Privacy policy
How prefire handles personal data. Early-access draft, pending formal legal review.
Who is responsible
prefire is run by a solo developer in the EU and is the data controller for everything described here. Contact for any privacy matter: contact@prefire.team. There is no Data Protection Officer; the developer handles requests directly.
What prefire collects
Account identity. When you sign in with Steam, prefire receives the minimum that Steam OpenID returns: your 64-bit Steam id and your public persona name. No password ever reaches prefire. Linking FACEIT later, to pull your matches, stores the OAuth tokens that link returns.
Email address, only if you offer one. The one place prefire accepts an email is the Notify me box for Ask your own demos. That address is used to tell you when it opens and for nothing else: no newsletter, no profiling, never passed on. It sits in its own list rather than on your account, so deleting an account does not remove it. Ask at contact@prefire.team and it is deleted.
Demo files and everything derived from them. The .dem files you upload or that are pulled from a connected account, the parsed rows, the counted findings, the round clips, the AI-written notes, and any question you ask about them.
Operational data. Standard server logs (IP address, timestamp, request path, error traces) and a per-call record of AI usage and cost. No analytics or advertising trackers are in place today; if that changes it will be opt-in and described in the cookie policy first.
What prefire never collects: your voice or in-game chat, contents of other browser tabs, or any data used to train a model. Your demos and sheets are not sold or shared.
Why prefire is allowed to (legal basis)
Under the GDPR, each use of your data rests on one of these:
- Performance of a contract (Art. 6(1)(b)): storing your account, parsing your demos, and showing you the sheets you asked for.
- Legitimate interests (Art. 6(1)(f)): keeping the service running and secure, preventing abuse, and controlling AI cost. This includes processing the demo data of other players in your matches, see the next section.
- Consent (Art. 6(1)(a)): anything non-essential, such as future product analytics or marketing email. You can withdraw consent at any time.
Demos contain other players' data
A CS2 demo records everyone in the match: names, account ids, positions, and actions. When you analyze a demo, prefire processes that data about other players so it can build the sheet. The legal basis is legitimate interests: you were in the match or hold the file, the data is already visible to every participant in-client and in the demo, and the analysis is limited to your own review.
If you appear in someone else's prefire sheet and want it restricted or erased, email contact@prefire.team with enough detail to identify the match. prefire will act on it unless there is an overriding reason not to, and will tell you which.
How long it is kept
- Uploaded
.demfile: deleted from the server as soon as the parse finishes (minutes). It is working material, not storage. - Rows, findings and clips: kept until you delete the demo or your account. There is no automatic expiry, but an account left completely unused may be pruned after a long dormancy, with notice to the sign-in address if one is available.
- Notify me address: kept until Ask your own demos launches and the announcement has gone out, or until you ask for it to be deleted, whichever comes first.
- Server logs: a rolling window of about 14 days, then rotated out.
- AI cost ledger: retained for accounting, with the link back to a specific sheet removed when that sheet is deleted.
- Backups: encrypted, rolling 14-day retention. Deleted data disappears from backups within that window.
Who processes it
prefire uses a small number of processors, all bound by data-processing terms:
- Hosting and database: a VPS provider and a managed Postgres provider, both in the EU.
- Object storage: for large regenerable blobs and backups.
- Anthropic: the model that writes the notes on a sheet. It receives only the already-counted facts, under terms that forbid training on the input.
- Steam: only for sign-in. FACEIT: only with your authorization, to pull your match list.
Where a processor operates outside the EEA, transfers rely on an adequacy decision or the EU Standard Contractual Clauses.
Your rights
You can access, export, correct, delete, restrict, or object to the processing of your data, and you can lodge a complaint with your local data protection authority.
The fastest route for the common two is in the app: Account has a one-click JSON export and account deletion. Deleting a single demo also removes its rows and clips immediately. For anything else, email contact@prefire.team and prefire will respond within 30 days.
Security
Traffic is HTTPS-only. Sheets are scoped to the owning account and checked on every request. OAuth tokens and the database are access-controlled; backups are encrypted. No system is perfect: if a breach affects you, prefire will notify you and the relevant authority as the GDPR requires.
Children
prefire is not directed at children and is not intended for anyone under 16. If you believe a child has used it, contact contact@prefire.team and the account will be removed.
Changes
When this policy changes materially, the date at the top moves and, for anything that affects your rights, a notice goes on the site before it takes effect. This is a draft under early access and will be firmed up with legal review before a public launch.