Privacy Policy

cs2pickside.com is an independently run service, operated by the owner of this website, who decides what personal data is collected here and why — the "controller", in the language of the GDPR.

For anything in this policy — a question, a correction, a copy of your data, a deletion — write to [email protected]. It reaches a person, and the answer comes from the same address.

This policy covers the site and every subdomain of it. It forms part of our Terms of Service.

Reading the site asks nothing of you: no account, no name, no form to fill in. What the servers note by themselves is the last group below, and that group applies to everyone; everything before it applies once you create an account, subscribe, write to us, or take the newsletter.

Your account:

• your email address, and a second one while a change of address is waiting to be confirmed;
• your password as an argon2id hash — never the password itself, which we cannot read or recover;
• the language you use the site in, so an email arrives in it;
• when you accepted the terms, which version you accepted, and in which language edition it was shown to you — the record that answers a payment dispute;
• when the account was created, when it last signed in, whether the email is confirmed, and the country the sign-up came from, derived from the connection and stored as a country code only;
• counters that lock an account after repeated failed sign-ins, so a password cannot be guessed at leisure.

Your sessions and the record of use:

• one row per signed-in session: a hash of the session token (never the token), the IP address and browser it was created from, and when it was last used;
• one row per day the account was used, with the address it was used from. This is kept as evidence: we defend chargebacks ourselves, and "the service was used on these days" is what a bank asks for. It is deleted after 400 days;
• security events — failed sign-ins, lockouts, refused registrations — kept for 365 days so a pattern of abuse can be seen and explained.

Your subscription:

• what our payment provider tells us: the subscription and payment identifiers, its status, the dates, the amounts, and the country of the payment method;
• your card details are handled by the provider and its processors and never reach us — we could not show them to you if you asked.

What you send us:

• emails to support, their attachments, and our replies, kept with the thread so a later question has its history;
• a newsletter subscription: the address, its language and its confirmation state, until you unsubscribe;
• notes an operator writes about an account while handling a request.

What the servers record on their own:

• application logs and traces for requests, including the IP address and what was asked for, kept for a short operational window and used to run and debug the service;
• one row each time somebody arrives here from somewhere else: the site or search that sent you, as its domain and never the full address you came from; the page you landed on; any campaign tags carried in the link; the country the connection is placed in; and your address as a hash rather than the address itself. It is kept for 90 days;
• a log of the emails we sent you and what happened to them, so a "you never told me" can be answered;
• page analytics — see the section on cookies and analytics below.

That hash is what keeps an arrival countable without keeping it identifiable. It is made from your address together with a random value that lives for one day and is then thrown away, so the same address gives a different hash tomorrow and, once that value is gone, no hash can be turned back into an address. If you create an account, that day’s hash is written beside the sign-up as well — the one thread that ever ties an arrival to a person, and it goes when the account does.

Where the GDPR or a comparable law applies to you, we rely on:

• performance of our contract with you — the account, the subscription, the emails a subscription has to send;
• our legitimate interests — keeping the service secure, stopping abuse of free trials and country restrictions, defending a payment dispute, and knowing how people find the site and which pages they use, counted without being identified;
• a legal obligation — records of payments and of the acceptance of the terms, which tax law and the time limits on a dispute require us to keep;
• your consent — the newsletter, which you confirm by clicking a link, and which you can withdraw in one click from any issue.

Where we rely on a legitimate interest, you may object: write to us and say so, and we will either stop or explain why the interest overrides in your case.

The site sets no advertising cookies, embeds no advertising tags, and does not follow you across other sites. One cookie measures how the site is used, and it is not ours: in the EEA and the UK, and anywhere we cannot tell where you are, it is set only after you accept it; elsewhere it is set by default. You can change that answer whenever you like — the Cookies control in the footer reopens the question, and refusing removes what was already stored.

What is stored on your device:

• `cs2p_session` — the signed-in session, readable only by the server;
• `cs2p_link_token` — the one-time credential from a password-reset or confirmation email, taken out of the address bar so that nothing which records addresses records it too. Readable only by the server, and it expires fifteen minutes after the link is opened;
• `cs2p_auth`, `cs2p_access`, `cs2p_trial_used` — flags the interface reads to decide what to show before the server answers (signed in, access open, trial already used). They carry no identifier;
• `cs2p_locale` — the language you chose, kept for a year. It is written only when you pick one; simply landing on a page does not count as choosing;
• `cs2p_lang`, `cs2p_lang_off` — the language your browser and your approximate country suggest, and whether you have dismissed the offer to switch. The first is worked out on each request and holds a language code, not a location;
• `cs2p_install_off` — whether you waved away the offer to install the site as an app. It holds that one answer and nothing else;
• `cs2p_gdpr`, `cs2p_consent` — whether you are somewhere we have to ask about cookies, and the answer you gave;
• `cs2p_consent_id` — the reference the answer was filed under, so that changing your mind is recorded against the same answer rather than as an unrelated one. Set only if you were asked;
• `_ga` and one `_ga_` cookie per property — Google Analytics, which counts visits and where they came from. Present only where the answer above allows it;
• `cs2p_nav_depth` — not a cookie but a number in your browser’s per-tab storage, which is how the back button knows whether there is anywhere to go back to. It carries no identifier, is never sent to us, and is gone when the tab closes;
• `pwa-install-dismissed` — the same answer as the install cookie above, kept in your browser’s own storage so that the offer stays away for good. It is never sent to us;
• `cs2:chunk-reload-at` — the moment a page last reloaded itself to pick up a version we had just published, kept per tab so that one reload cannot become a loop. It is never sent to us, and it goes when the tab closes.

Our own analytics remain self-hosted and cookieless: no identifier is written to your device, and the script and the collector are served from our own domain, so that measurement never leaves it. What is counted is pages, events and arrivals — and an arrival is counted through the daily hash above, which tells two visits apart on the same day without telling us whose they are.

The second measurement is Google Analytics, and that one is not ours. The tag and everything it sends travel through this site rather than to Google directly, which is what keeps it working for a reader whose browser blocks Google’s own addresses. That changes who your browser talks to and not what Google learns: what it collects — the pages opened, the search or site you arrived from, the country and the kind of device — still reaches Google, and so does your address, which we pass on so that the country stays right. It tells us how a visit unfolds and how our traffic looks against everything else Google sees, which our own counting does not. It is not used to advertise to you, and we do not link it to your account.

When you answer that question we keep a record of the answer, because a consent we cannot produce later is one we cannot rely on. The record holds the moment, what you chose, the wording you were shown, the language you read it in, the address the answer came from and the country it resolved to, the browser you used, and your account if you happened to be signed in. A refusal is recorded exactly as an acceptance is — the question we are most likely to have to answer is whether we stopped when you asked us to.

That record is kept for three years and used for nothing else. It is not analytics, it is not linked to anything you read, and it is deleted automatically once it is older than any dispute about it could be.

If we ever add an advertising tag, we will ask before it runs, and this policy will say so before it happens.

We do not sell personal data, and we do not share it for anyone else’s marketing. The services below process it on our instructions so that the site can work:

• Whop — payments and subscriptions, as merchant of record. It holds the payment details we never see, and tells us the state of your subscription.
• Resend — sending our email and receiving what you send to support.
• Cloudflare — the network in front of the site: the tunnel that carries requests, the anti-bot challenge on the sign-in and sign-up forms, and a page-performance measurement. It processes connection data such as your IP address in doing so.
• Hetzner — the servers themselves, in Germany, where the database and the backups live.
• Google — the analytics that tell us where visitors come from, described in the section on cookies. It receives nothing where consent has not been given.

Our forecasts are produced with the help of a language model, and no personal data is sent to it: the questions it is asked are about matches, teams and tournaments.

We disclose personal data outside that list only where the law requires it, or where it is necessary to establish or defend a legal claim — a chargeback is the everyday example, and the Terms of Service say exactly what a bank is shown.

The database and its backups are in Germany. Backups are encrypted, and a copy is held offsite with a storage provider, also encrypted.

Some of the services above are based outside the EU. Where personal data reaches them it travels on the transfer terms their own agreements provide — the European Commission’s standard contractual clauses in the usual case, and for Google its certification under the EU-US Data Privacy Framework, which the Commission has found to provide adequate protection.

We keep each thing for as long as the reason for having it lasts:

• the account and its email address: until you ask us to erase it;
• sessions: until they expire, and then they are swept away;
• the record of days an account was used: 400 days;
• security events: 365 days;
• the record of arrivals on the site: 90 days;
• payments, and the record that the terms were accepted: for as long as tax law and the time limit on a payment dispute require, which outlasts the account itself;
• support threads: while they are useful to answer a later question;
• the newsletter: until you unsubscribe;
• server logs and traces: a short operational window, measured in days.

You can ask us to show you what we hold, correct it, give you a copy you can take elsewhere, delete it, restrict what we do with it, or object to a use we base on a legitimate interest. Where we rely on consent, you can withdraw it at any time without affecting what was done before.

Write to [email protected] from the address on the account. We answer within one month, which is the period the GDPR allows, and usually much sooner. We do not charge for this.

Erasure means the identifying details are overwritten and the account can no longer be signed in to. An arrival carrying the same hash as your sign-up is erased with it, and a copy of your data includes that arrival — it is the only one we can show is yours. Erasure does not remove the records we are required to keep — the payments and the acceptance of the terms — which stay under the legal obligation above, detached from a name.

If you think we have handled your data badly, tell us first — we would rather fix it. You also have the right to complain to the data protection authority of the country you live in.

Passwords are stored as argon2id hashes. Session tokens are random and stored only as hashes, so a copy of the database does not let anyone sign in as you. Every connection is HTTPS, and the site declares strict transport security and a content security policy.

Sign-in and registration are rate-limited and protected by an anti-bot challenge, an account locks itself after repeated failed attempts, and the admin console is reachable only to accounts holding that role.

Backups run daily, are encrypted, and are restore-tested on a schedule — a backup nobody has restored is a hope, not a backup.

No system is perfect. If a breach ever affects your data and the law requires it, we will tell you and the authority within the time the law allows.

The site is for adults: you must be at least 18 to hold an account, and we do not knowingly collect data from anyone younger. If we find that an account belongs to someone under 18 we close it and delete what we hold, refunding the most recent payment.

We may change this policy — because the service changes, or the law does. The version in force and the date it took effect are printed at the top of this page.

A change that materially affects how we use data we already hold is announced by email to the address on your account before it takes effect, so that a change of use never arrives unannounced.

Questions about any of it: [email protected].