Privacy Policy

Bulk operates the website bulk.fun and the Bulk Steam Connector browser extension (together, the “Services”). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have.

By using the Services, you acknowledge this Privacy Policy. If you do not agree, please do not use the Services.

Scope

This policy covers both the Bulk website and the Bulk Steam Connector extension. It does not apply to third-party websites or services (including Steam, Valve, Solana, or wallet providers) that have their own privacy policies.

The browser extension

The Bulk Steam Connector exists to link your already-logged-in Steam session to your Bulk account so your case inventory can sync. It also shows public Bulk pricing and unbox-ROI data on Steam Community Market container pages.

• Connect Steam. When you click Connect Steam, the extension reads your short-lived Steam Web API token (loyalty_webapi_token), your SteamID, and the Steam session cookies needed to authenticate requests to Steam — all from your own logged-in browser session on steamcommunity.com / store.steampowered.com.
• Where the token goes. Your Steam token and SteamID are handed to the Bulk web page, which submits them to your Bulk account under your existing Bulk login. The extension itself never sends your token to our servers directly.
• Cookies. Steam session cookies are read locally and are only ever attached to requests sent back to Steam’s own domains (where they already belong), so the extension can read your Steam token. Cookie values are not transmitted to Bulk, never shown to the web page, and are not logged.
• Earlier versions. Extension versions before 0.8.0 also uploaded a small set of Steam community cookies to Bulk, stored encrypted, so trades on the former P2P market could be sent from our servers. That upload was removed when the P2P market closed in October 2026, and the stored copies were deleted.
• Market insights. When you view a CS2 container on the Steam Community Market, the extension sends only that container’s public name to Bulk to look up pricing and unbox data. It does not send your Steam session or inventory in that context.
• No tracking. The extension contains no analytics, advertising, or third-party tracking, and does not sell or share your data.

Information we collect

We collect information from you, from Steam and other third parties, and automatically when you use the Services.

From you

• Steam sign-in. When you sign in with Steam (OpenID), we receive your SteamID64 and use it to create or update your Bulk account.
• Profile and account settings. You may provide a Steam trade URL (required to tokenise or redeem cases) and, if we offer the field, an email address for account-related communication.
• Wallet. When you link a Solana wallet, we store your public wallet address so we can mint case tokens to it and verify the transfers and payments you make to Bulk. We never receive your wallet private keys or seed phrase.
• Deposits and redemptions. When you tokenise or redeem cases, we record the details needed to run them: case type, quantity, status, the Steam trade offer, and the related on-chain transaction signatures.
• Points. We keep a record of the activity points credited to your account.
• Support. If you contact us, we collect your message and any information you choose to include (such as your Steam account or a deposit or redemption ID).

From Steam and other third parties

• Steam profile. After sign-in we fetch your public Steam profile details: display name, avatar, profile URL, and profile visibility state.
• Steam inventory. To show cases you can tokenise, we read your CS2 inventory either through Steam’s public inventory endpoint (only if your inventory privacy is set to Public) or through the authenticated API using your stored Steam Web API token (via the extension).
• Trade offers. When you deposit or redeem, a Bulk custody account sends a Steam trade offer to your trade URL, and we track its status with Steam. You accept the offer in Steam.
• Blockchain. Token mints, transfers, trades, and any USDC payments to Bulk are recorded on the Solana blockchain. Transaction data there is public by design. Trades you make on third-party exchanges happen between your wallet and that exchange, not through Bulk.

Collected automatically

• Session cookie. When you sign in, we set an encrypted, HTTP-only session cookie (cases_session) so you stay logged in (typically up to seven days). This is strictly necessary to operate the site.
• Security data. We may process your IP address and request metadata transiently for rate limiting, fraud prevention, and to keep the Services secure.
• Usage analytics. If you accept analytics cookies via our consent banner, we use Google Analytics to understand how the website is used (for example pages viewed and approximate traffic). Google may set cookies or use similar technologies and receive usage data such as your IP address, browser type, and pages visited. We do not use this for advertising. You can reject analytics cookies; essential session cookies still apply so you can stay signed in.
• Trustpilot. If you accept analytics cookies and we have connected a Trustpilot business profile, we load Trustpilot’s review widget so the site can show our public review score. Trustpilot may receive technical data such as your IP address and the page you are on. Rejecting analytics cookies does not load their widget.

Information we do not collect

We never receive your Steam password, your Steam Mobile Authenticator secrets, your Steam login cookies, or your wallet’s private keys. We do not run identity verification (KYC), collect payment card numbers, or collect biometric data.

How we use information

We use personal information to:

• Hold cases in custody, mint case tokens, and process redemptions.
• Authenticate you and maintain your account.
• Sync inventory and send trade offers when you deposit or redeem.
• Verify on-chain transfers and payments before acting on them.
• Credit activity points.
• Respond to support requests and communicate about your account, deposits, or redemptions.
• Detect, prevent, and address fraud, abuse, and security issues.
• Comply with legal obligations and enforce our terms.
• Improve and maintain the Services.

How we share information

We share personal information only where necessary for the purposes above. We do not sell your personal information.

• Public statistics. Our public pages show aggregate figures such as token supply, cases in custody, and revenue, and link the Steam inventories of Bulk’s custody accounts. They do not identify individual users.
• Steam / Valve. We send requests to Steam’s APIs and trade endpoints to authenticate you, read inventory, and manage trade offers, according to Steam’s terms.
• Infrastructure providers. We use service providers for hosting, Solana RPC access, and similar operational needs. They process data on our behalf under contractual obligations.
• Google Analytics. We share website usage data with Google as described above. See Google’s Privacy Policy.
• Trustpilot. When the review widget is loaded, Trustpilot processes the technical data described above. See Trustpilot’s privacy terms.
• Legal and safety. We may disclose information if required by law, court order, or government request, or when we believe disclosure is necessary to protect rights, safety, or property, or to investigate fraud or abuse.
• Business transfers. If Bulk is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction.

In-game and off-platform communications

We do not monitor or record your in-game communications in Counter-Strike 2 or other games, including communications related to trades with Bulk. You are responsible for communications you have with others outside our Services.

Retention

We keep personal information for as long as needed to provide the Services and for legitimate business purposes, including resolving disputes and meeting legal obligations.

• Steam Web API token. Stored encrypted until it expires (typically within roughly 12–24 hours) or until you disconnect Steam from your account.
• Account, deposit, and redemption records. Retained while your account is active and afterward as needed for custody accounting, dispute handling, and record-keeping.
• Former P2P market records. Listings, orders, and payment records from the P2P market, which closed in October 2026, have been deleted. Payments made on it remain on the Solana blockchain, which is public and outside our control.
• Security data. Rate-limit and security counters are kept only for short windows and then discarded.

When information is no longer needed, we delete or anonymize it where reasonably practicable.

Security

We use technical and organizational measures designed to protect personal information, including encrypting stored Steam tokens at rest and using HTTP-only session cookies. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Your choices and rights

Depending on where you live, you may have rights regarding personal information we hold about you. Subject to applicable law, these may include:

• Access and portability. Request a copy of personal information we hold about you.
• Correction. Ask us to correct inaccurate personal information.
• Deletion. Request deletion of your account and associated personal information, subject to records we must keep for legal or operational reasons (such as deposit, redemption, and past order history).
• Objection / restriction. Object to or ask us to limit certain processing where the law allows.
• Disconnect Steam. From your Account page, disconnect Steam to delete the stored Steam Web API token.
• Analytics cookies. Reject analytics via our cookie banner; essential session cookies still apply so you can stay signed in. Rejecting also keeps the Trustpilot review widget from loading.

You can view much of your account data on the site. To exercise other rights, email support@bulk.fun. We may need to verify your identity (for example via your Steam account) before fulfilling a request. We will not deny you access to the Services solely for exercising privacy rights, though some choices (such as deleting your account) may limit what we can provide. You may also have the right to lodge a complaint with a supervisory authority where you live.

Do Not Track

Some browsers offer a “Do Not Track” (DNT) setting. Our websites do not currently respond to DNT signals. You can still control analytics cookies through our consent banner.

Third-party links

The Services may link to third-party websites or services (including Steam, wallet providers, block explorers, Discord, or X). We do not control those services and are not responsible for their content or privacy practices. Their own policies apply when you use them.

Children

The Services are not directed at children. We do not knowingly collect personal information from anyone under 16 (or under the applicable age of digital consent in their jurisdiction). If you are a parent or guardian and believe a child has provided us personal information, contact us and we will take steps to delete it.

International users

Bulk is operated from self-hosted infrastructure. If you access the Services from outside that region, your information may be transferred to and processed where our servers are located. Data protection laws where servers are located may differ from those in your country. We handle personal information as described in this policy regardless of where it is processed.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the effective date. For material changes, we may also notify you through the site or by email if we have your address on file. Please review this page periodically.

Contact

Questions about this policy, your data, or a privacy request? Email support@bulk.fun. Please include the email or Steam account associated with your Bulk account and a clear description of your request.