Privacy policy · LOCKSTAT

What the site shows

Match stats, ranks, names and avatars come from public sources: the Deadlock API (deadlock-api.com) and Steam. This data is public to anyone who knows your Steam ID; LOCKSTAT does not create it and cannot remove it from those sources.
A profile owner can hide the Players tab, the activity calendar and the “in a match” status on LOCKSTAT in profile settings.

Signing in with Steam

Sign-in uses the official Steam OpenID: you enter your password only on Steam, we never see it. Steam tells us only your Steam ID.
After sign-in we set a lockstat_session cookie for 30 days containing your signed Steam ID so you stay signed in. “Sign out” removes it.

What is stored on the server

If you sign in: your favorite players, profile customization (main, background, bio, hidden sections) and the “verified profile” mark. If you post in “Find teammates” — region, mode, heroes, note and rank; the post is deleted after 2 hours. Nothing else about your account is stored.
A profile view counter for “Popular profiles”: one view per visitor per day. Instead of the IP address an irreversible hash is stored; the IP itself is not saved, and records older than 7 days are deleted.
To protect against overload, the server keeps the IP address in memory for no more than two minutes to rate-limit requests. It is never written to disk.
Patch note translations — patch text only, no personal data.
If you clicked “Follow”: the notification subscription address issued by your browser (a Google, Mozilla, Apple or Microsoft push service address with encryption keys), your language and the list of followed players. No name and no link to an account. Deleted when you unfollow all players or block notifications in your browser.
If you use the Telegram bot: the chat id, language, your Steam ID if you signed in with Steam (/login) and the list of followed players. Your name and phone number are not stored. Deleted if you block the bot.
If you supported the project (Patreon, Boosty, etc.) and gave us your Steam ID: the Steam ID, platform, amount and period — only to show the Supporter badge. Deleted on request.
If you write to us via Feedback (the site or /feedback in the bot): the message text, date and, if you are signed in with Steam or linked your account in the bot, your Steam ID; from the bot also the chat id, so we can tell you when the idea ships. If you report another player's text: the text and your Steam ID — visible to moderators only.
If you requested an AI match review: the finished review (tip text) and a daily review counter tied to your Steam ID. In the Telegram bot reviews work after you confirm your account by signing in with Steam — your Steam ID is then linked to the chat.
Our own visit statistics: how many times pages were opened per day, how many different visitors there were and which sites they came from (domain only). No cookies: visitors are told apart by a hash of IP address and browser with a salt that changes every day and is then erased, so visits on different days cannot be linked and the IP cannot be recovered. Separately we count how many times per day each profile and match was opened and which names were searched without results — numbers only, not linked to visitors (kept for 60 days). We also count how many times per day certain actions happened (search, sign-in, follow, AI review) and which site the visitor who did it came from — totals only. Daily totals are kept for 120 days.

What is stored in your browser

The lang cookie — the site language you chose.
localStorage — recently opened profiles and matches for search. It never leaves your browser; “Clear” in the search box removes it.
If you install the site as an app, the browser caches icons and site files for offline use.
There are no ads and no third-party counters or trackers.

Third-party services

Deadlock API — the stats source. Our server makes the requests; your IP address is not passed on.
Steam — player avatars are loaded by your browser directly from Steam servers.
Hero and item icons are loaded from Deadlock API servers.
Claude API (Anthropic) — translates patch notes. Only the patch text is sent.
Your browser’s push service (Google, Mozilla, Apple or Microsoft) delivers notifications about followed players. Notification content is encrypted; the push service cannot read it.
Telegram — delivers LOCKSTAT bot messages if you use the bot.
Claude API (Anthropic) — writes AI match reviews on your request. Only the match game stats are sent (hero, souls, items, deaths, comparison with averages), without your name or Steam ID.

Legal bases and retention

Sign-in, favorites and profile customization — to provide the service you asked for. Kept until you delete them.
Overload protection and the anonymized view counter — our legitimate interest in a stable, fair site. IP addresses stay in memory for a couple of minutes at most; counters for 7 days.
Recent profiles and the offline cache in your browser — only with your consent, which you can withdraw on the Cookie policy page.
The sign-in cookie lasts 30 days or until sign-out; the language and consent cookies — 1 year.

Your rights

You can learn what data about you is stored, correct it, delete it, object to processing or withdraw consent. Almost all of this is available on the site: Profile settings, the delete button below, the Cookie policy.
If you believe your rights have been violated, you can contact your country's data protection authority.

Children

Signing in with Steam is allowed from age 16. We do not knowingly collect children's data; if we learn of such an account, we delete its data.

How to delete your data

You can change favorites, profile customization and your teammate post at any time. The button below deletes everything LOCKSTAT stores about your account and signs you out.

Delete my data from LOCKSTATRequires signing in with Steam. In-game stats stay available through the Deadlock API — we cannot delete those.

Current setting: not chosen yet — essential only

Who runs the site

LOCKSTAT is a non-commercial fan project run by a private individual. It is not affiliated with Valve Corporation.

A contact address will be listed here once the site is public.

What the site shows

Match stats, ranks, names and avatars come from public sources: the Deadlock API (deadlock-api.com) and Steam. This data is public to anyone who knows your Steam ID; LOCKSTAT does not create it and cannot remove it from those sources.

A profile owner can hide the Players tab, the activity calendar and the “in a match” status on LOCKSTAT in profile settings.

What is stored on the server

If you sign in: your favorite players, profile customization (main, background, bio, hidden sections) and the “verified profile” mark. If you post in “Find teammates” — region, mode, heroes, note and rank; the post is deleted after 2 hours. Nothing else about your account is stored.

A profile view counter for “Popular profiles”: one view per visitor per day. Instead of the IP address an irreversible hash is stored; the IP itself is not saved, and records older than 7 days are deleted.

To protect against overload, the server keeps the IP address in memory for no more than two minutes to rate-limit requests. It is never written to disk.

Patch note translations — patch text only, no personal data.

If you clicked “Follow”: the notification subscription address issued by your browser (a Google, Mozilla, Apple or Microsoft push service address with encryption keys), your language and the list of followed players. No name and no link to an account. Deleted when you unfollow all players or block notifications in your browser.

If you use the Telegram bot: the chat id, language, your Steam ID if you signed in with Steam (/login) and the list of followed players. Your name and phone number are not stored. Deleted if you block the bot.

If you supported the project (Patreon, Boosty, etc.) and gave us your Steam ID: the Steam ID, platform, amount and period — only to show the Supporter badge. Deleted on request.

If you write to us via Feedback (the site or /feedback in the bot): the message text, date and, if you are signed in with Steam or linked your account in the bot, your Steam ID; from the bot also the chat id, so we can tell you when the idea ships. If you report another player's text: the text and your Steam ID — visible to moderators only.

If you requested an AI match review: the finished review (tip text) and a daily review counter tied to your Steam ID. In the Telegram bot reviews work after you confirm your account by signing in with Steam — your Steam ID is then linked to the chat.

Our own visit statistics: how many times pages were opened per day, how many different visitors there were and which sites they came from (domain only). No cookies: visitors are told apart by a hash of IP address and browser with a salt that changes every day and is then erased, so visits on different days cannot be linked and the IP cannot be recovered. Separately we count how many times per day each profile and match was opened and which names were searched without results — numbers only, not linked to visitors (kept for 60 days). We also count how many times per day certain actions happened (search, sign-in, follow, AI review) and which site the visitor who did it came from — totals only. Daily totals are kept for 120 days.

What is stored in your browser

The lang cookie — the site language you chose.

localStorage — recently opened profiles and matches for search. It never leaves your browser; “Clear” in the search box removes it.

If you install the site as an app, the browser caches icons and site files for offline use.

There are no ads and no third-party counters or trackers.

Third-party services

Deadlock API — the stats source. Our server makes the requests; your IP address is not passed on.

Steam — player avatars are loaded by your browser directly from Steam servers.

Hero and item icons are loaded from Deadlock API servers.

Claude API (Anthropic) — translates patch notes. Only the patch text is sent.

Your browser’s push service (Google, Mozilla, Apple or Microsoft) delivers notifications about followed players. Notification content is encrypted; the push service cannot read it.

Telegram — delivers LOCKSTAT bot messages if you use the bot.

Claude API (Anthropic) — writes AI match reviews on your request. Only the match game stats are sent (hero, souls, items, deaths, comparison with averages), without your name or Steam ID.

Legal bases and retention

Sign-in, favorites and profile customization — to provide the service you asked for. Kept until you delete them.

Overload protection and the anonymized view counter — our legitimate interest in a stable, fair site. IP addresses stay in memory for a couple of minutes at most; counters for 7 days.

Recent profiles and the offline cache in your browser — only with your consent, which you can withdraw on the Cookie policy page.

The sign-in cookie lasts 30 days or until sign-out; the language and consent cookies — 1 year.

Your rights

You can learn what data about you is stored, correct it, delete it, object to processing or withdraw consent. Almost all of this is available on the site: Profile settings, the delete button below, the Cookie policy.

If you believe your rights have been violated, you can contact your country's data protection authority.