Draft — owner/legal review required before production launch.

Privacy Policy

Launch blocker: This implementation-ready draft is not legal advice. The owner must confirm the responsible operator, contact address, lawful bases, retention periods, and Microsoft contractual details before accepting members.

1. Scope and choices

Dogshit Players is an opt-in public Steam membership directory with structured community ratings. A Steam OpenID sign-in proves control of a Steam account but does not itself publish a profile. Publication starts only after the member accepts the current consent, privacy, and rating document versions and asks the service to retrieve their own public Steam metadata.

2. Data the service stores

the permanent SteamID64 verified by Steam OpenID;
public Steam display name, public profile URL, public avatar URL, current vanity segment, synchronization time, and selected historical public display/vanity aliases;
membership tier and profile state, including deactivation, suspension, and deletion-request timestamps;
the accepted consent, privacy, and rating-terms versions, acceptance time, choices, and any withdrawal time;
structured rating values, category, target and author membership references, invalidation state, and timestamps; public output does not identify individual raters;
cryptographic hashes for short-lived OpenID state, server sessions, and CSRF protection—not the raw server-side tokens;
necessary moderation actions and deletion-processing records, including restricted reasons and the administrator identity supplied by Static Web Apps authentication.

The service does not ask for or store a Steam password, private Steam login/account name, email from Steam, friends, inventory, game history, or ban history. Public search does not contact Steam or an external resolver.

3. Use and public disclosure

SteamID64, current display name, public avatar, public Steam link, membership tier, and eligible rating aggregates are displayed for Active members. Current and selected historical aliases are used to find an Active profile, but the public API does not publish an alias-history ledger. Individual rating authors, session data, consent records, suspension reasons, and moderation detail are not public.

4. Sources and processors

Account ownership is asserted by Steam OpenID. After consent or an explicit member refresh, the backend requests only that verified member’s public summary from Valve’s Steam Web API. Microsoft Azure hosts the Static Web App, Function, Key Vault, and SQL database. Steam data and external services are provided as-is and may be unavailable or inaccurate.

5. Location and transfers

The repository’s production parameters configure the application, Function, Key Vault, and Azure SQL primary resources in Azure West Europe (Netherlands). The owner must confirm the live deployment before launch. Microsoft-managed support, resilience, diagnostic, and backup processing may involve operational or retained copies under the owner’s Azure configuration and agreements; this draft makes no guarantee that every transient or backup copy stays in one country.

6. Retention

OpenID correlation state is short-lived and single use. Member sessions expire under the configured session lifetime and can be revoked earlier. Public profile metadata and aliases remain while needed for active membership or a documented operational/legal reason. Consent history is retained to show which version governed participation. A deactivation hides the profile but is not deletion. A deletion request immediately hides the profile, revokes sessions, and removes ratings authored by or received by the member; administrator completion removes the remaining member-linked application data while retaining only a redacted moderation audit. Azure backups and operational copies expire under the configured platform retention rather than immediately.

7. Member controls

Members can refresh their own public Steam metadata, deactivate, request deletion, sign out, and withdraw participation by deactivating. Suspension and moderation decisions use the contact process below. Reactivation requires fresh Steam authentication, current consent, and a successful metadata refresh.

8. Security

The service uses HTTPS in deployed environments, managed identities, Key Vault, parameterized SQL, opaque hashed sessions, CSRF checks, bounded local search, least-privilege administrative roles, and audit records. No service can promise absolute security.

9. Contact and version changes

The owner must publish a privacy/contact address on dogshitplayers.org before launch. Until then, do not accept production membership. Material policy changes receive a new configured version; members whose stored acceptance is no longer current become ineligible for public visibility and ratings until they review and accept the current documents.