Privacy Policy — OVERSKILL.gg

1. Data controller

The data controller is MINDNEY SAS, a simplified stock company (SAS) registered in Uruguay (RUT 220052950015), with registered address in Canelones, Uruguay, operating OVERSKILL.gg. The privacy contact channel is in section 12. OVERSKILL is not established as a GDPR controller in the European Union.

2. Data we process

Steam identity: when you sign in with Steam (OpenID), and while your account stays active, we process your SteamID, public profile, VAC status, CS2 hours, account age, and persona name (including the name-benefit tag, if you activate it). We may re-check VAC and Steam profile data on later connects and on a periodic catch-up. When you sign up, the Steam, CS2, and CSRep data read when you connect is held on our servers for up to 15 minutes while you give the signup consents, and discarded if no account is created.
Public comments on your Steam profile (signup only): the first time you connect a new Steam account, we read once the public comments on your Steam Community profile (up to the 200 most recent): the text, the commenter’s Steam display name and account ID, and the date. An automated count measures how many comments accuse the account of cheating. If it passes a threshold, the account may be held for a manual review: a person on our team reviews the comments and decides whether the account is activated or rejected. The automated count never rejects or bans an account on its own. If the comment section is private or has too few comments, signup continues as normal. Existing accounts are never re-checked. We read only public comments, and only for this purpose: we do not use them for anything else or share them, and the internal notice to the team carries the counts, never the comment text or authors. If you wrote one of those comments, you can exercise your rights through the contact in section 12.
Our own reputation score (as a backup to CSRep): we check every Steam connect with CSRep (section 4). When you sign up with a new Steam account, we also compute our own reputation score, which may let you in while CSRep is unavailable. For it we read, through the Steam Web API, your public Steam friends list, only to count how many of those friends have a VAC or game ban on their public Steam record, plus your Steam level and the number of games you own; and, by looking up your SteamID in the Data API of FACEIT (a competitive Counter-Strike platform, see section 4), whether your Steam account has a FACEIT account and, if so, when it was created, whether it is verified, how many Counter-Strike 2 matches it has played, and its bans (type, reason, and dates). We keep only the result, as an internal security audit record (section 8): the score, the decision, and the numbers behind it (friends counted, how many and what share of them are banned, your Steam level, games owned, account age and CS2 hours, and the FACEIT account’s age, verification, match count, and number of bans). We never store or log your friends’ identifiers, or your FACEIT nickname or ID. The score never rejects anyone on its own: below the bar you are asked to try again later, and it can only let you in before CSRep answers. If you got in this way, we compute it again at your next Steam logins until CSRep answers; if CSRep then does not approve the account, your sessions are ended and the account is blocked at the next sign-in, like any account CSRep rejects. If you are one of those friends, we only count your public Steam data, and you can exercise your rights through the contact in section 12.
Email address (optional): if you verify it, we use it for the claim action in the app, account recovery, service communications, and legal obligations.
Wallet address: the address of the wallet you connect; it is public on-chain.
Steam trade URL: an optional profile default, and a snapshot when you claim a skin prize (raffle win or redeem code) so we can deliver it via a Steam trade offer.
IP and technical data: for security, fraud prevention, and latency measurement.
Gameplay and match data: demos, logs, and match events, stored on Amazon Web Services.
Match highlights: from the GOTV demo of a finished match we render, on our own infrastructure on Amazon Web Services, a short video clip (up to 60 seconds) of one player’s best play, with a poster image and a vertical version. The clip shows the featured player’s public username and avatar, and may be published on our website, on our official Discord server, where we mention the featured player (their linked Discord account, if they linked one, or otherwise their public username), and, for curated clips, as Shorts on our official YouTube channel (the vertical version without the intro) and as Reels on our official Instagram account (the same vertical version, at most two per day chosen by an automatic daily selection; the Reel caption may name the featured player’s public username). On our website each public clip has its own page with the video, its poster image and a stable link to the video file; public clips are listed in a video sitemap, so search engines may index and display them. You can turn this off in Settings → Privacy (see sections 3 and 8).
Elo, competitive rank and Trust Rank: your rating per format and season, and your privilege rank for entry caps and claim wait.
Discord account (optional): if you link your Discord account (Settings → Linked accounts), we read your Discord user ID, username, display name, and avatar once, through Discord’s identify scope. We use them to mention you in posts on our official Discord server, to let server members look up your public OVERSKILL stats with the bot’s commands (/stats, /card, /compare), to give you the automatic Verified Player role on that server, and — only if you turn them on — to send you direct-message reminders about your own tournament matches (check-in open, next match coming up, match ready). We do not store Discord tokens. Unlinking deletes the link, removes the role, and turns the reminders off.
Twitch or Kick account (optional) and broadcasts: if you link your Twitch or Kick account (in the Broadcast panel or in Settings → Linked accounts), we read your provider user ID, channel name, display name, and avatar once, and immediately revoke the access token: we do not store Twitch or Kick tokens. While you have a broadcast open, we read the public status of your channel about every 60 seconds, with OVERSKILL’s own application credentials (whether it is live, start time, stream title, category, viewer count, and the stream’s preview image) and overwrite it on every read, keeping no history. For each broadcast we store the provider, when you confirmed the minimum stream delay, when it started and ended, when we first and last saw your channel live, and why it ended; the delay confirmation and the start and end of each broadcast are also kept as audit records. Per tournament we store when you were shown live and why that ended. While your broadcast is live in Counter-Strike, the page of every tournament where you hold a seat publicly shows your OVERSKILL username and avatar, your channel name and link, a still preview image of your stream, the stream title, category, and viewer count, and embeds the provider’s player, which loads only when a visitor presses play. If we ever show your channel anywhere else, we will say so in a new version of this policy before we do.
Acquisition data: how you first reached OVERSKILL: the campaign’s UTM tags, the domain of the site that sent you, the entry page, and whether the link carried an ad click ID (only that it did, never its value). We read it from the first-party os_attr cookie or from the sign-in link and store it with your account once, when the account is created.
Analytics: via Google Analytics 4. Without your consent, Google receives only cookieless, identifier-free signals; analytics cookies are set only with your consent. Team and test-account traffic is flagged as internal (see the Cookie Policy).
Advertising measurement: if you accept advertising cookies, Meta Pixel 1851423562526503 receives only that a page was viewed. We do not send amounts, wallet addresses, SteamIDs, usernames or codes, and we do not match the visit to your account.

3. Purposes and legal bases

Performance of the contract: playing, matchmaking, settling matches, and creating and publishing match highlight clips on our website (including clip pages that search engines may index), our official Discord server, our official YouTube channel, and our official Instagram account (opt-out in Settings → Privacy).
Legitimate interest: security, anti-cheat, and fraud prevention, including reading the public comments on your Steam profile when you sign up, to detect reports of cheating and protect fair play (a person always makes the decision on the account); understanding which campaigns and channels bring players (acquisition data and cookieless, identifier-free analytics signals), with no advertising use and no profiling.
Consent: analytics cookies, advertising cookies for a Meta page view, and, where applicable, optional marketing communications; the optional Discord account link and its opt-in direct-message reminders, both revocable at any time in Settings → Linked accounts (you can turn the reminders off separately).
Consent (Twitch and Kick): the optional link to your Twitch or Kick account, revocable at any time in Settings → Linked accounts, and starting a broadcast with your linked channel, which publishes your channel on the pages of the tournaments where you hold a seat while you are live in Counter-Strike. You withdraw it by stopping the broadcast (“Stop broadcast”) or by unlinking your channel.
Legal obligation: compliance with applicable law (including Uruguayan Law 18.331).

4. Processors and recipients

Processors that handle data on our behalf include:

Google — Google Analytics 4 (cookieless signals and, with your consent, analytics cookies);
Meta Platforms, Inc. (United States) — the Meta Pixel, which receives a page view only after you accept advertising cookies. This is separate from Instagram, where we publish Reels;
CSRep — reputation (Trust Rate) derived from your SteamID;
Alchemy and Infura — RPC node providers;
Amazon Web Services — storage of demos and logs; rendering (in the United States) and storage of match highlight clips;
Render — hosting;
DatHost — CS2 servers.

Independent third parties / public rails (not processors acting only on our instructions): Valve / Steam (OpenID, Web API, and the public comments on Steam Community profiles, under Steam’s terms); FACEIT (ESL FACEIT Group Limited, United Kingdom), a competitive Counter-Strike platform whose Data API we query with OVERSKILL’s own server key, looking up your SteamID, to read the FACEIT account details used in our reputation score (section 2), under FACEIT’s terms; Discord (Discord Inc., United States), where we post match highlight clips, the bot’s replies, and tournament thread updates on our official server, assign its roles, and send the direct-message reminders you turn on, under Discord’s terms; YouTube (Google LLC, United States), where we publish curated match highlight clips as Shorts on our official OVERSKILL channel, under Google’s terms; Instagram (Meta Platforms, Inc., United States), where we publish curated match highlight clips as Reels on our official OVERSKILL account, under Meta’s terms; search engines (for example, Google Search), which may index and display the public pages of our website, such as player profiles, finished-match pages, and public clip pages, under their own terms; the BASE network (public chain). On-chain operations are public by the nature of the blockchain.

Twitch (Twitch Interactive, Inc., United States) and Kick (Kick Streaming Pty Ltd, Australia) are also independent third parties: they are not our processors and we are not theirs. They are involved when you link your own account (one identity read, with the token revoked), when, while you have a broadcast open, we read the public live status of your channel with OVERSKILL’s application credentials, and when a visitor presses play on the tournament page to load the provider’s player, all under each provider’s terms and cookie policy.

5. On-chain data

Your wallet address, your entries, and settlements are recorded publicly, permanently, and immutably on the BASE network. As a result, the rights to erasure and rectification are limited for on-chain data. Match history is anonymized (the wallet is replaced by a hash), not deleted, because deleting it would affect your opponents’ history.

6. Analytics data minimization

We never send third-party analytics or the Meta Pixel the exact amounts of entries or prizes, wallet addresses, or individual payouts. Nor do we send SteamIDs, usernames, codes, or other identifiers in page addresses or titles. Google’s advertising signals are off. After you accept advertising cookies, the pixel sends only a page view.

7. International transfers

Some providers (for example Google, Steam, AWS, Discord, Twitch, or Kick) may process data outside Uruguay and outside the European Economic Area; match highlight clips, for example, are rendered on AWS infrastructure in the United States. We rely on the safeguards those providers make available, including the European Commission’s Standard Contractual Clauses where the provider offers them. This policy does not claim that MINDNEY has a signed SCC with every vendor. Twitch processes data in the United States and Kick in Australia.

8. Retention

We keep data while your account is active and for the applicable legal periods. Audit records (audit_events), match events (match_events), and on-chain records are never deleted; all other data is deleted or anonymized. Match highlight clips (video, poster image, and vertical version) are kept for up to 365 days and then deleted. Hiding a clip (for example, after an opt-out) removes it from the website and from our sitemaps, and its page and video link return “not found”; search engines may keep showing cached results for some time, and we do not control when they remove them. Hiding a clip does not delete the stored file before that period ends, and does not automatically remove posts already made on our official Discord server, uploads already made on our official YouTube channel, or Reels already published on our official Instagram account; you can ask us to remove a published clip (section 12).

Acquisition data is kept with your account and deleted when the account is closed; the os_attr cookie expires after 90 days. Google Analytics keeps analytics data for 14 months.

If you unlink your Twitch or Kick account, or close your account, the link is deleted. The live status is overwritten on every read and we keep no history. Your broadcast records stay with your account and each tournament’s records stay in that tournament’s history, in both cases without a channel name or live data once the account is unlinked. The audit records of the delay confirmation and of the start and end of each broadcast are permanent, like every audit record.

When we read the Steam comments at signup, the result (the counts and excerpts of the comments that mention cheating, with their authors’ display names and account IDs) is cached for up to 24 hours. If the account goes to review, those excerpts and their authors’ data are kept only until the team decides, and then deleted; the counts, the comment IDs, the decision, and the team’s note stay with the account record. The audit records of the check and of the decision keep the counts, not the comment text or authors.

9. Your rights

Under Uruguayan Law 18.331, and any mandatory rights that apply in your country of residence, you may have the right to:

access your data;
rectify it;
erase it;
object to its processing;
restrict its processing;
data portability;
withdraw your consent at any time;
lodge a complaint with the competent supervisory authority.

These rights are subject to the on-chain limitation described in section 5.

10. The right to be forgotten: how to exercise it

Deletion is requested through the official Discord. The account is marked for deletion for 30 days, and after that period personal data is permanently deleted.

11. Minors

The service is for adults (18 or older). We do not knowingly process minors’ data.

12. Contact and data protection

Privacy requests: contact@overskill.gg. Registered address: Canelones, Uruguay. No Data Protection Officer is appointed.

Account deletion continues via the official Discord as described in section 10. You may also use the support paths published on the site. You may lodge a complaint with Uruguay’s Unidad Reguladora y de Control de Datos Personales (URCDP) or with the competent supervisory authority in your country.

13. Changes

We may update this policy. Material changes are communicated and the current version is identified at the top of this document.