Privacy Policy.

1. Controller

2. Hosting and server logs

The web application is hosted on a server operated by STRATO AG in Germany. When you access the service, server logs may process your IP address, date and time, requested address, amount of data transferred, referrer, browser and operating system. This is used to provide a secure and stable service and to detect errors and abuse. The legal basis is Article 6(1)(f) GDPR. Logs are retained only for as long as required for operation, security and error analysis.

3. Steam login

Login is handled through Steam OpenID. We receive your SteamID64. Your Steam password and Steam Guard credentials are not transmitted to clipthat. To display your profile, we may retrieve public details through the Steam Web API, including your profile name, avatar, profile URL, online status and publicly visible CS2 playtime. The provider is Valve Corporation. The legal basis is Article 6(1)(b) GDPR, as this processing is required to provide your account.

4. Match history and access codes

If you enable automatic match import, we process your SteamID64, Match Sharing Code, Game Authentication Code, detected match codes and replay addresses. The Game Authentication Code is stored in encrypted form. We never request your Steam password or Steam Guard codes. Processing is necessary to provide the match synchronisation requested by you and is based on Article 6(1)(b) GDPR. You may disconnect the integration at any time; stored access codes will then no longer be used for new requests.

5. Demos, analysis data and clips

We process demo files uploaded by you or retrieved through match history, SteamIDs and player names contained in those files, match and kill events, highlight scores, render jobs, video clips and thumbnails. This is required to analyse, render, store and provide your clips under Article 6(1)(b) GDPR. As demo files may also contain data relating to other match participants, the visible personal analysis is generally limited to highlights belonging to the assigned user.

6. Public profiles, clips and likes

Your profile name, avatar and shared clips may be publicly accessible. For likes, we store the signed-in user's SteamID64, the clip ID and the time of the like. This enables community features, abuse protection and selection of the Clip of the Day. The legal bases are Article 6(1)(b) and (f) GDPR. Do not publish content unless you hold the necessary rights.

7. Cloudflare R2

Videos and thumbnails are stored in the private Cloudflare R2 object storage service. Access is provided through time-limited signed links. The provider is Cloudflare, Inc. or the relevant Cloudflare contracting entity. Cloudflare processes technical access data. Storage and delivery are required for performance of the contract and for secure, efficient operation under Article 6(1)(b) and (f) GDPR.

8. Payments with Stripe

If paid subscriptions are enabled and used by you, payments are processed by Stripe. Contact, contractual, payment and transaction data may be transmitted to Stripe. Full card details are not stored on our servers. The legal bases are Article 6(1)(b) and (c) GDPR. clipthat does not transmit payment data unless you use a paid feature.

9. Cookies and sessions

clipthat uses only technically necessary session and security mechanisms. These keep you signed in for up to 30 days and are refreshed while you actively use the service, protect forms against unauthorised requests, remember your language choice and temporarily store the login flow. You can sign out at any time or end sessions on all devices. The legal bases are Section 25(2)(2) TDDDG and Article 6(1)(b) and (f) GDPR. We currently use no advertising or analytics cookies.

9a. First-party audience measurement

To evaluate use of the service and guide technical development, clipthat counts page views and approximately unique visitors per day. We process the requested path, timestamp and the IP address temporarily to immediately create a non-reversible hash that changes daily. The full IP address is not stored in the statistics. No cookies are set and no analytics data is sent to third-party providers. Visits from administrators, identifiable bots and browsers with “Do Not Track” enabled are not counted. Statistical data is automatically deleted after 90 days. The legal basis is our legitimate interest in privacy-conscious audience measurement and service improvement under Article 6(1)(f) GDPR.

10. Recipients and international transfers

Data is disclosed only to parties that require it to operate and provide the service, particularly hosting, storage, authentication and payment providers. Providers outside the European Economic Area may process data on the basis of an adequacy decision, the EU-US Data Privacy Framework where applicable, or the EU Standard Contractual Clauses.

11. Retention periods

Account data is generally retained until the account is deleted. Match access data remains stored until the match-history integration is disconnected or the account is deleted. Demos, analysis data and clips are stored according to the selected plan and storage limits, and until deleted by the user or operator. Billing records subject to statutory retention obligations are kept for the required period. Security logs are deleted once they are no longer needed for their purpose.

12. Your rights

Subject to the applicable legal requirements, you have the right of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with future effect. To exercise your rights, contact the address stated above.

13. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. For a private-sector company based in Bavaria, the competent authority is generally the Bavarian State Office for Data Protection Supervision (BayLDA).

14. Security and changes

We use appropriate technical and organisational measures, including encrypted HTTPS transmission, access restrictions, private object storage and encrypted storage of sensitive match access data. This policy will be updated when features, service providers or the legal framework change.