Unbox.tf Privacy Policy
1. Introduction
We operate the Unbox.tf API and related services. This Privacy Policy explains what data we collect, why we collect it, and the choices you have. By using our services you agree to the practices described below.
2. Data We Collect
We only collect information required to operate the platform and the in-game item ecosystem. The data categories mirror the production database tables listed below:
- Users:
user_id,username,password(hashed),api_key(hashed),first_unbox,last_unbox,linked_discord_id, andprofile_picture. - Items: item metadata such as
schema_id,quality_id,grade_id,effect_id, trait flags (is_strange,is_collector,is_tradable,is_haunted,is_gift),unboxer_id,current_owner_id, descriptive fields (description,user_description), and lifecycle flags (is_scrapped,is_deleted). - Crates:
crate_id,crate_reference_id,is_tradable,is_deleted,current_owner_id,original_issue_user, andunbox_time. - Trades: trade state, timestamps (
date_sent,date_completed), origin/target user IDs, item/crate payloads (trade_send_items,trade_send_crates,trade_receive_items,trade_receive_crates), and messages (send_message,reject_message). - Realistic Items: mapping between Unbox.tf item IDs and TF2 identifiers (
unboxtf_item_id,tf2_unique_id), plus claim status and the claimant's trade URL (claimed,claimer_trade_url). - Bans:
ban_id,user_id,ban_type,unban_date, andban_reason. - Market: listings and transactions with
item_id,crate_id,seller_id,buyer_id,price,sold, andcompleted. - Notifications:
notification_id,user_id,notification_text,target_url, anddismissed. - Promo Codes:
promo_code_id,promo_code_crate_reference_id,promo_code_max_uses, andpromo_code_expiration. - Promo Code Redemptions:
redemption_id,user_id, andpromo_code_id. - Reports: moderation reports with
report_id,suspect_id,reporter_id,report_text, andreport_closed. - Support Tickets:
ticket_id,ticket_author_user_id,ticket_responding_support_user_id,ticket_close_date, andticket_transcript.
3. How We Use Data
- Authenticate users, enforce access controls, and protect the service from abuse.
- Generate item previews, inventories, and market listings to fulfill API requests.
- Detect fraud, enforce bans, and ensure compliance with platform rules.
- Provide customer support, investigate reports, and resolve trade disputes.
- Deliver notifications, support tickets, and promo code redemptions.
4. Sharing & Disclosure
We do not sell personal data. We only share information:
- With infrastructure vendors (e.g., hosting providers) under contract and solely to operate the service.
- When compelled by law or to protect our rights, users, or the public.
5. Data Retention & Security
- Account data persists while the account remains active. Trade, item, and market history are kept for auditability.
- We store secrets (password hashes, API keys) securely and restrict access to the production database.
- Profile pictures and other blobs reside in the
userstable as binary data, protected by the same safeguards as other account information.
6. Your Choices
- You may request deletion of your account, which removes identifying information from the
userstable and anonymizes related records where feasible. - You can revoke API keys, update linked Discord IDs, or replace profile images at any time through provided interfaces.
7. Contact
For privacy questions or requests, email [email protected]. Please include your user ID or username so we can identify records accurately.