What is stored
A random internal user ID, linked SteamID64 values, public Steam profile names and avatars, public CS2 inventory snapshots, inventory events you confirm, account preferences and security audit records needed to operate the service.
Only the data needed to run your inventory.
Plain-language scope for the free English inventory manager and the Chinese rental ledger.
Optional transfer data
A Steam trade-offer URL is optional. Its token is encrypted at rest and is not displayed in account pages. Only when you explicitly open a Windows transfer is it released through a five-minute, single-use bearer ticket to the installed local helper; device pairing is not required for this transfer ticket. It cannot send or accept an offer, confirm Steam Guard or move an item by itself.
Local Steam sessions
The optional Windows companion opens a separate Microsoft Edge profile for each Steam account. Steam and Edge keep that signed-in session locally under your Windows account; Zuce servers never receive or read its cookies. Companion credentials and local profiles are restricted to the current Windows user and can be cleared by resetting the local profile.
What is never requested
Zuce never asks you to paste Steam passwords, browser cookies, login tokens, Steam Guard codes, mobile confirmations, wallet balances or private Steam API credentials into the website.
Server-transfer development preview
Live server execution is disabled pending a reviewed authorization provider and an independently isolated executor. The administrator preview stores the exact transfer plan, authorization decisions and sanitized security events, not Steam credentials. Any future session-processing service requires separate per-operation opt-in, identification of its operator, verified revocation, updated disclosures and release acceptance. Consent does not transfer the operator's security responsibilities to the user.
Free early access and traffic measurement
The English inventory manager is free during early access. It has no advertising profile, no payment requirement and no sale of personal data. Page traffic is counted with route groups, device class, country code and referrer hostname only. Query strings, raw IP addresses and full browser identifiers are not stored; a rotating daily hash and raw event expire after 30 days, while anonymous daily totals may be retained.
Inventory and market data
Public inventory snapshots are user-owned records. Cached public market observations are shared product data and are not presented as proof of a purchase, sale, rental or profit.
Screenshot recognition
If you choose screenshot recognition, the selected image is sent to OpenAI only to create a structured draft. The request uses store:false. Nothing is booked until you confirm it, and images containing credentials should never be uploaded.
Public community
Topics and replies you publish are public and may be indexed by search engines. Do not post personal data, credentials or trade tokens. Account deletion removes your profile and replaces retained discussion text with a non-identifying deletion notice so other users' reply threads remain coherent.
Service providers and transfers
Cloudflare processes hosting, security and database traffic; Steam supplies public identity and inventory responses; OpenAI processes a screenshot only when you request recognition. These services may process data outside your country under their own safeguards and terms.
Purpose and retention
Data is used to provide requested inventory, ledger, security and moderation functions. Optional recognition is based on your action; essential security processing protects the service. Records are kept only while needed for the feature, abuse prevention, dispute handling or legal duties, then deleted or anonymized.
Your controls
You may pause inventory sync, unlink a secondary account, remove a saved trade URL, sign out, export your data or delete your account. Account deletion removes private product records and anonymizes any public discussion needed to preserve replies. Some minimal security records may be retained where legally necessary.
Early-access scope
Effective 3 September 2026. ZuceCS is an independent early-access project and is not affiliated with Valve. It is not directed to children below the digital-consent age in their country. A dedicated public privacy contact and operator address must be added before paid or broad commercial availability.