GriefBot
Up to date: Build 5.8.5 is made for CS2 1.41.9.0, the version live now.Sign inSign up

Privacy

Updated

This page says what griefbot.net stores about you, why, for how long, and who else sees it. The site is run by [[FILL: legal name of the operator and its address]]. It is written from the code that runs the site, so it is specific.

What we store

  • Your account: username, a bcrypt hash of your password (never the password), your role, when the account was made, when you were last on the site, and who invited you. Your profile holds an avatar colour, a bio, if staff set one a title, and, if you upload one, a picture. A picture is re-drawn on upload (nothing else in the file is kept, location data included) and is shown to anyone who can see your name, and in the in-game menu. There is no email address: the site does not send mail.
  • Sign-ins: every sign-in attempt to the website or the loader is recorded with the time, the result, your IP address, a city, region and country looked up from it, and the browser or loader that was used. These records are deleted after [[FILL: event_retention_days, 180 by default]] days.
  • Website sessions: a random token in a cookie, stored as a hash, with a hash of your IP and your browser's user-agent string. Sessions end when they expire or you sign out, and dead rows are purged after 30 days. You can see and end your sessions on Account › Security.
  • Devices: the loader sends a hash of the PC it runs on, which is bound to your account so the same account is not used from many PCs at once. You see your devices on Account › Security and can free one yourself.
  • Downloads: when the loader or the overlay is downloaded, with the time, the device hash and a hash of the IP, kept as long as sign-ins are. The overlay carries a per-download watermark that identifies your account if a copy is leaked.
  • Forum, shoutbox, library: what you post, when, and a hash of the IP it was posted from. Deleted posts are hidden, not erased, so staff can review them; shoutbox lines are deleted after 30 days; read notifications after 90 days. Posts stay after an account is deleted and read as "deleted user".
  • Orders: which plan, the price, the currency, the coupon, the payment provider and the provider's reference for the payment, and what access the order granted. Card, bank and wallet details are entered on the provider's own pages and never reach us.
  • Staff actions: everything staff do to an account or to money is written to an audit log with the names involved, kept indefinitely.
  • Rate limiting: counts of actions per account and per IP, stored as hashes and deleted within a day.
  • Lobby presence: while the overlay runs, it tells the site which game lobby you are in so members in the same lobby can share skins. A presence row is deleted an hour after it was last refreshed.

Cookies and browser storage

The session cookie, a short-lived cookie that carries a one-line message across a redirect, and a token for signed-out forms. Unsent forum drafts and small preferences are kept in your browser's local storage and never sent to us.

Who else sees it

  • Payment providers (Stripe, Shopify, PayPal, NOWPayments, Paymentwall, whichever you choose) see what they need to take the payment, under their own privacy terms.
  • Apple Pay and Google Pay run through Stripe. Their order page loads Stripe's script, which Stripe uses to take the payment and to spot fraud; Apple or Google also see the payment in your wallet, under their terms.
  • Cloudflare Turnstile, when it is switched on for the signup page, checks that you are not a bot under Cloudflare's terms.
  • Steam is asked by our server which game version is current. No data about you is sent.
  • Nobody else. We do not sell or share member data, and the site loads no analytics or advertising scripts.

Your rights

You can see most of what we hold on your account pages. To correct something, to get a copy of your data, or to have your account deleted, contact [[FILL: contact email or forum link]]. Deleting an account removes the account, its sessions, devices, configs and library items; orders and forum posts stay, without your name on them. If you are in the EU/EEA or the UK you also have the right to complain to your data protection authority.

Changes

A change to this page is announced on the site, with the date at the top updated.