Privacy Policy

1. Operator and scope

WOK API operates the service at woksteamapi.com. This policy applies to the public website, customer account, checkout and requests made with a WOK API key.

Email, account recovery and message preferences

An email address is linked only after you request it in Account and confirm the verification link. We store the linked address, its verification state, message preferences and delivery records to provide account recovery and the emails you choose. An email typed into an order contact field is not treated as a verified address or marketing consent.

Verification, password recovery and account-security notices are service messages. Optional subscription reminders are separate from promotional emails. News, plan offers and win-back messages require an explicit marketing opt-in. You can change preferences, remove your email or unsubscribe from marketing without disabling account-security notices.

Our configured email delivery provider receives the recipient address and message contents to deliver mail. Access links contain short-lived or purpose-limited tokens. Do not forward them. Our email templates do not contain tracking pixels.

2. Account and authentication data

For a local account we process the login and a salted scrypt password hash. The password itself is never stored in plaintext. For Steam sign-in we process SteamID64, public name, avatar and profile URL returned through Steam OpenID and public profile services. For Discord sign-in we process the Discord user ID, username and avatar hash to verify membership in the WOK API server; the OAuth access token is used only during sign-in and is not stored.

3. Orders and payments

For an order we process the selected plan, subscription term, currency, base price, buyer-paid payment fee rate and amount, exact final total, order and payment status, related identifiers and payment method.

4. API and requested data

We process API usage counters, response times and errors needed to operate and protect the service. At your request, the service retrieves and caches Steam profile and inventory data, game item data and FACEIT profile or statistics data.

5. Why data is processed

We process data to create and secure accounts, authenticate users, deliver subscriptions and API keys, complete and reconcile payments, answer support requests, provide requested API results, maintain caches, measure usage, prevent abuse and fraud, diagnose failures and meet legal obligations.

6. Recipients and external services

Data is disclosed only when necessary to operate the requested feature. Recipients may include the selected payment provider, including Platega where applicable, hosting and infrastructure providers, Steam and FACEIT.

7. Storage and security

Customer sessions last no more than 30 days. Abuse-control counters are normally retained for about 7 days. Contract, payment and security records are retained only as long as necessary to provide the service, resolve disputes, prevent fraud and comply with applicable law.

8. Your choices and policy changes

You may request access to your personal data, correction, deletion or withdrawal of consent by contacting support. We may ask for information needed to verify that the request concerns your account. Legal or security obligations may require us to retain limited records.

Cookies and optional site statistics

We keep your cookie choice for 180 days. If you allow site statistics, a random session token is stored in browser session storage. We record categories of public pages, source and language, activity time, scroll depth and selected actions or errors. A session expires after 30 minutes of inactivity or 8 hours in total; raw statistical records are kept for up to 30 days. This is pseudonymous measurement, not a record of form contents, API keys or private account and order pages.

Choose Necessary only to stop optional browser statistics and remove the current statistical session. Reopen Cookie settings in the footer to change your choice. Linking a source to a new account, first API use and first payment requires the separate sign-up choice described below; you can withdraw that account permission in Cookie settings when signed in.

Aggregate server page counters

Separately from optional browser statistics, the server keeps daily totals for successful public HTML page responses by page category, source category and client category (browser-like, known bot or other). Request headers and approved campaign tags are classified without storing their raw values in these counters. These aggregates use no cookies or persistent visitor identifiers, are not linked to accounts, and are kept for up to 90 days. They count responses, not unique people; sources may be missing or inaccurate, and browser-cache or in-page navigation may not reach the server.

To estimate visits without counting every reload as a new visit, the server keeps a temporary keyed code derived from the trusted network address in RAM, using a random secret for that process. The fixed window is 30 minutes, resets at a new UTC day and restarts with the process. Neither the raw address nor this code is saved in the analytics database. The bounded memory cache holds only expiry times and a set of page categories already counted, not an ordered browsing history. No cookies, device fingerprint or account links are used for these estimates.

Only daily aggregate estimates are saved for up to 90 days. Shared addresses can merge different people; address changes and restarts can split a visit. Capacity limits or an unavailable address can leave coverage incomplete. These are approximate network visits, not unique people. Detailed page transitions and last observed pages use the separate optional browser statistics after your consent.

Optional source measurement

Only if you tick the separate optional box at sign-up, WOK stores a short-lived first-party consent token (20 minutes) and then the source, medium and campaign buckets with your account’s registration, first successful API use and first payment times. The account-linked record is deleted after 90 days. It contains no IP, email, SteamID, API key, raw URL, order ID or request data. You can decline and still register, sign in and buy normally. Browser-reported source labels are approximate; milestones are confirmed by the server. No Google tag, advertising cookie or conversion upload is enabled. Only fixed categories of public entry pages and page languages are stored; older or unsupported values are unknown. These categories are reported by the browser and may be inaccurate.