Privacy

This page lists exactly what the site stores, where, and who processes it. It is written to meet the Steam Web API Terms of Use and the GDPR.

Who runs the site

[controller name and contact address: set PRIVACY_CONTACT before launch]

What is stored when you only paste an id

Nothing about you. The account id you paste is public match data; the site fetches the match from OpenDota, keeps the match blob, a replay snapshot (positions, HP and visibility of all ten heroes), the computed metrics and the detected moments, and remembers the job so the page can poll it. Any re-decide answer you type is stored against that match and account id. Lawful basis: legitimate interest in reviewing public match data.

What is stored when you sign in through Steam

• Your 64-bit SteamID and the 32-bit Dota account id derived from it.
• Your Steam persona name and avatar URL, as returned by GetPlayerSummaries at each login.
• Whether your account exposes public match data, as returned by one GetMatchHistory call at each login or when you ask for a re-check, and when it was last checked.
• Your language choice.
• The time you claimed the account and the time you accepted this notice by signing in. Marketing consent is a separate switch that does not exist yet; Steam data is never used for unsolicited marketing.
• A session cookie (HttpOnly, SameSite=Lax, Secure in production) that keeps you logged in for up to 180 days, a CSRF cookie and a language cookie. No analytics or advertising cookies.

Steam never gives this site your password or email. Lawful basis: the contract you enter by claiming the account.

What is stored when you add Google as a backup login

Google's subject id for your account and the email address Google reports, used only to log you back in and to show you on the settings page which Google account is linked. The address is not used to send you anything. Google can never claim a Dota account.

Where it is stored

All of the above, including Steam Data, is stored in United States.

Who processes it

• Hosting: the server that runs the site and holds the database (provider named with the storage country above).
• Object storage: replay snapshots and match blobs may be kept in an object store of the same hosting provider or a storage provider named here before launch.
• OpenDota: match data is requested from OpenDota by match id; your account id is sent to it when listing your matches.
• Valve (Steam Web API): the OpenID login, GetPlayerSummaries and GetMatchHistory calls described above.
• Anthropic: the facts of a moment (hero names, times, positions, numbers; never your SteamID, name or email) are sent to the Claude API to write the explanation.
• Payment provider: none yet. When paid plans launch, an email address will be collected at checkout for receipts and account notices only, and the provider will be named here.

How long, and how to delete

Account data is kept while the account exists. Settings → Delete my account removes your login, Steam and Google links, persona name, avatar, jobs and re-decide answers at once. Reviews of public match data (metrics and moments by match and account id) are kept, as they would be for any public account looked up without a login; write to the contact above to have them removed as well. Match blobs and replay snapshots are regenerable caches and may be pruned at any time.

Your rights

You can see everything stored about you on the settings page and this page, change your language, remove the Google link, and delete the account yourself. For access, correction or erasure requests beyond that, write to the contact above.

Dota 2 and the Dota 2 logo are trademarks of Valve Corporation. This site is not affiliated with or endorsed by Valve. Steam data is used under the Steam Web API Terms of Use.