Privacy policy

Some things are worth stating first, because they are the ones people are actually worried about:

• Your Steam password. Sign-in happens on Steam’s own site through OpenID; Emerald only ever receives your SteamID back.
• Your Steam Guard code or mobile authenticator.
• Your full card number or CVV. Card details go straight to our payment provider, and Emerald stores only their opaque reference plus the brand and last four digits for display.
• Your session token. Only a SHA-256 hash of it is stored, so a copy of our database cannot be used to sign in as you.
• Your password in readable form. Passwords are stored as scrypt hashes.

• Account details: your email, username, display name, and when the account was created.
• Steam link: your SteamID, persona name, profile URL, avatar URL and trade URL.
• Commerce records: your orders, listings, trades, payments and balance ledger.
• Session records: the IP address and browser user agent for each sign-in, so you can review and revoke your own sessions.
• Audit records: a log of security-relevant actions on your account, such as password changes and trade URL updates.

Account and Steam data exist so Emerald can identify you and deliver items to the right inventory. Commerce records exist because a marketplace handling money must be able to reconstruct exactly what happened to any order — for you, for support, and for the auditors any payment provider will eventually send.

Session and audit records exist for your security. They are the reason you can see every device signed in to your account and end any of them from your settings.

Emerald shares the minimum necessary with the services that make it work: a payment provider processes payments, and a trading service moves items through Steam. Emerald does not sell personal data, and does not share it for advertising.

Financial records are kept for as long as accounting and anti-fraud obligations require, which is typically several years and is not something an account deletion can override. Session records are pruned shortly after they expire.

You can view and correct your profile in your account settings. For a copy of your data, or to ask for it to be deleted, email support@emerald.example. Deletion requests are honoured except where a record must be retained for legal or anti-fraud reasons, and you will be told which records those are.

Emerald sets one cookie: your session. It is httpOnly, SameSite=Lax, and secure in production. There are no advertising or analytics cookies, which is also why there is no consent banner to dismiss.