Privacy

Profit.tf keeps your Steam ID, the public inventory it scans, and the trades you type in. It never receives a password. Nothing is sold, shared or used for advertising, and no route in the app shows one trader another's entries.

The rest of this page is the same statement with the details filled in. If something here contradicts what the app does, the app is the bug and the page is the promise.

• Your Steam ID, and the display name and avatar on your public Steam profile. That is what signing in through Steam hands over.
• The contents of your TF2 inventory as it was when you scanned: the items, and the attributes each one carries.
• Everything you put in the ledger yourself: prices, dates, storefronts, quantities and which items you chose to track.
• Your settings and saved views: the theme, whether money reads in keys or cash, and the filters you saved as tabs.
• A session cookie, so the site knows which account is asking.

There is no email address, no phone number and no payment detail, because nothing here needs one. There is no password: Steam sign-in returns an ID, and a password is never sent to this site to be stored, hashed or lost.

• tf2pt_session is the sign-in cookie. It is signed, it cannot be read by scripts in your browser, it is only sent over HTTPS, and it expires after 30 days. Without it the site cannot tell one signed-in person from another, so there is no version of this app that does not set it.
• Google Analytics sets its own cookies (the ones beginning _ga) to count visits and tell a returning visitor from a new one.
• Vercel Web Analytics and Speed Insights set no cookies at all. They measure page views and load times without identifying anyone.

That is the whole list. There are no advertising cookies, no tracking pixels and no third-party scripts beyond the analytics named above.

To answer two questions: whether anybody is finding the site, and whether it is fast. Which pages get visited, roughly where the visitor came from, and how long a page took to render.

• None of it is joined to your ledger. The app sends the analytics no identifier of its own: not your Steam ID, not an account number, not an item, not a trade. What they receive is a page view, the same thing they receive on any site.
• The measurement only runs on profit.tf. Local development and the preview site report nothing, which is also why the numbers are not padded with our own testing.

• Ledger entries stay until you delete them, because they are the point of the app.
• Inventory snapshots do not accumulate. Only the two most recent per account are kept, and every scan prunes the ones behind them.
• The database is backed up daily to an archive that expires after thirty days, so a deletion has left the backups within a month of being made.
• The session cookie expires after 30 days, or immediately when you sign out.

Nobody, in the sense people usually mean. Nothing is sold, rented, shared with advertisers or handed to a data broker.

In the sense of who technically handles it: the site runs on Vercel and the database is MongoDB Atlas, so both hold the data in the ordinary course of hosting it. Item prices are fetched by our server rather than by your browser, so reading your ledger does not announce you to a price site. Item pictures are the exception and are loaded by your browser from Steam's own image servers, the same as on any TF2 trading site.

Whoever administers this app can read the database, the same way that is true of every site you have an account on. Since 2026-09-05 an administrator can also open your dashboard and see it as you do, which is how the site gets improved by watching how it is actually used rather than how one person uses it. It is read only: nothing can be changed, added or deleted while your account is being viewed, and that is enforced on the server rather than by hiding buttons. Every view is recorded, and it ends by itself within the hour. What is still not true here is one *trader* reaching another: there is no route, link or setting that shows one user the entries belonging to another, and the tests fail if one appears.

• Signing in uses Steam OpenID. You type your Steam password on Steam, and Steam tells this site which account you are.
• A scan reads the inventory that is already public on your Steam profile. If yours is set to private, the scan fails rather than finding a way in.
• Nothing is ever traded, listed, bought or sold on your behalf. This app records trades you make elsewhere and has no ability to make one.

Ask, and it is removed by hand: the account, the ledger, the saved views and the inventory snapshots. Not hidden or flagged, actually deleted, and gone from the rolling backups within thirty days.

The way to ask is to email support@profit.tf from wherever you like, or to message the Steam account linked at the bottom of this page. A button in Settings is coming, and it says so rather than pretending: deleting an account keyed to a Steam ID has a wrinkle worth settling first, which is that signing in again would silently recreate an empty one.

The date at the top is the last time it changed. This page lives in the same repository as the app, so every edit to it is a commit anybody can read alongside the change that prompted it.