Privacy Policy

1. Who processes your data

The operator of TF2Syntax, operating under the AVX GROUP brand, determines the purposes and means of processing data within the Service.

Official contact for personal data and legal enquiries: redworld@riseup.net. Use this address to request access, correction or deletion, or to ask about this policy.

Discord is used for operational support. Use the email address above for legal enquiries and personal data requests.

2. What we store

Account data: username, display name and avatar, plus identifiers of the services you signed in with or linked — SteamID, Google ID, Discord ID, Telegram chat ID.

Email address — only if you signed in with Google, in which case it comes from your Google profile. We do not ask for it separately.

A password, if you have one, is stored as an irreversible hash, never in plain text. It cannot be recovered from that hash.

Two-factor authentication data, if you enabled it: the secret is stored encrypted and backup codes are stored as hashes.

Trading data: bot settings, buy orders, positions, trade history and profit calculations, capital snapshots. This is the content of the service itself.

Payment data: the fact of payment, amount, currency, plan and period. We never receive or store card details — payments go through external providers.

The marketing campaign tag you first arrived with, and the date of your first visit.

An account security session register records the device type, IP address when available, and session creation and last activity times. These records support sign-in checks and termination of unrecognised sessions.

3. Visit statistics

We count page visits to understand which content and which advertising work.

What is recorded: the page path without query parameters, the referring site's domain (not the full address), campaign tags, device type (phone, tablet, desktop) and an anonymised technical visitor identifier.

We do not store your IP address or full browser string in these statistics, and the visitor identifier cannot identify you — it only distinguishes a returning visit from a new one.

There are no third-party advertising or analytics trackers that follow you across other sites.

4. Cookies

A session cookie keeps you signed in. The service cannot work without it.

Local interface settings — chosen language and theme. They stay in your browser and are not sent to the server.

We use no advertising cookies.

5. Why we need this data

So you can sign in and so the service knows whose settings, bot and capital these are.

So the bot can trade: your SteamID is required to send items back to you on withdrawal.

To send you notifications about the bot — on Discord or Telegram, if you linked them and turned them on.

To accept payment and enable access according to your plan.

To investigate failures and disputes: operation logs make it possible to reconstruct what happened to a trade.

To analyse use of the Service and the effectiveness of referral sources: a campaign tag and first-visit date are used separately from the data needed to execute trades and payments.

6. Who we share data with

Steam (Valve Corporation) — when trading items and when signing in with Steam.

backpack.tf — when publishing orders and listings on behalf of the bot.

Discord and Telegram — if you linked them for sign-in or notifications; only what is needed to deliver a message is passed.

Google — if you sign in with Google.

The payment provider (CryptoBot) — when paying with cryptocurrency; payment details are handled by them, not by us.

We do not sell or share your data with third parties for advertising. Disclosure is possible only on a lawful request from competent authorities.

7. How we protect data

The site works over a secure connection (HTTPS).

Passwords are stored as irreversible hashes, and personal access tokens are stored as hashes too: even if the database leaked, they could not be recovered.

Bot credentials and two-factor secrets are stored encrypted with a modern algorithm (AES-256-GCM), using a key that is not kept in the database.

Server access is restricted. No one can promise absolute security, but we take this seriously.

8. How long we keep data

Account data and trading history — while your account exists, and for a reasonable period afterwards where needed to resolve disputes and meet legal requirements.

Market data and service logs are kept for a limited time and cleared automatically on a schedule.

Visit statistics are kept in anonymised form.

9. Your rights

You may ask what data we hold about you, ask to correct or delete it, and unlink Discord, Telegram, Google or Steam.

A deletion request means deleting your account. Withdraw your capital first — after deletion there is nothing left to link you to it.

Some data must be kept even after account deletion: records of payments and trades are needed to handle possible claims.

For any such request, contact redworld@riseup.net.

10. Changes to this policy

We may update this policy. The current version is always available at this address, with the date of the last change at the top. Material changes are announced in the news section.