Steam
- The documents do not say whether your data trains AI.
- Your data is used to target ads at you; you can opt out.
- They say they do not sell or share your data.
- The documents do not say who can read your content.
Steam collects account, game, and device data, says it does not sell it, and lets you manage or delete much of it in a dashboard.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, payments, chats, game stats, device IDs, IP address, and cookies.
Read the exact line
Privacy policy
“Personal Data we collect may include, but is not limited to, browser and device information, data collected through automated electronic interactions and application usage data.”
Training
They use it to run Steam, recommend games, send marketing, and look for cheating.
Read the exact line
Privacy policy
“We may process information collected under this section 3 so that content, products and services shown on the pages of the Steam store and in update messages displayed when launching the Steam Client can be tailored to meet your needs”
Sharing
They say they do not sell data; providers, other players, and game makers can see some of it.
Read the exact line
Privacy policy
“Valve does not sell Personal Data. However, we may share or provide access to each of the categories of Personal Data we collect as necessary for the following business purposes.”
Kept
They keep it as long as needed; tax records can last up to ten years after you leave.
Read the exact line
Privacy policy
“Please note that Valve is required to retain certain transactional data under statutory commercial and tax law for a period of up to ten (10) years.”
Controls
You can see, fix, or delete a lot of data in the Privacy Dashboard after you log in.
Read the exact line
Privacy policy
“This gives you access to your Personal Data, allows you to rectify and delete it where necessary and to object to its use where you feel necessary.”
Fine print
Steam’s own lawsuit and refund rules were not in the terms we could read.
Read the exact line
Privacy policy
“Other capitalized terms in this Privacy Policy shall have the meanings defined in the Steam Subscriber Agreement ("SSA").”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Open the Privacy Dashboard
https://help.steampowered.com then My Account -> Data Related to Your Steam Account
Turn off auto store page and notifications
Steam Client settings, Interface section
Unsubscribe from marketing email
Unsubscribe link in marketing emails or the email setting page
Manage cookies
Cookie banner or Cookie Settings page on the Steam website
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Even after you leave, some purchase records can stay for a decade because of tax rules.
Read the exact line
Privacy policy
“Please note that Valve is required to retain certain transactional data under statutory commercial and tax law for a period of up to ten (10) years.”
For example, if you delete Steam, they may still keep years of wallet and purchase history.
Anyone who looks up your Steam ID can see at least your public name, avatar, and cheat bans, and game makers get more.
Read the exact line
Privacy policy
“We make certain data related to your Steam User Account available to other players and our partners through the Steamworks API.”
For example, a website or another game can pull your public profile and whether you were banned for cheating.
Steam logs how you play and details about your computer, not just your login.
Read the exact line
Privacy policy
“By game statistics we mean information about your games' preferences, progress in the games, playtime, as well as information about the device you are using, including what operating system you are using, device settings, unique device identifiers, and crash data.”
For example, they can store how long you played a game and a unique ID for your PC.
What you type in community chats and forums can be public.
Read the exact line
Privacy policy
“When posting a message to a board, forum or chat area, please be aware that the information is being made publicly available online; therefore, you are doing so at your own risk.”
For example, a forum post with your username can be read by anyone on the internet.
They say they do not sell your personal information for money.
Read the exact line
Privacy policy
“Valve does not sell Personal Data.”
For example, they claim they would not sell your email list to an advertiser as a sale.
You can ask to wipe the account through Steam support, with a 30-day undo window.
Read the exact line
Privacy policy
“You can also request the deletion of your Steam user account via the Steam support page.”
For example, you log into help.steampowered.com and request account deletion, then have 30 days to restore it.
You must be at least 13; they rely on you (and parents where the law is stricter) rather than a strong ID check.
Read the exact line
Privacy policy
“The minimum age to create a Steam User Account is 13. Valve will not knowingly collect Personal Data from children under this age.”
For example, a 12-year-old is not supposed to make an account, but the policy describes a stated minimum age.
They say they use common encryption and other safeguards when moving data.
Read the exact line
Privacy policy
“ of data Industry-standard encryption Provision of access to data on a need-to-know basis”
For example, they list encryption among steps they take for transfers out of Europe.
You can stop sales emails with unsubscribe or email settings.
Read the exact line
Privacy policy
“You can opt out or withdraw your consent to receive marketing emails at any time by either withdrawing the consent on the same page where you previously provided it or clicking the "unsubscribe" link provided in every marketing email.”
For example, you click unsubscribe in a Steam sale email.
They use cookies and ad-style tags to measure use and improve marketing.
Read the exact line
Privacy policy
“We use "Cookies", which are text files placed on your computer, and similar technologies (e.g. web beacons, pixels, ad tags and device identifiers) to help us analyze how users use our services, as well as to improve the services we are offering, to improve marketing, analytics or website functionality.”
For example, a pixel can record that you opened a store page so they can refine what they show you.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- device identifiers
- Codes that single out your phone or computer, used to recognise you across apps and sites. For example, the advertising ID on your phone lets two unrelated apps know they are seeing the same person.
- pseudonymous
- Your name is swapped for a code, but the company keeps the key and can still link the data back to you. For example, your chats are filed under user 48213 instead of your name, but staff can still look up who that is.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- tracking pixels
- Tiny invisible images or bits of code in a page, app or email that report back when and where you opened it. For example, a pixel in a marketing email tells the sender the moment you read it.
How we got here · grade C · score 43/100 · 15 of 15 policy answers backed by a verified quote · 8 not stated
What does the app collect beyond what it needs to work?
Besides your account and what you type, they collect device info, unique device IDs, IP address, cookies, game stats, crash data, and payments.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They tailor store recommendations and marketing using your data, with cookie settings, store-page toggles, and email unsubscribe.
Do they sell or share your data, and can you opt out?
They say they do not sell personal data. They still share with providers, subsidiaries, CDNs, and via the public Steamworks API.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete via the dashboard or account deletion (30-day restore). Some tax and match data can last years or stay anonymized.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe encryption, need-to-know access, DPF certification, and similar safeguards. No independent audit of a leak is described.
Is there a real age gate, and are teens protected?
The minimum age is 13, with parental consent where a country requires a higher age. It is not described as a hard ID check.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated February 14th, 2025, but it does not clearly promise advance notice of every change.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 4,659 words at a college level (Flesch reading ease 45.9); the terms are 17,653 words at a professional or legal expert level.
