Privacy

There is no analytics script, no ad network and no tracking pixel on this site. Item images are loaded from Valve's public CDN and avatar images from an icon service, both as plain image requests.

A username, an optional email, a salted scrypt password hash, an avatar URL, your demo balance, your inventory, and a log of every transaction, case opening, upgrade and battle you take part in. Session tokens live in a database row plus an httpOnly cookie so the site knows who you are between requests.

The game records are what make the economy auditable: your balance is the sum of your transactions, your inventory is a list of rows, and provably-fair history needs a seed pair per player. Nothing is kept beyond that purpose.

One cookie, named ti_session. It carries an opaque session token — no personal data — and expires after thirty days or when you log out.

Re-seeding the database removes every account and every trade record in one step. If you want a single account removed, that is a one-row delete; nothing is retained in backups because there are none.

This is a demonstration build. There is no support desk and no data controller to write to — treat any data here as disposable test data.