Your data on this site
This page says in plain words what the RVR3 site does with data today. If the site starts working differently, this text will change.
- The site never sees your Steam passwordYou enter it only on the Steam website.
- No advertising cookiesOnly technical ones, and only when you sign in.
- No IP address or browser data keptThe database holds sign-in sessions and shop requests.
- Sign out everywhere with one button“Sign out everywhere” erases all your sessions.
Sign-in through Steam
When you press “Sign in through Steam”, you go to the Steam website and sign in there. You enter your Steam password only on Steam; this site never sees it. Steam sends back only the number of your Steam account (SteamID), which the site writes to its database together with your sign-in session (see below). The Steam icon on the sign-in button is part of the site’s page: nothing is loaded from Steam servers for it.
Steam name and avatar
After you sign in, the site asks Steam for your name and avatar by your account number and shows them in the page header. The site does not write them to disk or to a database: Steam’s answer is held temporarily in the memory of the site’s server only. It counts as fresh for 5 minutes (1 minute if Steam did not answer), after which Steam is asked again. If the name cannot be obtained, the header shows your Steam number. Your browser loads the avatar picture directly from Steam servers.
Cookies and browser storage
The site sets only technical cookies, and only when you sign in. There are no advertising cookies.
| Record | What for | How long |
|---|---|---|
__Host-rvr3_loginCookie | Sign-in mark: checks that Steam’s answer belongs to your sign-in | 10 minutes, erased once you are signed in |
__Host-rvr3_sessionCookie | Sign-in session: only a random number, no Steam number; page scripts cannot read it | 30 days, extended no more than once a day |
| LanguagelocalStorage | The language picked in the language switcher | Appears when you pick a language |
rvr3:seenlocalStorage | You have already seen the first screen of the home page: next time it opens at the news | Appears when you leave the first screen, after 20 seconds on the home page or as soon as the home page sees that you are signed in through Steam |
| ReloadsessionStorage | A mark of an automatic reload after the site was updated | Until you close the tab; only if a file failed to load |
rvr3:accountlocalStorage | The sign-in state of the header from the last check: Steam number, nickname and avatar link, or “not signed in”; the next page shows it at once and the header does not jump | Appears when a page checks the sign-in; rewritten on every check; after signing out only “not signed in” stays |
The “Sign out” button erases the cookie in your browser and deletes this session on the server: a copy of the cookie, if it was stolen, stops working. The “Sign out everywhere” button deletes all your sessions on the server — on all devices and in all browsers.
Besides cookies, the browser keeps four technical records: the language you picked in the language switcher (localStorage, appears when you pick a language), a mark that you have already seen the first screen of the home page (localStorage, rvr3:seen; appears when you leave the first screen, after 20 seconds on the home page or as soon as the home page sees that you are signed in through Steam, so that next time the home page opens at the news) and a mark of an automatic page reload after the site was updated (sessionStorage, until you close the tab; appears only if a page failed to load one of its files). The fourth is the sign-in state for the header (localStorage, rvr3:account): your Steam number, nickname and avatar link from the last check, or a mark that you are not signed in, so that the header of the next page does not jump while the sign-in is checked again; after you sign out only the mark stays.
What the site’s database holds
The site has its own database — Cloudflare D1. It holds sign-in sessions and shop requests (about them, see below). A session record contains your Steam account number, a fingerprint of the session number (the number itself cannot be recovered from it), when the session was created, when it expires and when you last visited the site (to the day). The site does not store your IP address or browser data.
If you sign in to the RVR3 launcher, its sign-in gets the same session record marked “launcher”; the launcher keeps its key on your computer, and the database holds only a fingerprint of it. For the minute of signing in, the database also holds a one-time code: its fingerprint, your Steam account number and the launcher’s check value. After a minute the code no longer works; its record is deleted when the launcher exchanges it for a key, at the next launcher sign-in (yours or another player’s) or by “Sign out everywhere”. “Sign out everywhere” signs the launcher out too.
When you first sign in, the database records your account: your Steam account number, when it appeared and whether you are hidden from the ranking. The RVR3 player registry (KOTLOVAN) reads this list to know whose game data to send. The registry sends the site your game data: your in-game nickname, play time and totals by server, your current character and your latest visits; the database keeps one record per player and replaces it with each update. It also keeps the ranking the registry computed: nicknames, Steam account numbers and values of the top players. Your game data is shown only to you, in your profile and in the launcher; other players see only your row in the ranking, unless you are hidden.
On your profile page you see your own sessions (dates only) and your own shop requests: the site shows them only to you, by your sign-in session, and does not show them to other players. Your Steam name and avatar there are taken from Steam the same way as for the page header.
A session record is deleted when you sign out. A session whose time is up no longer works, and its record is erased at the next sign-in on the site — yours or another player’s. To recover from failures, Cloudflare keeps past states of the database (Time Travel): 7 days on the free Cloudflare plan, 30 days on a paid one. A deleted record disappears from there too within that time at the latest.
The “Sign out everywhere” button deletes all your sessions at once; it does not delete shop requests (below). You can also ask for your data to be deleted on our Discord server (below).
Shop requests
There is no payment on the site: in the shop you leave a request instead. When you send one, the site writes it to its database: your Steam account number, the item and quantity, the server you chose, the price, currency and name of the item at that moment, when the request was left, the request number and marks of whether it has reached Discord. The site does not see card or bank details.
A copy of the request with your Steam number goes to a hidden admin channel on our Discord server. The admins see it there; they take care of payment and delivery themselves.
How long requests are kept has not been decided yet. “Sign out everywhere” does not delete them; you can ask for them to be deleted on our Discord server (below).
People from Discord on the home page
The home page shows who is online on the RVR3 Discord server right now and how many people are online: nicknames, statuses and avatars from the server’s public Discord widget. These are public community data. The site’s server takes them from Discord, keeps them for a minute (avatars for a day) and writes them nowhere else: neither to logs nor to the database. Your browser does not connect to Discord: the avatars are served by the site itself.
Where the site runs
The site runs on Cloudflare: its pages, the sign-in and the site’s database are at Cloudflare, so your requests pass through its servers, as with any site there.
Questions about data
You can ask questions about data on our Discord server.