Privacy Policy

Bulk operates the website bulk.fun and the Bulk Steam Connectorbrowser extension (together, the “Services”). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have.

By using the Services, you acknowledge this Privacy Policy. If you do not agree, please do not use the Services.

Scope

This policy covers both the Bulk website and the Bulk Steam Connector extension. It does not apply to third-party websites or services (including Steam, Valve, Solana, or wallet providers) that have their own privacy policies.

The browser extension

The Bulk Steam Connector exists to link your already-logged-in Steam session to your Bulk account so your case inventory can sync and trade offers can be sent reliably. It also shows public Bulk pricing and unbox-ROI data on Steam Community Market container pages.

• Connect Steam. When you click Connect Steam, the extension reads your short-lived Steam Web API token (loyalty_webapi_token), your SteamID, and the Steam session cookies needed to authenticate requests to Steam — all from your own logged-in browser session on steamcommunity.com / store.steampowered.com.
• Where the token goes. Your Steam token and SteamID are handed to the Bulk web page, which submits them to your Bulk account under your existing Bulk login. The extension itself never sends your token to our servers directly.
• Cookies.Steam session cookies are read locally and are only ever attached to requests sent back to Steam’s own domains (where they already belong), so authenticated inventory reads and trade-offer sends succeed. Cookie values are never transmitted to Bulk, never shown to the web page, and are not logged.
• Market insights.When you view a CS2 container on the Steam Community Market, the extension sends only that container’s public name to Bulk to look up pricing and unbox data. It does not send your Steam session or inventory in that context.
• No tracking. The extension contains no analytics, advertising, or third-party tracking, and does not sell or share your data.

Information we collect

We collect information from you, from Steam and other third parties, and automatically when you use the Services.

From you

• Steam sign-in. When you sign in with Steam (OpenID), we receive your SteamID64 and use it to create or update your Bulk account.
• Profile and account settings. You may provide a Steam trade URL (required to sell) and, if we offer the field, an email address for account-related communication.
• Wallet. When you connect a Solana wallet, we store your public wallet address to process marketplace payments and escrow. We never receive your wallet private keys or seed phrase.
• Marketplace activity. When you list, buy, or place buy orders, we collect order details (case type, quantity, price, status), trade-offer links, and on-chain transaction signatures needed to operate escrow.
• Support. If you contact us, we collect your message and any information you choose to include (such as your Steam account or order ID).

From Steam and other third parties

• Steam profile. After sign-in we fetch your public Steam profile details: display name, avatar, profile URL, and profile visibility state.
• Steam inventory.To show cases you can sell, we read your CS2 inventory either through Steam’s public inventory endpoint (only if your inventory privacy is set to Public) or through the authenticated API using your stored Steam Web API token (via the extension).
• Trade offers. When you buy or sell, we create or track Steam trade offers on your behalf. Outgoing trades still require your confirmation in the Steam Mobile app.
• Blockchain. USDC escrow deposits, releases, and refunds are recorded on the Solana blockchain. Transaction data there is public by design.

Collected automatically

• Session cookie. When you sign in, we set an encrypted, HTTP-only session cookie (cases_session) so you stay logged in (typically up to seven days). This is strictly necessary to operate the site.
• Security data. We may process your IP address and request metadata transiently for rate limiting, fraud prevention, and to keep the Services secure.
• Usage analytics. If you accept analytics cookies via our consent banner, we use Google Analytics to understand how the website is used (for example pages viewed and approximate traffic). Google may set cookies or use similar technologies and receive usage data such as your IP address, browser type, and pages visited. We do not use this for advertising. You can reject analytics cookies; essential session cookies still apply so you can stay signed in.

Information we do not collect

We never receive your Steam password, your Steam Mobile Authenticator secrets, or your wallet’s private keys. We do not run identity verification (KYC), collect payment card numbers, or collect biometric data.

How we use information

We use personal information to:

• Provide and operate the marketplace (listings, orders, escrow, trades).
• Authenticate you and maintain your account.
• Sync inventory and send trade offers when you initiate a transaction.
• Display public marketplace data (seller/buyer Steam persona names and avatars on listings and orders).
• Process and verify on-chain USDC payments.
• Respond to support requests and communicate about your account or orders.
• Detect, prevent, and address fraud, abuse, and security issues.
• Comply with legal obligations and enforce our terms.
• Improve and maintain the Services.

How we share information

We share personal information only where necessary for the purposes above. We do not sell your personal information.

• Other users.Marketplace listings show seller Steam identity. When you participate in an order, the buyer and seller can see each other’s Steam persona and Solana wallet addresses needed to settle escrow. Wallet addresses are not shown on public listing feeds.
• Steam / Valve.We send requests to Steam’s APIs and trade endpoints to authenticate you, read inventory, and manage trade offers, according to Steam’s terms.
• Infrastructure providers. We use service providers for hosting, Solana RPC access, and similar operational needs. They process data on our behalf under contractual obligations.
• Google Analytics. We share website usage data with Google as described above. See Google’s Privacy Policy.
• Legal and safety. We may disclose information if required by law, court order, or government request, or when we believe disclosure is necessary to protect rights, safety, or property, or to investigate fraud or abuse.
• Business transfers. If Bulk is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction.

In-game and off-platform communications

We do not monitor or record your in-game communications in Counter-Strike 2 or other games, including communications related to trades arranged through Bulk. You are responsible for communications you have with other users outside our Services.

Retention

We keep personal information for as long as needed to provide the Services and for legitimate business purposes, including resolving disputes and meeting legal obligations.

• Steam Web API token.Stored encrypted until it expires (typically within roughly 12–24 hours) or until you disconnect Steam from your account.
• Account and order records. Retained while your account is active and afterward as needed for escrow settlement, dispute handling, and record-keeping.
• Security data. Rate-limit and security counters are kept only for short windows and then discarded.

When information is no longer needed, we delete or anonymize it where reasonably practicable.

Security

We use technical and organizational measures designed to protect personal information, including encrypting stored Steam tokens at rest and using HTTP-only session cookies. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Your choices and rights

Depending on where you live, you may have rights regarding personal information we hold about you. Subject to applicable law, these may include:

• Access and portability. Request a copy of personal information we hold about you.
• Correction. Ask us to correct inaccurate personal information.
• Deletion. Request deletion of your account and associated personal information, subject to records we must keep for legal or operational reasons (such as completed order and escrow history).
• Objection / restriction. Object to or ask us to limit certain processing where the law allows.
• Disconnect Steam. From your Account page, disconnect Steam to delete the stored Steam Web API token.
• Analytics cookies. Reject analytics via our cookie banner; essential session cookies still apply so you can stay signed in.

You can view much of your account data on the site. To exercise other rights, email support@bulk.fun. We may need to verify your identity (for example via your Steam account) before fulfilling a request. We will not deny you access to the Services solely for exercising privacy rights, though some choices (such as deleting your account) may limit what we can provide. You may also have the right to lodge a complaint with a supervisory authority where you live.

Do Not Track

Some browsers offer a “Do Not Track” (DNT) setting. Our websites do not currently respond to DNT signals. You can still control analytics cookies through our consent banner.

Third-party links

The Services may link to third-party websites or services (including Steam, wallet providers, block explorers, Discord, or X). We do not control those services and are not responsible for their content or privacy practices. Their own policies apply when you use them.

Children

The Services are not directed at children. We do not knowingly collect personal information from anyone under 16 (or under the applicable age of digital consent in their jurisdiction). If you are a parent or guardian and believe a child has provided us personal information, contact us and we will take steps to delete it.

International users

Bulk is operated from self-hosted infrastructure. If you access the Services from outside that region, your information may be transferred to and processed where our servers are located. Data protection laws where servers are located may differ from those in your country. We handle personal information as described in this policy regardless of where it is processed.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the effective date. For material changes, we may also notify you through the site or by email if we have your address on file. Please review this page periodically.

Contact

Questions about this policy, your data, or a privacy request? Email support@bulk.fun. Please include the email or Steam account associated with your Bulk account and a clear description of your request.