How tournament data is handled

Last updated July 27, 2026.

Data collected

Steam sign-in supplies your numeric Steam ID, display name, avatar, and public profile URL. MatchFound stores tournament registration, team membership, organizer-assigned rank, check-in, bracket entry, match result, normalized game events, and audit history needed to run the event.

Opaque session hashes, security nonces, request IP information used for abuse limits, request and trace IDs, and redacted operational logs are processed to secure and operate the service. Live match address and password are shown only to that match’s competitors and organizer and are removed after completion or cancellation.

Purpose and sharing

Data is used to authenticate competitors, seed and operate tournaments, assign private CS2 servers, publish brackets and results, prevent abuse, investigate incidents, and recover the service. Public tournament pages show the Steam persona name, avatar, assigned rank, team, bracket, and results needed to identify competitors. Numeric Steam IDs, Steam profile URLs, account timestamps, and server-side bracket membership arrays are retained on the server and are not included in browser tournament or session responses. MatchFound does not sell personal data. Steam receives the OpenID request; infrastructure, database, backup, monitoring, and streaming providers process only the data required for their service.

Retention and deletion

Browser sessions expire after 14 days and can be revoked immediately. Match and audit history may be retained for tournament integrity and incident response. Encrypted backups follow the operator’s configured retention schedule. Streams are not enabled by this build.

A signed-in player can use Delete my account on the tournament home page. Deletion is refused while the account owns or participates in a registration, running, or paused tournament, or owns a game host whose access has not been revoked. The player must leave, cancel, or finish active events and revoke every owned game host first. Revoked host records may remain where tournament or match history references them, but their runner credentials no longer authorize access. A successful deletion revokes every session, removes the Steam ID, name, avatar, and profile link, and replaces player-facing completed bracket history with “Deleted player.” Stable pseudonymous record IDs, ranks, results, and audit history remain where needed for tournament integrity, security, disputes, or law. The deletion request and its outcome are recorded in the security audit trail.

Encrypted backups age out under the operator’s configured retention schedule and are not selectively rewritten. Before public launch, the deployment operator must publish its legal identity, contact address, jurisdiction-specific retention periods, verified support channel, and process for access, export, correction, appeal, or deletion of data outside the self-service workflow.

Your choices

You may decline Steam sign-in and not enter a tournament. Use the signed-in deletion control for profile deletion, or ask the deployment operator for access, correction, export, appeal, or deletion of other records. Organizers can correct scores through the audited workflow; they cannot retrieve session, runner, RCON, or backup secrets.

Security

The production design uses HTTPS, server-side revocable sessions, CSRF protection, least-privilege authorization, a private database, encrypted backups, an outbound-only game runner, short-lived match credentials, audit events, and monitoring. No system can guarantee absolute security.