What we keep, and what we don’t

Last updated 4 October 2026 (Google Analytics disclosed; earlier: desktop app data sharing, 23 September 2026). Overshoot is built to hold as little about you as possible.

If you only use the lookup or the crosshair converter

• Lookups are not stored. We ask Steam for the public profile you searched and pass it straight back to you.
• We also ask Leetify for that Steam ID’s public Leetify profile (ranks and ratings, not stored), and FACEIT for the public FACEIT profile linked to that Steam ID (level, Elo, lifetime stats and FACEIT bans) and show it labelled as FACEIT’s. That is FACEIT’s data, not part of Overshoot’s aim evidence.
• When someone opens the Inventory tab on a player page, we read that Steam ID’s public CS2 inventory from Steam (the same list anyone sees on the Steam profile) and add prices from Skinport’s public price list. The inventory is not stored; the answer is cached for up to 10 minutes so Steam isn’t asked again on every view. Private inventories are never read.
• Your crosshair config never leaves your browser. If you paste a custom profile link, only that public name is sent to Steam to find the ID.
• No ads. We use Google Analytics 4 to see how the website is used: which pages are opened, roughly where visitors are, what device and browser they use, and how they arrived. Google sets cookies in your browser for this and receives that data, including the address of each page you open (a player page’s address may include the public profile’s Steam ID). We do not send Google your searches, your crosshair config, your email or your sign-in. Google’s own privacy policy applies. To opt out, use Google’s browser add-on at tools.google.com/dlpage/gaoptout or turn on your browser’s tracking protection.
• Separately, on our own server we count how many lookups and match-history connections happen each day: a number per day, with no name, Steam ID, search or IP address attached.
• Profile view counts: each player page shows how many times it has been opened. When you open a profile (not your own), your browser sends one anonymous “+1” for that profile, at most once a day. We store only the profile’s Steam ID and the date, never who opened it, your IP address or your browser details. Obvious bots are not counted.

If you sign in with Steam

• You sign in on Steam’s own site. We never see your Steam password.
• Steam tells us your public SteamID64. We keep it only inside a signed cookie in your browser, which keeps you signed in for 30 days. Signing out deletes it.
• Your account page shows your public Steam record, fetched live from Steam each time.
• We log each sign-in for our own counts: your public SteamID64, the dates you signed in, and how many times (website or app). No IP address, no browser details. Only the site owner can see it. Ask us to remove your record and we delete it.

If you add an email (optional)

• We store your email, your SteamID64 and the date you agreed, on our hosting provider (Netlify).
• We use it only for alerts about your matches and Overshoot updates. It is never shown to other players and never sold.
• Remove it any time on My account → Remove my email. That deletes the record completely.

If you track players (signed in with Steam)

• We store the list of players you track (their SteamID64, Steam name and avatar link), the last public Steam ban record we saw for each, and your alerts, under your SteamID64 on our hosting provider (Netlify). Up to 50 players and the last 50 alerts.
• Every hour we ask Steam for the public ban record (VAC and game bans) of the players you track. You get an alert only when a ban count goes up: in the bell at the top of the site, on My account, as a Windows notification in the desktop app (turn off in Settings) and by email if you added one.
• Lobby watch: for the players in your own latest matches (up to 20 matches, from your connected match history or the desktop app), we store their SteamID64 and in-game name under your account and check their public Steam ban record every hour the same way. You get an alert if one of them picks up a new ban.
• Other alerts you can turn on or off: a tracked player changing their Steam name, setting their profile to private, or showing up in new matches Overshoot collects. When a tracked player changes name we keep the earlier name (up to 10) and show it on their player page as “Also seen as”.
• Notifications on your devices (optional): if you turn them on, your browser gives us a push address for that device, which we store (up to 5 devices) to send alerts through your browser’s own push service (Google, Mozilla or Apple). Turn it off on My account and it is deleted.
• The players you track are not told and never see your list. Your list is never shown to anyone else.
• Remove players any time on My account. Remove my email there deletes your tracked list too.

If you leave your email in an update box or “Track this player”

• We store the email, where you signed up and the date you agreed, on our hosting provider (Netlify). No sign-in is needed.
• If you track a player, we also store that player’s Steam ID (up to 20 players) so we can email you when they appear in new matches Overshoot collects or pick up a public VAC or game ban. The player is not told and nothing about it is shown on the site.
• We use your email only for the updates you asked for: Overshoot news and features, weekly stats, and updates about players you track. It is never shown to anyone and never sold.
• Emails are sent through our email provider, Resend, which receives only your address and the email itself. Every email has a one-click Unsubscribe link that deletes your address completely.
• To remove it, enter it here. We delete it completely.

The Overshoot desktop app

• Your demo files never leave your PC. The app analyses them locally.
• Anonymised aim data is shared to improve detection. This is on by default, and you can turn it off in the app under Settings → Help improve detection. Turning it off stops sharing immediately and deletes anything not yet sent.
• What is shared, per analysed match: the movement numbers around each fight that our model reads (how the view and mouse moved, and when shots were fired, over about four seconds), plus the map, the game mode and the day. Players are labelled p0, p1… in a random order, and the match is identified only by a scrambled code, so copies from different players in the same lobby count once.
• What is never shared: names, Steam IDs, chat, the demo file itself, or anything about your PC.
• Other players in your matches appear in that data only in the same anonymised form. It is used only to train and test Overshoot’s detection models, is never shown on this site, and is never sold.
• Signing in from the app (optional). “Sign in with Steam” opens Steam’s own page in your browser; we never see your Steam password. Steam tells us only your SteamID. The app then keeps a sign-in key (valid 30 days) on your PC, encrypted with Windows’ own protection for your Windows account. It lets the app show your account, your matches and your email setting, exactly like this site. Sign out in the app deletes the key and cancels it on our side.

Kill rankings and match stats

Player pages (player lookup) also show match stats read from those same matches: K/D, rating, rounds won and lost, clutches, entry duels, damage, maps played and per-weapon kills, accuracy and hit locations, plus the crosshair code the player used. These are in-game results, never an Overshoot aim score. The Rankings page shows, for every player in the matches Overshoot collects, their Steam name, a link to their Overshoot player page and how many kills they got with each weapon. These are counts of in-game kills only, never an Overshoot aim score or a judgement about anyone. Since 26 September 2026 the rankings and player pages can appear in search engines such as Google (like other CS2 stats sites); a page's title and description show the player's Steam name and match stats, never ban details or scores. To be removed from the rankings (and from our data entirely), send your SteamID64 to Overshoot in the Discord server's #app-help channel; you're removed at the next update and not added again.

Some of these match stats come from the public archive of Renown (renown.gg), a CS2 matchmaking platform that closed in January 2026 and left its match API open to the public. For those matches we copy the scoreboard only: SteamID, the nickname used on Renown, kills, deaths, assists, headshots, damage, opening duels, 4K and 5K rounds, map, score and date. No demos, no aim data and nothing else about the player. Renown’s own platform bans are kept on our machine to check our research methods and are never shown on the site. The same removal route applies.

Downloading the desktop app

The download needs Steam sign-in. We record your Steam ID, the day and your browser type once per day you download, to count downloads and to know who has the app. That record is kept while you have an account with us; ask to have it removed the same way as below.

Match links you paste

Anyone can add one match by pasting its CS2 match link (share code) on the home page or the Track my matches page. A match link only identifies a match; it holds no account data. We keep it until our match fetcher has asked Valve for that match’s demo, then delete it. The demo is handled exactly like a connected match below: match stats for all 10 players go into the rankings and player pages, anonymised aim data is used for detection, and the demo is deleted.

Connected match histories and the players in those matches

Players can connect their CS2 match history to Overshoot with Steam’s match-history authentication code, on the Track my matches page (no sign-in needed: only the account owner can get this code from Steam, and Steam confirms it before we save it) or on the download page. The code is stored encrypted and is only used by our match fetcher; Disconnect on the download page deletes it, and revoking the code on Steam stops all fetching at once. That code only lets us list their matches; it can’t sign in, trade or change anything, and it can be revoked on Steam’s “Access to Your Match History” page at any time. For each connected match we download the demo from Valve, cut it into the same anonymised aim data described above, and delete the demo.

• To learn which fights came from players who were later banned, we keep the Steam IDs of the players in those matches privately, for at most 187 days, and use them only to ask Steam’s public ban API whether they were banned afterwards (at about 30, 90 and 180 days).
• As soon as a player’s result is known, their Steam ID is erased and only “banned after N days” or “not banned” stays with the anonymous data. (Separately, their public kill counts appear on the Rankings.) Ban results are never published, shown on a profile or used in the rankings.
• To have your Steam ID removed, send your SteamID64 to Overshoot in the Discord server's #app-help channel. It is erased at the next pipeline run, your fights from connected matches are dropped from training, and matches you play later are skipped.

Match evidence

Aim measurements from analysed matches are not published on this site. When they are added, they will be visible only to players who were in that match, and never as a public ranking or a verdict.

News videos

The News page shows video thumbnails from YouTube’s image server. A video only loads from YouTube (in its privacy-enhanced youtube-nocookie.com mode) after you press play, and from then on YouTube’s own privacy policy applies to that video.

The Overshoot Discord bot

In the Overshoot Discord server, /check sends the profile you type to this site’s public lookup (the same one as the homepage) and shows the result only to you. The bot keeps no record of what you checked. It remembers which roles you picked only through Discord itself, and it never sees your messages. Discord’s own privacy policy applies to the server.

Cookies

• overshoot_session: keeps you signed in (signed, HttpOnly, 30 days).
• os_in: tells the page to show “My account” instead of “Sign in”. Holds no personal data.
• _ga and _ga_*: set by Google Analytics so it can tell separate visits apart. They hold a random ID, not your name or Steam ID.

Overshoot is not affiliated with Valve Corporation.