Privacy policy

Version 1.8 · Last updated 3 November 2026 · Applies to subtick.gg and testing.subtick.gg

Who runs Subtick

Subtick is run by Subtick I/S, a company owned by Asger Spange and Laust Maarbjerg. Subtick I/S is the data controller for the personal data described here.

Company: Subtick I/S, CVR 46889525
Address: Duftrankevej 15, 1. tv., 5200 Odense V, Denmark
Privacy and requests: hello@subtick.gg
Reports and abuse: abuse@subtick.gg

We have not appointed a data protection officer, because the law does not require one for a service of our size. Write to hello@subtick.gg with any question about your data.

The short version

You sign in with Steam. We get your Steam ID, name and avatar, never your Steam password.
Your team's plays, demos and voice recordings are visible to your team and to teams you share them with.
Only players who linked their TeamSpeak to Subtick are recorded.
Full statistics run in your browser only if you accept them. Without that we only count page views, without cookies and without knowing who you are.
We do not sell personal data and we do not show ads.
Write to hello@subtick.gg to see, correct or delete your data.

What we collect and why

For each kind of data: what it is, why we need it, the legal basis under the GDPR, and who can see it.

Your account

What: Your Steam ID, Steam name and avatar, which Steam sends when you sign in. What you add to your profile: handle, bio and roles. Your language and when you joined. If you connect FACEIT, your FACEIT ID and nickname. If you turn on matchmaking import or Steam messages, see below.
Why: To create your account and sign you in.
Legal basis: Contract (art. 6(1)(b)). You need a Steam account to create a Subtick account.
Who sees it: Your name, avatar and profile are visible to signed-in users you share a team, server or leaderboard with.

Teams and what you make

What: Team name, tag and logo. Members and their roles. Invite codes. Plays, playbooks, drawings and notes. Calendar events and who answered. A Discord webhook, if your team adds one.
Why: This is the service you signed up for.
Legal basis: Contract (art. 6(1)(b)).
Who sees it: Members of the team, and teams you share with.

Demos you upload

What: The demo file and the statistics we calculate from it. A demo holds the Steam IDs, in-game names, positions and actions of everyone in the match, including opponents who do not use Subtick.
Why: So your team can review its matches.
Legal basis: Contract for you. For the other players in the demo: legitimate interests (art. 6(1)(f)), namely a team's interest in reviewing matches it played. Their data is only shown to teams that have the demo.
Who sees it: Your team, and teams the demo is shared with.

FACEIT matches

What: If you connect FACEIT, we fetch your CS2 match history from the last 30 days from FACEIT and download the demos of those matches. If you use the Subtick browser extension on a FACEIT match page, it asks FACEIT for that match's demo link with your own FACEIT login, in your browser, and sends only the match ID and that link to Subtick; your FACEIT login stays in your browser. Like any demo, these hold the Steam IDs, in-game names, positions and actions of everyone in the match.
Why: So you can review your FACEIT matches without uploading them yourself.
Legal basis: Contract for you, since you choose to connect FACEIT. For the other players in the demo: legitimate interests (art. 6(1)(f)), namely your interest in reviewing matches you played.
Who sees it: Only you. The demos go into a private Faceit folder. If you share one with a team, that copy becomes a team demo like any other.

Matchmaking demos

What: If you turn on matchmaking import, your CS2 authentication code (stored encrypted) and your latest match share code. With them we ask Valve for your new match share codes and, through the Subtick Steam account, for each match's demo, which we then download. Like any demo, these hold the Steam IDs, in-game names, positions and actions of everyone in the match.
Why: So you can review your Premier and Competitive matches without uploading them yourself.
Legal basis: Contract for you, since you choose to turn it on. For the other players in the demo: legitimate interests (art. 6(1)(f)), namely your interest in reviewing matches you played.
Who sees it: Only you. The demos go into a private Matchmaking folder. If you share one with a team, that copy becomes a team demo like any other.

Steam messages

What: If you turn on Steam messages, the Subtick Steam account sends you a friend request (or asks you to add it, when Steam won't let it send one) and then a message when your game server is up, with the address to join, or when a matchmaking demo is ready. Steam only delivers messages between friends, so nothing arrives until you are friends.
Legal basis: Consent (art. 6(1)(a)). Turn it off in your settings or remove the bot as a friend at any time.

Google Calendar

What: If you connect Google Calendar, we keep the access tokens Google gives us, stored encrypted. We make one "Subtick · team name" calendar per team in your Google account and copy your teams' calendar events into it: the type, title, opponent, note, start and end time, and a link to Subtick. When an event is added, changed or removed in Subtick, we change your copy too. We only ask Google for permission to make our own calendars and manage the events in them, so we cannot see or change anything else in your Google account.
Why: So your training and matches show up in the calendar you already use.
Legal basis: Contract for you, since you choose to connect Google Calendar.
Who sees it: You, in your Google account, and anyone you share those calendars with there. Subtick's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Player pages

What: A page per Steam ID that gathers that player's statistics from the demos the viewer already has access to, plus their training ranks. It also shows the player's current FACEIT ELO and level, which we look up on FACEIT by Steam ID and keep for 15 minutes, and their Premier rating from the latest Premier demo the viewer can see. Your own profile shows the same.
Why: To compare and scout players within a team's own material.
Legal basis: Legitimate interests (art. 6(1)(f)).
Your choice: Write to hello@subtick.gg and we take your page down. You can still see it yourself.

Voice recordings

What: The voice of players who linked their TeamSpeak identity to Subtick, recorded in the team's channel when at least two linked teammates are there, or when a linked player types !rec. Players who have not linked are never recorded. The recorder posts a notice in the channel when it starts. We also keep your TeamSpeak ID and nickname so we know you linked. When a recording is paired with a demo, we write the comms out as text: one line per stretch of speech, with its time and the language detected for each player. To do that, we send the audio of each stretch of speech to Odincore, Ordbogen's speech-to-text service, which sends back the text. Whole recordings are not sent.
Why: So your team can hear its comms next to the demo, and read or search them while it watches.
Legal basis: Contract (art. 6(1)(b)). You turn the feature on by linking, and you can unlink at any time.
Who hears it: Your team, and teams the demo is shared with. The same people can read the text. Odincore processes the speech for us to write it out. Files are stored with Bunny in Stockholm and Frankfurt and can only be played through links that expire after 12 hours.
How long: Deleted 3 months after the last demo using the recording is deleted, or 3 months after recording if it never matched a demo. When you unlink, you can delete all your recordings at once. The text is always deleted together with its recording.

Game servers and training

What: When you play on a Subtick server: your Steam ID and in-game name, training sessions, scores, ranks and weapon loadouts, and your server's settings and password. Players without a Subtick account are stored by Steam ID as well.
Why: To run the servers and training modes and to show ranks and leaderboards.
Legal basis: Contract for users. Legitimate interests (art. 6(1)(f)) for players without an account, namely running fair rankings on our servers.
Who sees it: Leaderboards show Steam name, avatar and rank to signed-in users. The servers are hosted by DatHost.

Professional matches

What: Publicly available professional match data, including professional players' names, Steam IDs and match statistics.
Why: So teams can study professional play.
Legal basis: Legitimate interests (art. 6(1)(f)).
Who sees it: Anyone. Pages for professional matches, teams, players and events are public, without signing in, and search engines and AI services can index them. They show players' names and match statistics, never their Steam IDs.
Taking a page down: A professional player can write to hello@subtick.gg to have their page taken down. Their page then stops working, they are left out of search engine sitemaps, and every other page shows them as "Hidden player", without a name or link.
Source: Publicly available professional match records.

Statistics

Before you choose, and if you say no, we only count page loads, with no ID, IP address or cookie: which part of the site was opened, which site sent the visitor, campaign tags, mobile or desktop, and whether someone is signed in. Activity in the app is counted the same way, without linking it to you.

On our public pages (the front page, guides, maps, pro and stats pages and the like), PostHog also counts page views without cookies: nothing is stored on or read from your device. Your browser sends which page you viewed, the site that sent you, campaign tags, and your browser and device type. To tell visitors apart within one day, PostHog's servers make a code from your IP address and browser details with a key that changes every day, so the code cannot be traced back to you or linked across days. The IP address itself is not kept. No clicks, replays or account details are recorded.

Legal basis for both: legitimate interests (art. 6(1)(f)) in knowing how much the site is used and where visitors come from.

If you accept statistics, PostHog runs in your browser and records page views, clicks, visit replays (how you clicked and scrolled on our pages; what you type is hidden), load times and errors, linked to your account (user ID, Steam name and team). Events our server sends about you are then linked to your account too. Legal basis: consent (art. 6(1)(a)), which you can withdraw at any time under . If you are under 15, a parent must give or approve that consent (Danish Data Protection Act § 6).

PostHog keeps statistics in the EU (Frankfurt) for one year.

Security and running the service

What: While you are signed in, your session is stored with your IP address and browser details; it ends after 2 hours without activity. A log of account and team actions: who did what, to what, and when. Error reports.
Why: To keep accounts and teams safe, stop abuse, fix bugs and show who changed what.
Legal basis: Legitimate interests (art. 6(1)(f)).
Admin access: The two of us can see account data and can view Subtick as a specific user to fix a problem, help that user or look into a security issue. Every time we do, it is logged.

When you contact us

What: Your name, email, topic and message from the contact form, or your email to us.
Why: To answer you.
Legal basis: Legitimate interests (art. 6(1)(f)) in answering, or steps you asked for before a contract (art. 6(1)(b)). Messages are kept on our own mail server.

Payments

What: When you buy a plan: the name, email, billing address and payment details you enter at Stripe. We keep your Stripe customer ID, which plan you have, its status and dates, and whether you withdrew. Your card details never reach us.
Why: To sell and renew plans, send your contract confirmation, and handle withdrawals and refunds.
Legal basis: Contract (art. 6(1)(b)), and our legal duty to keep bookkeeping records (art. 6(1)(c)).
Who sees it: You buy through Link, which Stripe runs as merchant of record. Link decides over the payment data for the sale itself (receipts, VAT, fraud checks and payment support) under its own privacy policy. We only get your Stripe customer ID and the details of your plan. Team members can see that their team has a plan, not who paid or how.

Free trials

What: When you start a free trial: the trial itself (player or team, who started it, start and end dates), and the IP address it was started from. To check that you can have one, we ask Steam for public details of your account: how old it is, your CS2 playtime, and whether it has a VAC, game or community ban. For a team trial we check those details for everyone on the team, and everyone on the team, or who joins during the trial, is marked as having had a team trial. We remember who has had a trial as a scrambled code made from the Steam ID (a keyed hash), not the Steam ID itself.
Why: To give out free trials, and to stop the same people from taking one again and again with extra accounts, new teams or swapped rosters.
Legal basis: Contract (art. 6(1)(b)) for the trial itself. Legitimate interests (art. 6(1)(f)) for the checks, namely preventing abuse of a free offer (recital 47). That also covers checking and marking the other members of a team.
The automatic check: Whether a trial starts is decided automatically from the Steam details above: the account must be at least 180 days old, have at least 20 hours of CS2, show its age and game details publicly and have no bans. A team needs at least 3 members who pass, and nobody on it may have been in a team with a trial in the last 12 months. If you are refused, you can still buy a plan. Write to hello@subtick.gg if you think the check got it wrong, and a person will look at it.
IP addresses: Several trials from the same address within 30 days are shown to an admin, who decides whether to end them. The address alone never blocks a trial, because households, schools and LAN events share addresses.
How long: The Steam details are kept in a short-term cache for up to a day and are not saved with your account. The IP address is deleted after 90 days. The trial and the scrambled codes are deleted 24 months after the trial started. If you delete your account before then, the trial is no longer linked to you, but the codes stay, so the same Steam account cannot take another trial.

The free trial check above is the only decision we make about you automatically. Being refused a free trial does not stop you from using the free features or buying a plan, and you can always ask a person to look at it. Play recognition suggests which of your team's plays was used in a round, and your team decides whether it is right; it does not judge people.

Cookies and browser storage

Necessary, always on. The site does not work without these.

subtick-session: Cookie. Keeps you signed in. Ends after 2 hours without activity.
XSRF-TOKEN: Cookie. Protects forms against forged requests. Same lifetime as the session.
__Secure-mercure_access_token: Cookie. Lets the page receive live updates. 12 hours.
csm.consent: Browser storage. Your cookie choice. 12 months, then we ask again.
csm.language, csm.team.*, csm.invite_prompt.*, subtick.*: Browser storage. Choices you made: language, current team, dismissed invite prompts, and demo viewer settings such as camera, layout, voice volume and list or grid view. Kept until you clear them.
csm.invite: Session storage. Remembers an invite link while you sign in through Steam. Removed when you join the team or close the tab.

Statistics, only if you accept.

ph_*_posthog: Cookie and browser storage, set by PostHog. An ID that ties your visits together. Up to 1 year.
PostHog session data: Session storage, for visit replays. Deleted when you close the tab.

Saying no to statistics changes nothing about what you can use. When you withdraw consent, we delete PostHog's cookies and storage from your browser.

Providers that process data for us, under data processing agreements:

Bunny (BunnyWay d.o.o., Slovenia) stores and delivers voice recordings and images, such as team logos. Demos and the data from them stay on our own server.
Odincore (Ordbogen, Odense, Denmark) writes voice recordings out as text. It receives the audio of each stretch of speech, not whole recordings. It processes the audio only in Ordbogen's own data centre in Odense, deletes it as soon as it has sent back the text, and does not use it for training.
Hetzner (Germany) stores our encrypted backups.
PostHog (EU region) runs statistics, only as described above.
DatHost (DatHost AB, Sweden) is our server provider and hosts our game servers in Stockholm. It gets Steam IDs and server passwords, and your game connects directly to its servers.

Companies you use through Subtick, which decide over the data themselves:

Valve (Steam). You sign in through Steam, and we fetch public Steam names and avatars, and the public account details described under free trials. If you use matchmaking import or Steam messages, we also ask Valve for your match history and demos, and send messages through Steam. Avatars load from Steam's servers, so Steam sees your IP address. Steam's privacy policy applies.
FACEIT. If you connect FACEIT, you sign in on FACEIT, and we fetch your FACEIT profile, match history and match demos from FACEIT. FACEIT's own privacy policy applies to your FACEIT account.
Google. If you connect Google Calendar, we write your teams' calendar events into calendars in your own Google account. Google's privacy policy applies to your Google account.
Stripe and Link. When you buy a plan, Link sells it to you as merchant of record and Stripe processes the payment. Link's privacy policy applies to that data.
Discord. If your team adds a Discord webhook, the posts you send go to Discord.
TeamSpeak servers are run by your team, not by us.

We hand data to authorities only when the law requires it.

If we move Subtick into another business that we own, such as Subtick ApS, your data moves with it, and that business becomes the data controller. We tell you in the app at least 30 days before, and this policy will name the new controller.

Data outside the EU/EEA

Our server is in Denmark and our backups are in Germany. Bunny stores files in Sweden and Germany and only serves them from data centres in the EU/EEA, and Odincore runs in Ordbogen's own data centre in Odense. There are two exceptions:

PostHog keeps statistics in the EU. PostHog Inc. is a US company, and its data processing agreement covers any access from outside the EU with the EU Standard Contractual Clauses.
Stripe and Link can transfer payment data to Stripe, Inc. in the US, as their privacy policies describe.

Valve, Discord and Google are US companies. When you use them, their own terms apply.

How long we keep data

Account: Until you ask us to delete it. Deleting your account also deletes your voice recordings, private FACEIT demos, training data, scores, loadouts, private arenas, sessions and memberships. Plays you made for a team stay with the team, without your name.
Team content and demos: Until the team deletes them or the team is deleted.
FACEIT and matchmaking demos: Until you delete them or your account. Disconnecting FACEIT or stopping matchmaking import stops new imports, and the demos you already have stay until you delete them.
Matchmaking codes: Until you stop matchmaking import or delete your account.
Google Calendar connection: Until you disconnect it or delete your account. Disconnecting deletes the Subtick calendars from your Google account and withdraws our access.
FACEIT ratings: 15 minutes, then we look them up again.
Voice recordings: See voice recordings.
Sessions and IP address: Until the session ends after 2 hours without activity.
Action log: 1 year, then it is deleted automatically.
Statistics: 1 year in PostHog.
Payments: Bookkeeping records for 5 years after the end of the financial year, as Danish bookkeeping law requires.
Free trials: 24 months after the trial started. The IP address is deleted after 90 days.
Error logs: On our server until the next release.
Contact messages: 1 year after our last reply.
Backups: Up to 6 months. Deleted data can stay in a backup until it rotates out. If we ever restore a backup, we delete it again.

Children

Subtick is for players aged 13 and up. If you are under 15, a parent must give or approve consent to statistics. If you are under 18, you need a parent's approval to buy a paid plan. A parent can ask us to see or delete their child's data.

Your rights

You can ask us to:

show you your data and give you a copy (art. 15),
correct it (art. 16),
delete it (art. 17),
limit how we use it (art. 18),
give it to you in a format you can take elsewhere (art. 20),
stop using it where we rely on legitimate interests, for example your player page or your stats in other teams' demos (art. 21).

You can withdraw consent at any time under Cookies. That does not undo what happened before.

Write to hello@subtick.gg and include a link to your Steam profile. We answer within one month and may ask you to confirm it is you.

You can complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby.

Changes

When we change this policy, we update the version and date at the top. We show important changes in the app before they take effect.

Subtick is not affiliated with or endorsed by Valve Corporation. Counter-Strike is a trademark of Valve Corporation.