Last updated: 28 September 2026
This notice says what Curio keeps about you, why, for how long, who else sees it, and how to have it corrected, exported or deleted. It covers the website and the Curio Telegram bot.
Who is responsible
Curio is run by the independent developer who owns the site, who decides how your data is used (the "controller"). Questions, requests and complaints: the address will be published here before the public launch.
What we keep, and why
Your account. When you sign in with Steam, Steam tells us your SteamID64, and we read your public Steam profile: persona name, avatar and profile link. We never see or store your Steam password — sign-in happens on Steam's own page. Why: to run the account you asked for (performance of a contract).
Your Dota 2 inventory. When you rate or update your inventory, we read your public Steam inventory and keep the items, their attributes (gems, styles, autographs), our valuation of them and your Collection Score. A private inventory is never read. Why: it is the service (contract).
What you add yourself. Username, bio, country, profile visibility, showcases, wishlists, price alerts, the share cards you make, and your language and currency. Why: contract.
E-mail, if you add one. Used only for the alerts you set up and for messages about your account, and only after you confirm it. Why: your consent — one click in any mail, or Settings, switches it off.
Telegram, if you connect it. The id of your chat with our bot and your @username (to show it in Settings). We never receive your phone number or your messages to others. Why: your consent — /stop in the bot or Settings removes it.
Trading, if you turn it on. Your Steam trade link, the items you put up for trade, whether you want match notices, when you agreed, and which matches we already told you about. Other collectors see your name and those items; only signed-in people see your trade link. If you report someone, we keep the report. Why: your consent for taking part; our legitimate interest in keeping trading safe for reports.
Payments, if you buy something. What you bought, the amount, the payment provider's reference and the payment's status. The provider handles the payment itself; we never see card numbers or wallet keys. Why: contract, and our legal duty to keep records of sales.
Technical records. Our web server logs each request: the time, the page asked for, the browser, and a shortened IP address with its last part removed. Full IP addresses are never written to the logs. Limits that stop abuse count requests per address for a short window — from a minute to a day — and then forget it. Why: legitimate interest in security and reliability.
What we look up without keeping
- The profile check. When you paste another Steam account and press Check, we ask Steam for its public profile and ban status, keep the answer for one hour so a repeat does not ask Steam again, and store nothing.
- A rating without signing in. A public inventory rated by link is kept for 30 minutes and then discarded. It is never saved to anyone's account.
What we never do
We do not sell your data, build advertising profiles, run analytics or advertising trackers, or read private inventories. We never ask for your Steam password, Steam Guard codes or Web API key, and nobody from Curio writes to you in Steam.
Who else receives data
- Hetzner Online GmbH (Germany) hosts our servers. Everything we keep is stored there, in Germany, and nowhere else.
- Valve / Steam. Sign-in happens on Steam, and we ask Steam's public interfaces about your account and inventory with your SteamID. Steam's own privacy policy covers what Steam does.
- Telegram, only if you connect it: alert messages to you pass through Telegram.
- An e-mail delivery service, once e-mail alerts are switched on for the site — named here before it is used.
- A payment provider, once purchases are switched on (NOWPayments is the one planned) — only what a payment needs.
- Other people, as you choose: a public profile, public wishlists and showcases, and — if you turn trading on — your name and your "Up for trade" list.
- Authorities, only when the law requires it.
Valve and Telegram may process data outside the European Union under their own terms. We send them only what the task needs: your SteamID, or a chat id and a message.
How long
- Your account and what you added: while the account exists. After you delete it, everything public disappears at once, and all of it is purged after 14 days; signing in again within those days cancels the deletion.
- Inventory snapshots: the first one, the last 90, and one a month for older ones.
- Alert deliveries: 90 days. Sync logs: 30 days. Audit records of account actions: 2 years.
- Server logs are rotated as they grow (a fixed size per service); the oldest lines go first.
- Trading: the trade link and the list are deleted as soon as you turn trading off. Reports are deleted with the account of either person.
- Payment records: as long as tax and accounting law requires.
Your rights
You can see, export and delete your data yourself: Settings → Account has the full export (a JSON file) and account deletion. You can correct your profile in Settings at any time.
You also have the right to object to processing based on legitimate interest, to restrict processing, to withdraw any consent at any time (it does not undo what happened before), and to complain to a data-protection authority — in the EU, the one where you live. For anything Settings does not cover, write to us: the address will be published here before the public launch. We answer within 30 days.
Age
Curio is for people old enough to have a Steam account (13 or older). If you are under the age at which your country lets you consent to online services yourself (up to 16 in the EU), use Curio only with a parent's or guardian's permission.
Steam
Steam data is used under the Steam Web API Terms of Use: fetched for your own requests or as cached public data, never resold, and deleted on request. Curio is not affiliated with Valve.
Changes
When this notice changes, the date at the top changes too. If a change affects how your data is used, we say so on the site before it applies.