Privacy Policy

1. Controller

The controller responsible for data processing on this website is:
Ioannis Pavlou
c/o IP-Management #8391
Ludwig-Erhard-Str. 18, 20459 Hamburg, Germany
Email: [email protected]

2. General Information on Data Processing

We process personal data only to the extent necessary to provide a functional website, our FACEITSync services (including FACEITSync Premium), and to fulfill contractual obligations. The legal bases for processing are, in particular:

• Art. 6(1)(a) GDPR (Consent)
• Art. 6(1)(b) GDPR (Performance of a contract)
• Art. 6(1)(f) GDPR (Legitimate interests, e.g. IT security, service optimization)

Where legal obligations apply (e.g., tax retention requirements), processing is based on Art. 6(1)(c) GDPR.

3. Data Collection When Using FACEITSync

3.1 Twitch Integration

When you sign in with your Twitch account, we receive the following data: Twitch ID, username, profile picture, email address, and permissions to manage Predictions. These are required to authenticate your account and provide FACEITSync’s core functions.
Legal basis: Art. 6(1)(b) GDPR (Performance of a contract)

If you did not share an email address through Twitch, you can enter it yourself when you buy. We store it in your account and use it for your invoice, purchase confirmation and messages about your subscription (Art. 6(1)(b) GDPR).

3.2 Steam Integration

When linking your Steam account, we receive your Steam ID. This is used to associate your FACEIT account and retrieve statistics. Legal basis: Art. 6(1)(b) GDPR

3.3 FACEIT Integration

You can link your FACEIT account to your FACEITSync account. We receive your FACEIT ID, username, profile data, and gameplay statistics (e.g., ELO, level, match history). These are used solely to provide core features such as ELO display and automatic predictions. Legal basis: Art. 6(1)(b) GDPR

Important: FACEITSync does not store any passwords. You sign in with Twitch (OAuth 2.0). You link FACEIT via OAuth 2.0 and Steam via Steam OpenID. Access tokens are encrypted and used only for the intended purpose.

3.4 FACEIT Data

Through the FACEIT API, we process your FACEIT ID, username, level, ELO, K/D ratio, win rate, and match data (e.g., match ID, results, demo URLs). These are used for your statistics, Twitch overlays, and automatic prediction generation. Legal basis: Art. 6(1)(b) GDPR

3.5 Public player profiles

We create public player profiles for FACEIT players, even if they do not have an account with us. The source is the public FACEIT Data API. We process the FACEIT ID, nickname, avatar, country and region, level, ELO and regional ranking, the Steam ID stored at FACEIT, verification status, FACEIT bans (type, reason, period) as well as matches with results and statistics (e.g. K/D, ADR, headshot rate, win rate), and derived from these the ELO history and shared matches with other players. For well-known players (e.g. pros) we add a known name or Twitch channel by hand. The profiles are publicly accessible and can be found via search. The purpose is statistics, rankings and search for the CS2 community as well as overlays, predictions and chat commands of streamers who play with or against these players.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting publicly available game statistics)

You can object to this processing (Art. 21 GDPR). Write to us at [email protected].

3.6 Former names

If your Twitch login or your FACEIT nickname changes, we store the previous name together with the time we noticed the change. We use it to redirect old profile links, show former names on the profile and make the profile findable by them in search. With an account, you can turn this display off in the settings under "Profile & language"; former names then appear neither on your profile nor in search, and old links still redirect. We delete the entries for your account together with the account. Former nicknames of a public FACEIT player profile remain part of that profile.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in working links and findable profiles)

3.7 Viewer stats in Twitch channels

If a streamer turns on viewer stats, we record in their channel how long signed-in Twitch users are present in chat and how many chat messages they write. For this we store the Twitch ID, login and display name, and per day the time present and the number of messages. We do not store the content of messages or the times of individual visits. The purpose is leaderboards and chat queries for the channel's community. Only display name, rank and totals within that channel are visible. We delete daily values after 35 days, monthly values after 13 months, totals after 12 months without presence, and all values of a channel 30 days after the streamer has turned the feature off.

You can object at any time: type !fsoptout in a chat where viewer stats run, or write to us. We will then delete your values and stop recording you.
Legal basis: Art. 6(1)(f) GDPR (the streamer's and our legitimate interest in this feature)

4. FACEITSync Connect (Windows app)

4.1 Sign-in and devices

You sign in to Connect through our website. For each PC we create a device in your account: the name of the PC (as Windows calls it), app version, language, the time of sign-in and of last use, and the most recently used IP address. We store the sign-in keys only as a checksum, never in plain text. A device stays signed in as long as you use it at least every 90 days, for at most 365 days. Up to 10 devices per account are active; if an eleventh is added, the one unused for the longest time is signed out. Under Settings › Devices you see all devices and can sign out any of them. We delete signed-out or expired devices after 30 days, and all devices together with your account.
Legal basis: Art. 6(1)(b) GDPR (providing the app), for the IP address Art. 6(1)(f) GDPR (protecting your account)

4.2 Settings Sync and your CS2 settings on your profile

Settings Sync is off until you turn it on on the "Settings Sync" page in Connect. The app then reads the CS2 settings files on your PC and sends us selected game settings: crosshair, mouse (e.g. sensitivity), viewmodel, video, HUD and radar, and key bindings, together with the account number of the Steam account whose folder they come from. The app does not read any other files or content. We keep crosshairs you used for at least 10 minutes as a history. Only what you share becomes public: your profile at /{name}/cs2-settings shows only the areas you unlock one by one, and your chat bot only states values through commands you turn on. If you turn Settings Sync off, we delete the values and the history immediately, and likewise together with your account.
Legal basis: Art. 6(1)(a) GDPR (your consent via the switch, which you can withdraw at any time by turning it off)

4.3 Instant Delay session log

If you use Instant Delay in the Windows app FACEITSync Connect, the app sends us a summary after each stream: counters (for example how often the delay was on or Twitch disconnected) and a short timeline of seconds since the stream started and fixed codes such as "delay on", "Twitch disconnected" or "match live", at most 200 entries. It contains no free text, no addresses, no stream keys and no names. We use it only to find faults in Instant Delay. We delete the timeline after 90 days and the counters after 180 days, both immediately when you delete your account.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working service)

4.4 Set up OBS with one click (only on your PC)

This feature runs only locally on your PC. If you allow it in the Windows app FACEITSync Connect, the app reads the obs-websocket connection data there (port and password from the OBS configuration) and uses it to switch the server in OBS to Connect or back. This happens directly between the app and OBS on your PC: none of it is transmitted, neither to us nor to third parties. The app keeps the password in memory only for that one step. Only your consent and the previous server for switching back are stored, both only on your PC. The app does nothing with your stream key: it does not request it, does not evaluate it, and never stores, shows, sends or changes it. OBS includes it on its own when the stream settings are requested; the app discards that part of the response at once without using it. You can withdraw your consent in the app under "This PC" at any time.

4.5 Feedback after uninstalling

When you uninstall FACEITSync Connect, a page opens where you can tell us why, if you want to. We only pass on the version and language of the app, nothing that identifies you or your PC. We count the opening of this page as an uninstall, with the version, language and time. This shows us how often the app is uninstalled, even without feedback. If you send the feedback, we store your answers with it. We delete all of it after 12 months. We only store your email address if you explicitly ask for a reply. We use it only for that and delete it after 90 days. To prevent abuse and double counting, we store a non-reversible check value instead of your IP address and delete it after 30 days.
Legal basis: For your answers and your email address, your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through our contact form. For counting and abuse prevention, our legitimate interest (Art. 6(1)(f) GDPR).

5. FACEITSync Premium & Payments

5.1 Payment processing by Stripe

When you buy Premium or Player+, we process contract, order and payment data (e.g. chosen plan, term, amount, transaction ID, status). The payment is processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). You pay in the Stripe payment form embedded in our page. You enter card and account details directly with Stripe; we do not receive or store them.

Stripe processes in particular your name, email address, billing details, payment method, amount, currency and transaction ID, as well as technical data for fraud prevention (e.g. IP address, browser and device information). For a subscription, Stripe stores the chosen payment method to collect the following payments. Stripe may transfer data to third countries, in particular the USA, and uses the EU Standard Contractual Clauses for this. More information: stripe.com/privacy

5.2 Payment methods

Through Stripe you can pay by card (Visa, Mastercard, American Express), Apple Pay, Google Pay, PayPal, Revolut Pay or Klarna. Which methods you see depends on your country, device and type of purchase. If you choose Apple Pay, Google Pay, PayPal, Revolut Pay or Klarna, Stripe passes the details needed for the payment (e.g. amount, currency, order reference) to that provider, and its privacy notice applies as well.

5.3 Former payment methods and retention

In the past, Premium could also be paid directly via PayPal and via Coinbase Commerce (cryptocurrencies). We no longer offer these methods. We keep data on purchases made back then (e.g. transaction ID, amount, date) only for as long as statutory retention obligations require.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(f) GDPR (fraud prevention) and Art. 6(1)(c) GDPR (statutory retention obligations). Accounting records are kept for up to 10 years.

6. Email Delivery via Brevo

We use Brevo (formerly Sendinblue) to send transactional and support emails. This may include processing your email address, IP address, browser data, and timestamps. The purpose is to ensure communication, support handling, and reliable email delivery.

Legal basis: Art. 6(1)(b) GDPR (Communication) and Art. 6(1)(f) GDPR (Customer support).

Accounts created before October 18, 2026 receive news and offers by email until they object (Art. 6(1)(f) GDPR, direct marketing); we point this out once in the dashboard, with a link to the settings where you can unsubscribe. Accounts created from that date on only receive them with consent (Art. 6(1)(a) GDPR), for example via the checkbox when you buy or the question in the dashboard. You can unsubscribe or withdraw at any time via the link in every email or in the settings under “Email & bell”.

7. Cloudflare

We use Cloudflare to protect our website against cyberattacks (e.g., DDoS) and to improve performance via a global CDN. Cloudflare may process technical data such as IP addresses, system configuration, and access timestamps. Cloudflare acts as a data processor under Art. 28 GDPR.
Legal basis: Art. 6(1)(f) GDPR (Security & Performance)

8. Server Log Files & Hosting

When visiting our website, certain technical data is automatically recorded (e.g., IP address, timestamp, URL, referrer, user agent). These server logs are used for IT security and troubleshooting and are deleted periodically. Legal basis: Art. 6(1)(f) GDPR

9. Cookies & Local Storage

We use necessary cookies and local storage entries (e.g., session, consent status) to provide essential functionality. Optional cookies, such as those for analysis with Google Analytics, are used only after your consent via the cookie banner.

Legal basis: Art. 6(1)(f) GDPR in conjunction with §25(2) TDDDG (necessary cookies) or Art. 6(1)(a) GDPR in conjunction with §25(1) TDDDG (consent).

10. Google Analytics

We use Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to understand how our website is used (reach, page views, where visits come from, devices) and to improve it. We load the Google script from our own domain (faceitsync.com/metrics/, served via Cloudflare).

Google Consent Mode: We use Google Consent Mode v2 in advanced mode. The Google script is therefore also loaded before you have made a choice in the cookie banner. As long as you have not consented to "Analytics", Google may not store anything on your device: no cookies are set or read and no identifier is created for you. In this state Google only receives a cookieless signal per page view or event containing the consent status, the page visited and the previous page (referrer), the time, browser and device type, screen resolution and language setting, and your IP address, which is technically required for the transmission. Google uses these signals to estimate visits without consent statistically (modelling); we only see aggregated figures. The storage types for advertising (ad_storage, ad_user_data, ad_personalization) always stay switched off on our site, even if you accept all cookies.

After you consent, Google Analytics sets the cookies _ga and _ga_<ID> (lifetime at most 13 months) to recognise your browser on later visits. In addition to the data listed above, a randomly generated identifier is then transmitted. Data may be transferred to Google LLC in the United States; Google LLC is certified under the EU-US Data Privacy Framework.

Legal basis: For cookies and analysis after your consent, Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. For the cookieless signals before consent, our legitimate interest in complete audience measurement (Art. 6(1)(f) GDPR).

Withdrawal and objection: You can withdraw your consent at any time via "Cookie settings" in the footer of the website. We then remove the Google Analytics cookies from your device, and only cookieless signals are sent to Google again. You can object to the cookieless signals (Art. 21 GDPR) by using the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout) or a script blocker. Google Privacy Policy: policies.google.com/privacy

11. Analysis with Matomo

We use Matomo to measure reach and analyze user behavior. We run Matomo ourselves on our server (stats.faceitsync.com); the data is not passed to any third party. Matomo sets no cookies and runs without consent. The IP address is anonymized, and direct personal reference is excluded.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in cookieless audience measurement). You can object (Art. 21 GDPR), for example with a script blocker.

12. Data Retention & Deletion

Personal data is retained only for as long as necessary to fulfill the stated purposes or legal requirements. After deleting your account, personal data is generally erased within 30 days unless retention obligations apply. Specific features have their own retention periods, which we state in the relevant section (3.6, 3.7, 4.1, 4.2, 4.3, 4.5 and 5.3).

13. Recipients & Processors

We engage service providers (e.g., hosting, Cloudflare, Brevo, Google Analytics) who process data solely according to our instructions (Art. 28 GDPR). In addition, the following receive data that they also process under their own responsibility: Stripe and the payment providers you choose (section 5). Data is shared with third parties only where legally required or based on your consent.

14. Data Transfers to Third Countries

If personal data is transferred to recipients in third countries (e.g., the USA: Google, Brevo, Cloudflare), this is done based on appropriate safeguards such as EU Standard Contractual Clauses or adequacy decisions.

15. Minors

Our offer is generally aimed at persons aged 16 and over. If personal data of persons under the age of 16 is processed, this is done exclusively with the consent of their legal guardians.

16. Your Rights

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

17. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy if our services or legal requirements change. The latest version is always available on our website.

18. Contact

For any questions regarding the collection, processing, or use of your personal data, please contact:
Ioannis Pavlou
c/o IP-Management #8391
Email: [email protected]