Unbox.tf Privacy Policy

Last updated: 2026-01-10

1. Introduction

We operate the Unbox.tf API and related services. This Privacy Policy explains what data we collect, why we collect it, and the choices you have. By using our services you agree to the practices described below.

2. Data We Collect

We only collect information required to operate the platform and the in-game item ecosystem. The data categories mirror the production database tables listed below:

• Users: user_id, username, password (hashed), api_key (hashed), first_unbox, last_unbox, linked_discord_id, and profile_picture.
• Items: item metadata such as schema_id, quality_id, grade_id, effect_id, trait flags (is_strange, is_collector, is_tradable, is_haunted, is_gift), unboxer_id, current_owner_id, descriptive fields (description, user_description), and lifecycle flags (is_scrapped, is_deleted).
• Crates: crate_id, crate_reference_id, is_tradable, is_deleted, current_owner_id, original_issue_user, and unbox_time.
• Trades: trade state, timestamps (date_sent, date_completed), origin/target user IDs, item/crate payloads (trade_send_items, trade_send_crates, trade_receive_items, trade_receive_crates), and messages (send_message, reject_message).
• Realistic Items: mapping between Unbox.tf item IDs and TF2 identifiers (unboxtf_item_id, tf2_unique_id), plus claim status and the claimant's trade URL (claimed, claimer_trade_url).
• Bans: ban_id, user_id, ban_type, unban_date, and ban_reason.
• Market: listings and transactions with item_id, crate_id, seller_id, buyer_id, price, sold, and completed.
• Notifications: notification_id, user_id, notification_text, target_url, and dismissed.
• Promo Codes: promo_code_id, promo_code_crate_reference_id, promo_code_max_uses, and promo_code_expiration.
• Promo Code Redemptions: redemption_id, user_id, and promo_code_id.
• Reports: moderation reports with report_id, suspect_id, reporter_id, report_text, and report_closed.
• Support Tickets: ticket_id, ticket_author_user_id, ticket_responding_support_user_id, ticket_close_date, and ticket_transcript.

3. How We Use Data

• Authenticate users, enforce access controls, and protect the service from abuse.
• Generate item previews, inventories, and market listings to fulfill API requests.
• Detect fraud, enforce bans, and ensure compliance with platform rules.
• Provide customer support, investigate reports, and resolve trade disputes.
• Deliver notifications, support tickets, and promo code redemptions.

4. Sharing & Disclosure

We do not sell personal data. We only share information:

• With infrastructure vendors (e.g., hosting providers) under contract and solely to operate the service.
• When compelled by law or to protect our rights, users, or the public.

5. Data Retention & Security

• Account data persists while the account remains active. Trade, item, and market history are kept for auditability.
• We store secrets (password hashes, API keys) securely and restrict access to the production database.
• Profile pictures and other blobs reside in the users table as binary data, protected by the same safeguards as other account information.

6. Your Choices

• You may request deletion of your account, which removes identifying information from the users table and anonymizes related records where feasible.
• You can revoke API keys, update linked Discord IDs, or replace profile images at any time through provided interfaces.

7. Contact

For privacy questions or requests, email [email protected]. Please include your user ID or username so we can identify records accurately.