Privacy Policy — FRAGWAY CS2 PUGS

01 Overview

This Privacy Policy explains how FRAGWAY CS2 PUGS, operated by Fragway Network, collects, uses, and protects your personal data when you use the Service at cs2.fragway.net.

We collect only what is necessary to run the platform. We do not sell your data, serve you advertisements, or share your information with third parties for marketing purposes.

By using the Service, you agree to the data practices described in this policy.

02 Data We Collect

The following categories of data are collected when you use the Service:

Data	What it is	Source
Steam ID	Your unique 64-bit Steam identifier	Steam OpenID login
Display name	Your Steam profile name at time of login	Steam OpenID login
Avatar URL	Link to your Steam profile picture	Steam OpenID login
Match statistics	Kills, deaths, assists, headshots, damage, KAST, rating, MVPs per match	CS2 server via MatchZy plugin
Round data	Round-by-round outcomes, map played, match score	CS2 server via MatchZy plugin
ELO rating	Calculated performance score across all matches	Calculated by the platform
Demo files	Recorded CS2 match demo (.dem) files	CS2 server SFTP upload
Support tickets	Messages and replies in your support tickets	Submitted by you
Ban records	Ban reason, duration, issuing staff member	Issued by staff
Session data	PHP session for login state	Browser session cookie
IP address	Your IP at time of login and admin-visible actions, stored in the activity log for security and moderation	Server request headers
AC flags	Automated stat anomaly flags generated by the anti-cheat worker — suspicion score and flag details visible to admins only	Calculated by the platform after each match

We do not collect email addresses, phone numbers, or payment information. Your IP address is recorded in the platform activity log for security and moderation purposes (see Data We Collect).

03 How We Use Your Data

Your data is used exclusively to operate the Service:

Authentication — your Steam ID identifies your account across sessions
Match records — statistics are stored and displayed on leaderboards and your player profile
ELO & rankings — your performance data is used to calculate your rating and rank
Demos — recorded files are stored for anti-cheat review and dispute resolution by authorised staff
Tickets — your messages are read by support staff to resolve your request
Bans — ban records are kept to enforce platform rules and prevent evasion
Staff notes — internal notes may be recorded against your Steam ID by staff for moderation purposes; these are never shown to you or other players
Anti-cheat monitoring — your match stats are automatically analysed after each game to detect anomalous performance. Flags are reviewed manually by staff. No automated bans are issued — human review is always required before any action
IP logging — your IP address is recorded on login and in the activity log for security, moderation, and ban enforcement purposes

04 Storage & Retention

All data is stored on Fragway Network servers. Specific retention periods:

Account data (Steam ID, name, avatar, ELO) — retained for the lifetime of your account
Match statistics & round data — retained indefinitely as part of the match history
Demo files — automatically deleted after the retention period configured by admins (default: 14 days)
Support tickets — retained indefinitely for audit and dispute reference
Ban records — retained indefinitely even after a ban expires, for moderation history
Activity log — staff action log retained indefinitely
Session data — expires when you log out or after a period of inactivity

If you request account deletion (see Your Rights), your personal identifiers will be removed, though anonymised match statistics may be retained for historical integrity.

05 Data Sharing

We do not sell or share your personal data with third parties for commercial purposes.

Your data may be shared in the following limited circumstances:

Public leaderboard and profile — your name, Steam ID, and statistics are visible to other users unless you set your profile to private
Anti-cheat cooperation — in cases of confirmed cheating, Steam ID and ban information may be shared with other CS2 community platforms or Valve as appropriate
Legal obligation — we may disclose data if required to do so by law or valid legal process

Your support ticket contents, staff notes, ban reasons, and internal moderation records are never shown to other players.

06 Steam & Third Parties

This Service uses Steam OpenID for authentication, operated by Valve Corporation. When you log in, you are redirected to Steam's login page and Valve's own privacy policy governs that interaction.

We receive only your public Steam profile data (Steam ID, name, avatar). We do not receive your Steam password, email, friends list, or purchase history.

Valve's privacy policy: store.steampowered.com/privacy_agreement

CS2 game servers may be hosted via third-party infrastructure (e.g. Fragify). Game data collected during matches is transmitted to our panel via the MatchZy plugin webhook. The game server host may retain standard server logs.

07 Your Rights

You have the following rights regarding your personal data:

Access — you can view your match statistics, ELO, and profile data on your player profile page at any time
Profile privacy — you can set your profile to private from your profile page to hide stats from other users
Correction — if your Steam display name changes, it updates on next login
Deletion — you may request full account deletion by opening a support ticket. We will remove your account and personal identifiers within 30 days
Portability — you may request an export of your match statistics via a support ticket

Account deletion requests will also remove your ELO, team memberships, and match history attribution. This cannot be undone. Ban records may be retained in anonymised form.

To exercise any of these rights, open a support ticket: Open a ticket →

08 Cookies & Sessions

This Service uses a single PHP session cookie to maintain your login state. This cookie is:

Set only when you log in via Steam
Used solely to identify your authenticated session
Deleted when you log out or the session expires
Never used for tracking, analytics, or advertising

We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts. There are no advertising cookies on this platform.

If you enable Two-Factor Authentication (2FA) on your account and choose "Remember this device", a separate trust cookie is set for 30 days. This cookie contains a hashed token that allows your device to skip the 2FA prompt on subsequent logins from the same browser. It is never used for tracking and can be cleared by logging out.

09 Security

We take reasonable technical measures to protect your data, including:

HTTPS encryption for all connections to the panel
Prepared statements and parameterised queries to prevent SQL injection
CSRF token validation on all forms
Role-based access controls limiting what each staff tier can view
Session ID regeneration on login to prevent session fixation
IP-based login rate limiting via Redis to prevent brute-force attempts
Timing-safe secret comparison for all webhook authentication
Security headers on all responses: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy
Session cookie fully expired on logout — no residual session access

However, no system is completely secure. We cannot guarantee absolute security of data transmitted over the internet. If you discover a security vulnerability, please report it responsibly via a support ticket or directly to Fragway Network.

10 Contact

For any privacy-related questions, data requests, or concerns, please contact us:

Fragway Network
fragway.net
Open a Support Ticket →

We aim to respond to all privacy-related requests within 14 days.