Privacy policy

Who is responsible. TrainYourCS is operated by J Pickering trading as TrainYourCS, 1 Example Street, Townsville, AB1 2CD, which is the data controller for the personal data described here. Contact support@trainyourcs.com about anything on this page.

What we hold, and why

Your account. Your name, email address, a hash of your password (never the password itself), an optional in-game handle, and when you last signed in. We need these to give you an account and to let you back into it.

Your team. Which teams you belong to and your role on each, plus the training you have been assigned, opened and completed; the team’s calendar, tasks, stratbook, opponent notes and demos. Owners and coaches of your team can see your training records — that is what the product is for, and it is the basis on which you joined.

Linked accounts, if you connect them. Connecting Steam stores your Steam ID, which is how the app knows which player in a parsed demo is you. Connecting FACEIT stores your FACEIT id, nickname, match history and elo readings. Both are optional, both can be disconnected from your account page, and disconnecting removes the link.

Demo files. A demo contains the names and Steam IDs of everyone in that match, including people who have no account here. We parse it into positions, rounds and statistics. The original file is deleted after 30 days; the parsed data stays with the team that uploaded it.

The TrainYourCS recorder app, if you use it. When you press Record it captures your screen, your microphone and your computer’s sound until you stop, and uploads them to your team, where your teammates, owners and coaches can watch them. Nothing is recorded until you (or, if you turned on “Record together”, a teammate while you are in CS2) press Record. For each signed-in copy of the app we hold which account it belongs to, the app version, when it was signed in and when it was last seen — not your computer’s name. While the app is open it tells us every few seconds whether you are in CS2 and whether you are recording, so your team can see who is ready; that is kept in memory only and never written down.

Security records. Sign-in attempts, successful and failed, with the IP address they came from — this is what makes account lockout possible after repeated failures. Deleted after 30 days. Actions taken by our staff in the admin panel are logged with their IP address, so that support access to an account can be accounted for afterwards.

Visits to the public pages. Counted, but not tracked. We record that a page was viewed on a date and which site linked to it, as running totals. To tell one person’s four page views from four people’s one, each visit is hashed together with a secret that is generated fresh every day and never written to disk — so the hash cannot be matched back to an address once the day has turned over. We do not store IP addresses for this, we do not place anything on your device for it, and no third party is involved. The hashes are deleted after 90 days.

Cookies

One cookie, and only after you sign in: the session cookie that keeps you signed in. It is strictly necessary for a service you have asked for, it is not used for advertising or profiling, and it goes when your session ends. There are no analytics, advertising or social cookies on this site. If you dismiss the cookie notice, that preference is kept in your browser’s local storage and never sent to us.

Who else sees it

Only the processors needed to run the service, and only what each one needs:

• Stripe — subscriptions and payments. Card details go straight to Stripe and never reach our servers; we hold a customer id, the plan and its status.
• Our email provider — sends account email such as invitations, password resets and reminders. It sees the address and the message.
• Our hosting provider — the server the app runs on, in the United Kingdom. All data is stored there.
• Steam and FACEIT — only if you connect them, and only to identify your account and read your own match data.
• Embedded content — if your team embeds a Google Doc, a YouTube video or a Twitch clip in the stratbook, opening that page loads it from Google, YouTube or Twitch, who will see the request as they would on any site.

We do not sell personal data, we do not share it for advertising, and we do not use it to train machine-learning models.

How long we keep it

Account and team data for as long as the account or team exists. Original demo files for 30 days. Recordings from the app for 21 days, unless the team deletes them sooner. Sign-in records for 30 days. Visitor hashes for 90 days. Aggregate visit counts, which identify nobody, are kept indefinitely. Ask us to delete your account and we will remove your personal data within 30 days, except anything we must keep for accounting.

Your rights

Under UK GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to have it sent to another provider. Email support@trainyourcs.com and we will answer within one month. If you are not happy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.

A note on team data. If you ask us to delete your account, your personal details go — but the content you created for a team belongs to that team and stays with it, as clause 4 of the terms says. Ask the team owner if you want that removed too.

Children

Accounts are for people aged 13 and over. If you believe a younger child has an account, tell us and we will delete it.

Changes

If this policy changes materially we will say so by email or in the app. The date at the top always reflects the last change.