Privacy Policy
Effective Date: October 19, 2026
Privacy Summary
sboxindex is operated by the owner of sboxindex.com. You can browse the site without an account. If you sign in with Steam, we store your public Steam ID and the information you choose to save, such as your watchlist and price alerts. We never receive your Steam password, we do not sell personal data, and we do not use advertising or tracking cookies. You can see, correct or delete your data at any time, and we share it only with the providers that run the Service or with authorities when the law requires it. The full policy is below.
1. Introduction
This Privacy Policy explains how the owner of sboxindex.com (“sboxindex”, “we”, “us” or “our”) collects, uses, shares and protects personal information when you use sboxindex.com (the “Service”). “Personal information” means any information that identifies you or could reasonably be linked to you, such as your Steam ID. We aim to handle it in line with applicable data protection laws, including the EU and UK General Data Protection Regulations where they apply. By using the Service, you acknowledge that you have read and understood this policy.
2. Categories of Personal Data Collected
Signing in is optional and takes place on Steam’s own website. Depending on how you use the Service, we may process the following:
| Category | What it includes |
|---|---|
| Identification data | Your Steam ID, the public identifier of your Steam account, received when you sign in, and when your account was created, last signed in and last used the Service. |
| Profile data | Your public Steam display name and avatar where available, and the username you choose on sboxindex. |
| Inventory data | The s&box items in your Steam inventory and how many of each, read from Steam’s public inventory page when you sign in or press Refresh. This works only if your Steam inventory is set to Public; if it is private, nothing is read. |
| Saved content | Watchlist items, portfolio entries, price alerts, notifications, display preferences, a Discord webhook address if you choose to add one for alerts, and your Steam trade offer link if you choose to add one. |
| Trade ads | The items you offer and ask for in a trade ad, and when you posted it. Ads are public and are deleted after 7 days, or sooner if you delete them. |
| Communications data | Messages you post in the community chat, with the time they were sent. |
| Moderation records | Mutes, bans and removed chat messages, with their length, the staff member who acted and, for a message removed by a moderator or admin, a copy of its text so the site owner can review moderation decisions. |
| Technical data | IP address, browser type and request times, processed by our hosting provider to deliver and protect the Service. We keep only a one-way hash of your IP address for rate limiting; raw IP addresses are not stored in our database. |
We never receive your Steam password or Steam Guard codes. We can only see what Steam shows publicly; we cannot move or trade your items, or access your trade offers, wallet or account settings. We do not ask for your email address, phone number, payment details or identity documents.
3. Purposes of Processing
We use the information described above only to:
- Sign you in, keep you signed in and administer your account;
- Provide the features you use, such as your watchlist, portfolio, price alerts and display settings;
- Display your name alongside messages you post in the community chat;
- Show your public profile, including your s&box inventory and its value unless you hide it in your profile settings;
- Show your trade ads, with your username and, if you added one, your Steam trade offer link;
- Moderate the community and enforce our Terms of Service;
- Detect and prevent spam, abuse and attacks on the Service; and
- Comply with legal obligations.
We do not sell, rent or trade personal information, and we do not use it for advertising or marketing.
4. Legal Basis for Processing
If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases:
- Performance of a contract: to provide the account features you ask for;
- Legitimate interests: to keep the Service secure, prevent abuse and moderate the community;
- Legal obligations: where we must keep or disclose information by law; and
- Consent: where it is required, for example when you add a Discord webhook. You can withdraw consent at any time.
5. Automated Decisions
The Service uses simple automated checks to protect the community chat, such as rate limits, slow mode and a list of blocked words. A message caught by the word list is shown only to you and to staff, who review it; it is never shown to anyone else. These checks do not produce legal or similarly significant effects. Mutes and bans are always applied by a member of staff, never automatically. If you believe a moderation decision affecting you was wrong, contact us using the details in Section 16 and a person will review it.
6. Cookies and Local Storage
We use a small number of cookies that are necessary for the Service or remember your choices. We do not use advertising, analytics or tracking cookies.
| Name | Purpose | Duration |
|---|---|---|
| bx_session | Keeps you signed in. Set only if you sign in. | 30 days |
| cur | Remembers your chosen currency. | 1 year |
| mode | Remembers your light or dark mode choice. | 1 year |
| chat | Remembers whether the chat panel is open or collapsed. | 1 year |
Your browser’s local storage also remembers your recently used chat emotes and whether you have seen the chat rules. This stays on your device and is never sent to us.
7. Third-Parties
We rely on the following providers to operate the Service. Each processes data under its own privacy policy. We do not work with advertising partners.
- Cloudflare hosts the Service, stores its data and protects it against attacks.
- Valve (Steam) handles sign-in when you choose to sign in, and provides your public inventory when you sign in or refresh it.
- Google Fonts delivers the fonts used on the site.
- Discord receives price-alert messages, but only if you add your own webhook.
8. Data Sharing and International Transfers
We share personal information only with:
- The service providers listed in Section 7, to the extent needed to run the Service;
- Courts, regulators or law enforcement, where the law requires it or where it is necessary to protect the rights, safety or property of our users or others; and
- A successor organisation, if the Service is transferred, under terms that keep this policy in effect.
Our providers operate globally, so your information may be processed in countries other than your own, including the United States.
For UK and EEA residents only
Where your information is transferred outside the UK or EEA, we rely on safeguards recognised by law, such as the European Commission’s Standard Contractual Clauses and their UK equivalents offered by our providers, and take reasonable steps to keep your information protected.
9. Public Information
Messages you post in the community chat are visible to anyone using the Service, together with your username. Please do not share personal information in chat.
10. Data Breach
If a security incident affects personal information, we will act promptly to contain it and assess the risk. Where the law requires it, we will notify the relevant data protection authority, within 72 hours where feasible, and inform affected users through a notice on the Service.
11. Data Retention
We keep personal information only for as long as it is needed for the purposes in this policy or as required by law:
- Account information and saved content: for as long as your account exists. Inventory data is replaced each time it is read, and erased if your Steam inventory becomes private.
- Chat messages: until you delete your account, staff remove them, or they are cleared by routine housekeeping that keeps only the most recent messages. A message removed by staff is deleted from our database straight away. A message caught by the chat filter is deleted within 7 days, or sooner once staff have reviewed it and you have dismissed it.
- Moderation records: for as long as the mute or ban is in effect, and afterwards only as long as needed to handle repeat abuse. The copy of a removed message’s text is deleted after 30 days. The log of staff actions keeps only its most recent entries.
- Rate-limit records: deleted automatically within 24 hours.
12. Your Rights
Subject to applicable law, you have the right to:
- Access the personal information we hold about you;
- Correct or delete your information;
- Restrict or object to certain processing;
- Receive a copy of your information in a portable format; and
- Withdraw consent at any time, where processing is based on consent.
To delete your account and everything saved to it, or for any other request, contact us using the details in Section 16. If an account is banned, we keep the ban itself (the Steam ID and the reason) after deleting the account, so the ban stays in place. You also have the right to complain to your local data protection authority.
13. Children’s Privacy and Age Restriction
The Service is intended only for people aged 18 or older. We do not knowingly collect personal information from anyone under 18. If we learn that someone under 18 has provided us with personal information, we will delete it. If you believe this has happened, please contact us.
14. Security Measures
We protect your information with:
- Encrypted connections (HTTPS) for all traffic, and storage that our hosting provider encrypts at rest;
- Signed, HTTP-only sign-in cookies;
- Strict content security rules and rate limiting; and
- Administrative access restricted to the site owner and approved staff, with staff able to see only what moderation requires.
No system is perfectly secure, but we work to protect your information and review our safeguards as the Service changes.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will post the new version here and change the effective date at the top of this page. Continuing to use the Service after an update means you accept the revised policy.
16. Contact Information
For questions about this Privacy Policy, your personal information or a moderation decision, contact the owner of sboxindex.com at the community chat on sboxindex.com.