CSS Taiwan

ZOLA TECHNOLOGY · CSS TAIWAN

Privacy Policy

This policy explains how Zola Technology collects, processes, uses, discloses, retains and deletes data while operating CSS Taiwan, including the website, Google and Steam linking, the game server, SourceTV and demos, moderation, Telegram, uploads and the player VPN.

Ordinary demos are normally retained for 7 days. After the super administrator confirms cheating, the selected evidence and related case demos are protected for 365 days from confirmation and exempt from ordinary age and capacity pruning.

Effective date
Operator
Zola Technology

1. Scope, purposes and legal grounds

Zola Technology is the controller and operator. We process data to provide and secure the website, accounts, CS:S game server, SourceTV/demos, community moderation, appeals, downloads and VPN; verify identity and eligibility; measure use; prevent cheating, abuse and attacks; perform our agreement; resolve disputes; and meet legal duties. Grounds include our contract or similar relationship with you, consent, legitimate security and operational interests, and circumstances permitted or required by law. Processing is primarily in Taiwan, but Google, Valve/Steam, Telegram, Cloudflare and demo viewers may be overseas.

2. Website and device data

  • Requests may contain IP address, time, URL, browser/User-Agent, referrer and security events. Our reverse proxy, Cloudflare and server logs use them for delivery, troubleshooting, rate limits and defence.
  • A random one-year css_vid cookie supports visit counts. Minute-scoped hashes deduplicate visits; raw IP addresses are not written to visit statistics. Rate limits and location caches use temporary or hashed keys.
  • css_locale and css_theme last one year. OAuth state/PKCE cookies last about ten minutes; the signed login cookie lasts about eight hours. Secure, SameSite and, where sensitive, HttpOnly protections apply.
  • We currently use no third-party advertising or browser analytics JavaScript. Infrastructure and security logs rotate and are retained only as reasonably needed for operations, investigations and law.

3. Google, Steam and profiles

Google sign-in requests openid email profile and returns a Google subject, verified email and name. The access token is used transiently and is not saved in the user profile. We retain email, an editable personal name, timestamps and avatar status. An uploaded avatar is converted to WebP up to 300×300 and is visible only to that signed-in user.

Steam OpenID supplies a 17-digit SteamID64. We may fetch the public Steam profile name and retain SteamID64, Steam2 ID, name and sync time. One Steam ID cannot be linked to two Google profiles. Unlinking removes the account association, not independent game records, demos, reports, bans, appeals or audit evidence.

4. Game, location, SourceTV and demos

The Source engine and plugins process player name, Steam ID, temporary IP, connection times, team, map, chat, voice, radio, kills, deaths, headshots, playtime, sessions and moderation events. Raw IP is held briefly in memory to resolve country/city, then removed after resolution or disconnect. Durable player records keep country, city and a hashed public CSS ID, not raw IP. Public pages may show game name, CSS ID, city, activity dates, playtime, sessions, name history and statistics. Player names and CSS IDs first link to a local public data card that visitors may download as a PNG; the card may separately link to the official numeric Steam profile URL deterministically derived from SteamID64. Administrators can also see Steam ID.

SourceTV may broadcast publicly. Each map is automatically recorded as a demo, which may contain names, gameplay, chat, voice and camera activity. Completed, validated files are publicly downloadable, normally for seven days; capacity, safety or evidence preservation may cause earlier removal or longer restricted retention. Do not disclose unnecessary sensitive information in game chat or voice.

5. Reports, confirmed cheating and appeals

A report stores case number, time, map, reason, reporter and subject names, Steam IDs/public CSS IDs, general location, related demos, status, administrator and outcome. A pending report is not a cheating finding and is not automatically published as one.

Only after the super administrator reviews demo evidence, confirms cheating and successfully applies the game ban may the confirmed-cheating record and Telegram notices disclose the game name, full Steam ID, cheating/confirmation times, ban length, country/city, case number and demo link. Raw IP is not published. The disclosure provides a verifiable server-safety record and is not a criminal conviction. General report notices use the public CSS ID; private administrator notices may contain full Steam IDs.

A banned player must sign in with Google and link the same Steam ID to view details, submit a free appeal/evidence URL, and message the super administrator. We retain Google subject, email, Steam ID, messages, administrative notes and the final ruling. An accepted and completed unban marks the case exonerated and removes it from the public cheating list; restricted case and audit records may remain for evidence integrity, disputes and law.

6. VPN, uploads and recipients

The optional IKEv2 VPN stores a Google-derived username, server-side verification password, active state, daily allowance, timestamps, connection state/date and bytes used. The password is shown to you only on creation or reset. Revocation removes active credentials but may retain account history for security and accounting. Full-tunnel traffic exits through our server. The application meters volume and does not routinely inspect content, but connection metadata may be processed where necessary for law, security or operations.

Avatars, knife sounds, sprays, maps and appeal evidence URLs may include the file/link, original name, size/duration, submitter Google/Steam identifiers, review status and timestamps. Approved sounds, maps or sprays are distributed to game clients or FastDL; rejection or revocation does not promise immediate deletion of an audit copy.

Necessary data may be received by authorised Zola Technology administrators, Google, Valve/Steam, Telegram Bot API and relevant chats, Cloudflare, Zola-operated IP/geocoding services, VPN/hosting infrastructure, players in the same game, SourceTV viewers and demo downloaders. Those external services also apply their own policies.

7. Retention, security and your rights

Demos normally last seven days; the public moderation feed keeps the latest 25 entries and the administration audit the latest 100. Reports and appeals each have a 500-record capacity limit. Accounts, player history, bans, appeals, VPN and evidence remain while reasonably necessary for service, safety, disputes or law; a capacity limit is not a promised deletion date.

Safeguards include TLS, reverse proxying, signed/HttpOnly cookies, PKCE, CSRF/origin checks, rate limits, file validation, separated permissions and minimising durable raw-IP storage. No network service can guarantee absolute security.

You may request access, a copy, correction or supplementation, cessation of collection/processing/use, or deletion. We generally answer access/copy requests within 15 days and other requests within 30 days, subject to lawful extensions. We may verify identity and limit a request where required to protect others, preserve cheating evidence, resolve disputes or comply with law.

8. Choices, children and changes

Without Google data you may still read public pages, but cannot use accounts, VPN, appeals or uploads. Without Steam linking, identity-bound player features are unavailable. Without game connection data, the server cannot be used. Avatars, sounds and supplemental evidence are optional. Users below the age of consent under their local law need guardian permission.

Updates will show a new effective date and material changes will receive reasonable notice. If translations differ, the Traditional Chinese version controls. The laws of the Republic of China (Taiwan) apply.