Privacy Policy — Heatcheck

Draft for the demo integration release: 2026-09-13. Not yet published.

Heatcheck is a browser extension that shows extended CS2 statistics inside the FACEIT match room. This page explains what it does with your data.

Short version

The extension contains no analytics or trackers. Optional demo analysis sends data to HeatCheck after you connect the integration and either select a file or explicitly enable automatic demo transfer.

What data is handled

• Your FACEIT Data API key — entered by you, stored only in your browser (storage.local). Never sent to the developer; sent only to FACEIT's official API (https://open.faceit.com) to fetch public statistics.
• Cached API responses — public stats cached locally to respect rate limits; clearable from the popup.
• Your settings — stored locally on your device.

What it does NOT do

• Statistics use FACEIT endpoints. Partner assets use heatcheck.space, Twitch status uses decapi.me, and flag images use flagcdn.com. Each service receives the network information needed to answer a request.
• No analytics, telemetry, ads, fingerprinting, or third-party trackers.
• No access to browsing history or credentials.

Permissions

• storage — save settings, API key, and cache locally.
• open.faceit.com host access — fetch public CS2 stats.
• content script on www.faceit.com — show stats in the room.

Data retention

Settings, your optional FACEIT API key and cache stay in your browser. Uninstalling removes this local data but does not revoke a server token.

Optional Telegram demo analysis — release in preparation

A one-time code links the extension to your Telegram bot account. A separate Steam OpenID login verifies your SteamID64 against your FACEIT profile on the server. HeatCheck does not receive your Steam password. The extension sends the pairing code, its dedicated access token, match ID and a demo file selected manually or obtained through the separately enabled automatic-transfer beta to https://api.heatcheck.space for validation and analysis. Demos contain match events, player identifiers and may contain communications recorded by the game.

Results are sent to your Telegram account. Raw uploads are deleted after processing, failure or cancellation, with a 24-hour expiry enforced by the running cleanup worker. Job status and identity records remain for access control and duplicate prevention. Codes expire after 10 minutes and tokens after 30 days; only their hashes are stored on the server. No FACEIT password, cookie, personal FACEIT API key or Telegram bot token is exported from the browser.

Disconnect in the extension or send /extension_revoke to the bot. This revokes access and cancels pending work; it does not remove a result already delivered to Telegram. For deletion of retained server records, contact the address below. Automatic transfer is a beta: the computer and browser must be running and FACEIT must be signed in during download and upload. FACEIT checks require your own action. Automatic download has not yet been confirmed by a complete live test on an installed extension. You can pause it in the extension; manual file selection remains available.

Website analytics (heatcheck.space)

The claims above describe the browser extension, which contains no analytics or trackers. Separately, the marketing website heatcheck.space uses Google Analytics to measure anonymous, aggregated visitor statistics (page views, referrers, which install button is clicked). This is standard website analytics and applies only to the website — never to the extension. You can opt out with any tracker-blocking extension, and no personal data is sold or shared.

Contact

angelokkus@gmail.com