the Data Privacy Framework certifications are current (they have been struck down before, and could be again), and decide whether a transfer-impact assessment is needed. Getting this wrong is one of the more commonly enforced parts of the GDPR, so it should not be left as boilerplate.]

Deleting your account

You can request deletion at any time from your Account page. We anonymise rather than erase, and you should understand exactly what that means.

Your identifying details — persona name, avatar, trade URL, notification settings, staff notes — are blanked. What survives is the account row itself with your SteamID64, plus your order and payment history in anonymised form.

We do this for two reasons, and we would rather say so than hide it:

1. Your order and payment records are financial records we are legally required to keep, and deleting the account row outright would corrupt them and the business statistics already derived from them.
2. Your SteamID64 is a permanent Steam identity you could sign in with again. A restriction on an account is not lifted by requesting deletion — otherwise deletion would be a way to wipe a ban.

If you believe you are entitled to full erasure notwithstanding the above, contact us and we will consider it on its merits.

Your rights

You can ask us to give you a copy of your data, correct it, delete it (subject to the section above), restrict or object to how we use it, or hand it to another provider. You can withdraw consent for Discord notifications at any time. Exercising these rights costs nothing and we will respond within one month.

Ask us first if you like — we would rather sort it out directly. Our Discord, linked throughout the site, reaches us quickly, or you can email [email protected]. We are open to being contacted about anything on this page.

That said, going to us first is never a requirement. If you think we have got this wrong, you can complain to your national data-protection authority at any time. In Norway that is Datatilsynet (datatilsynet.no); elsewhere in the EEA it is your local equivalent.

Cookies

We use two, and neither is for advertising:

• A session cookie, which keeps you signed in. The service cannot work without it.
• A referral cookie, set only if you arrive through someone's referral link, so their referral is credited correctly.

Security

Sign-in runs through Steam, so we never hold your password. Administrative actions that move money require a second authentication step and are written to an append-only audit log. Access to production data is limited to those who operate the service.

Age

This service is for adults. You must be 18 or over to use it. We do not knowingly collect data from children, and we will delete any we discover.

Changes

If we change how we handle your data we will update this page and change the date below. If the change is significant, we will say so prominently.

Last updated: 25 July 2026.

[REVIEW: a lawyer should check the retention periods, the international-transfer basis, the anonymisation-rather-than-erasure position, and the consumer-law interaction before this page is presented as binding.]