Privacy policy

Who we are and how to contact us

Goldmine is based in the United Kingdom and is responsible for the personal information described here. For privacy questions or to exercise your rights, email privacy@goldmine.to. For help with the service, email support@goldmine.to.

Please do not send passwords, authentication codes, Steam secrets, or proxy credentials by email.

What information we use

• Your account: name, email address, profile image, account status, and sign-in records, including IP address, browser or device information, and activity times. Email sign-in stores a password hash. If you use Discord sign-in or link Discord, Discord supplies your identifier, username, email and verification status, and avatar details.
• Security and access: the security methods you set up, such as authenticator secrets, hashed recovery codes, email verification codes, or passkey public keys and device metadata. We also keep API key records, workspace names, invitations, memberships, roles, permissions, and an audit trail of actions.
• Connected trading accounts: Steam account names and identifiers, passwords and authentication secrets you supply, API keys, session information, inventory, account restrictions, and trade offers. Where used, connected marketplace accounts also hold their authentication details and wallet seed. Steam chat features store sent and received messages, the other participant's Steam identifier, and message times.
• Proxies: provider credentials, proxy addresses, ports, usernames and passwords, account assignments, and connection health information. These come from you or the proxy provider you connect.
• Trading activity: trading rules, listings, orders, purchases, sales, prices, inventory changes, and performance calculations. We obtain relevant records from connected Steam and marketplace accounts, and market prices and listings from marketplace and public market-data sources.
• Visits and support: request and error information used to operate the service, and the contact details and message content you send when you ask for help or make a privacy request.

Sign-in information is needed to create and protect an account. Connected-account and proxy details are needed for the features that use them; without those details, those features cannot work. Only connect accounts you are entitled to manage, and avoid putting unnecessary personal information in workspace names, chat, or support messages.

Why we use it

We use account, workspace, connection, and trading information to provide the service you request, manage access, carry out your trading instructions, display results, and answer service questions. Where this is necessary to provide our service to you, our lawful basis under UK data protection law is performance of our contract with you, or steps you ask us to take before that contract.

We use security records, audit trails, and operational logs to prevent abuse, investigate failures, protect accounts, and keep the service reliable. Our lawful basis is our legitimate interest in running a secure, working service. This also covers managing access for invited workspace members who are not themselves the contracting customer, and handling general enquiries. We consider the impact on people whose information is used.

When we handle data protection requests or information that a law requires us to keep or disclose, our lawful basis is compliance with that legal obligation.

Trading automation compares market information with the rules and limits configured for an account or workspace to decide which trades to attempt. An executed trade can change your inventory and marketplace balance. Access controls and abuse checks can also reject requests. Contact us if you need an explanation or human review of an outcome affecting you.

Who receives information

• Workspace members can see information according to their roles and permissions. The operator can access information needed to administer the service and investigate problems.
• Cloudflare serves our website and application, protects requests, provides Turnstile checks on relevant authentication forms, and forwards email sent to our contact addresses.
• Resend sends account verification, password reset, security notifications, and email authentication codes. It receives the recipient address and message content needed for delivery.
• Server infrastructure supports our backend and operational tools. This includes Hetzner infrastructure used for our operations. Database backups are copied to Proton Drive, and Proton Mail handles the mailbox receiving contact emails.
• Our operator uses OpenAI (Codex) and Anthropic (Claude) for engineering and troubleshooting. Current diagnostic work uses operator-managed pilot records, logs, aggregates and application views. The selected input is processed by the AI provider under the operator's individual-account terms. These are internal engineering tools; customer records are not currently fed into an automated AI diagnostic service.
• Diagnostic replies can be delivered to a private operator Signal group. Signal messages are end-to-end encrypted, so Signal cannot read their content; the intended recipients can. Signal handles the operator's account and delivery information under its own terms.
• Discord handles Discord sign-in. Steam, connected marketplaces such as CSFloat, and proxy providers such as Webshare and Proxyline receive the authentication details and action requests needed to use the provider accounts you connect. They act as independent controllers for their own account management and service records, under their own privacy policies. Proxy providers also carry the network traffic routed through them.

Information may also need to be disclosed in response to a binding legal requirement.

Processing outside the UK

Using global infrastructure and connected services means information can be processed outside the UK. Our operational infrastructure includes servers in Germany. Cloudflare operates a global network, and Resend describes its primary processing as taking place in the United States. Proton stores Mail and Drive data in Switzerland, Germany or Norway. Steam, Discord and CSFloat process information in the United States; connected proxy services may process information in other countries.

Our transfers to Hetzner in Germany and Proton in Switzerland are covered by UK adequacy regulations, which recognise those countries' data protection laws. For covered US transfers to Cloudflare, Valve (Steam) and Discord, we rely on UK adequacy through their participation in the UK extension to the EU-US Data Privacy Framework. Resend transfers use standard contractual clauses with the UK addendum, incorporated into our service agreement. Cloudflare's service agreement also includes those contractual safeguards for transfers that require them. You can read Cloudflare's terms and Resend's terms, the Steam privacy policy and Discord privacy policy, or contact privacy@goldmine.to for information about the safeguards relevant to your data.

Current operator diagnostics can be processed in the United States and other countries. The individual-account OpenAI privacy policy and Anthropic privacy policy explain how those providers handle submitted information, including their own international transfers and possible use to improve models, depending on settings and the circumstances. Signal's terms and privacy policy explain its processing of encrypted messages and account information in the US and other countries.

Cookies and browser storage

The public marketing site does not sign you in. The application uses necessary cookies to keep you signed in and protect Discord sign-in: __Host-session lasts 15 minutes, and __Host-oauth-state lasts up to 10 minutes. The __Host-refresh cookie renews access; remembered and Discord sign-ins use a 30-day refresh window, with an overall 90-day session limit. Without "remember me", the browser cookie is session-scoped and server access has a shorter expiry. Signing out or revoking a session ends that session's access.

Browser storage remembers your colour scheme, table column choices, and Steam chat notification opt-in. It also holds temporary sign-in steps. These functions are separate from visitor tracking. We do not include optional advertising or visitor-analytics trackers in our website or application. The trading analytics in the dashboard calculate trading results; they are not advertising analytics. Cloudflare security checks can process browser and network information to detect automated abuse.

You can clear or block cookies and browser storage in your browser. Blocking necessary storage may prevent sign-in or stop settings being remembered.

Protecting information

Account passwords are hashed. The account service encrypts authenticator secrets, and our Steam and proxy services encrypt stored credential fields using workspace-specific encryption keys. The service must decrypt connected credentials when it uses them to authenticate or act on your behalf. This protection does not mean that all trading records, messages, logs, or configuration files are encrypted in the same way.

How long information stays

Account and workspace information stays while it supports your access and use of the service. Account, trading, chat, and support records do not have a single automatic expiry. We assess removal requests individually, including whether records are still needed for shared workspace activity, security investigations, resolving disputes, or a legal obligation. Inactivity alone does not automatically delete your information. Deleting an account disables access; it does not by itself erase the stored profile.

• Requesting workspace deletion disables access and schedules permanent removal after 90 days. Processing can take longer, and this does not automatically erase every historical marketplace or analytics record.
• Audit records have a configured 90-day retention period. Our service logs and traces have a configured 28-day retention period; cleanup runs periodically.
• Some historical market and inventory records have a configured retention window of about two years. Current records and other trading history do not all share that cutoff.
• Copies used to retry failed service actions have a configured 180-day retention period.
• Database backups normally rotate after 30 days. A last good local backup can be kept longer if newer backups fail, and offsite cleanup waits for a successful backup run. A deletion from a live system is not immediate removal from every backup.

Cookie and token expiry limits their use for authentication; it is not a promise that the corresponding database record has already been erased. Contact us to discuss the records and retention relevant to your account.

Your rights and requests

Depending on the information and lawful basis, you can ask for access to your personal information, correction of inaccurate information, deletion, restriction of use, or a portable copy of information you provided under a contract or consent. These rights have limits; for example, a request may involve other people's information or records we are legally required to retain.

Email privacy@goldmine.to with your request. Include enough information to find the relevant account or workspace. We may need proportionate checks to confirm your identity. Requests are normally free, and the usual legal response period is one month. If a permitted extension or exception applies, we will explain it. We handle privacy requests individually and will explain any information we need to keep.

You can object to use based on legitimate interests

You have the right to object to processing based on legitimate interests for reasons relating to your situation. Tell us what use you object to at privacy@goldmine.to; we will assess whether we must stop that use. Where processing relies on your consent, you can withdraw it without affecting the lawfulness of earlier processing.

Complaints and policy updates

You can raise a privacy complaint with us at privacy@goldmine.to. You can also complain to the UK Information Commissioner's Office through the ICO's complaint service, or call 0303 123 1113. You do not have to contact us first. If another data protection authority has jurisdiction where you live or work, you can contact it too.

Changes to this policy appear on this page with an updated date.