hubmix holds an email address, a phone number, IP addresses, device records and keyed hashes of hardware identifiers, because competitive matchmaking without them is a game of who can make accounts fastest. This page lists what is collected, where each item comes from, why it exists, how long it stays and who else ever sees it — item by item, from the database itself.
Engineering draft
This document was written by the hubmix engineering team by reading the platform itself, so that what it describes is what the code actually does. It has not been reviewed by a lawyer yet. That review happens before hubmix leaves beta, and this notice will change when it has.
You sign in with Steam, so Steam is where your identity on hubmix begins. We read your public profile through Valve’s own API.
Your SteamID64 — the permanent numeric id of your Steam account — is the anchor of your hubmix account and cannot be detached from it. Alongside it we cache your persona name, profile URL, avatar and avatar hash, so the platform can show you without calling Steam on every page view.
Your avatar is not uploaded to hubmix. It is the one on your Steam profile and it follows whatever you set there.
We also read and store the parts of your Steam profile that say how old and how real the account is: when it was created, whether the profile is public, your recorded Counter-Strike hours, whether the account is limited, and Valve’s own ban record — VAC bans and their count, game bans, community and trade bans, and how long ago the last one was.
This is used for one thing: telling a new player apart from a banned player’s fourth account. It is never shown to other players.
When you load into a hubmix match server, Steam is asked whether the copy of Counter-Strike being played is the account’s own or borrowed through Family Sharing. We store the answer, when it was taken, and the match that produced it.
If the copy is borrowed we also store the SteamID64 of the account that owns it. That is deliberately the strongest ban-evasion signal available about an account, and it is kept for exactly that.
Everything in this section you typed in yourself, and every item is required by something specific.
A verified email address is required to finish onboarding — it is how an appeal, an account notice or a security alert reaches you. A phone number in international format is captured in the same step and verified by SMS code.
Both are unique across all accounts. That uniqueness is the point: it is the cheapest honest brake on one person running six accounts, and it is the reason we ask for a phone number at all rather than for marketing, which hubmix does not do.
Your nickname is stored permanently and publicly — it is your name on every scoreboard, leaderboard and forum post. Your TeamSpeak3 unique identifier, which is a public value your own client generates, is bound to your account so the queue can check you are actually connected to voice.
If you enable app-based two-factor, the shared secret is stored encrypted with AES-256-GCM and your recovery codes are stored only as hashes — a code that has been used cannot be used again, and a leak of the table would not let anyone generate your codes.
Forum threads and posts, direct messages to friends, clan names and descriptions, and the text of any report you file. Direct messages are stored as plain text and are readable by staff during a moderation case — they are not end-to-end encrypted and nothing on this platform claims they are.
What you type in the game itself is not sent to hubmix as chat, but it is inside the match recording, which means a reviewer investigating that match can read it.
Collected automatically on every request, and used for keeping your session yours.
Each sign-in creates a session record holding the IP address and browser user agent it started from, plus a hash of the refresh token — never the token itself. Sessions rotate, and a rotated token being replayed invalidates the whole family, which is how a stolen session is caught.
Each browser you use is recorded as a device: a server-issued identifier stored in a cookie, the first and last IP address it was seen from, and the operating system, browser and platform read out of its user agent.
A fingerprint of your browser is computed as a corroborating risk signal. What is stored is a keyed HMAC of it, never the fingerprint itself — so the value cannot be recovered or brute-forced back out of the table if it leaked, even for a small input space like an IPv4 address.
A fingerprint is explicitly not identity here. Your device is identified by the server-issued cookie; the fingerprint only corroborates it, because fingerprints can be spoofed and treating one as proof would be a security bug rather than a privacy feature.
Every sign-in attempt — successful or not — is appended to a login history: the method, the outcome, the IP address, the user agent, the device it came from, and a short reason when it failed. That is the whole record; hubmix does not look your IP address up in a geolocation service, so no city or country is derived from it.
This exists so that you can see your own active sessions and so that a compromised account can be reconstructed after the fact.
The anti-cheat client has not shipped, so nothing described here is running on anyone’s machine today. This is what it will send back when it does, and this page is updated before it ships if any of it changes.
Each install generates its own signing keypair on your machine. The private half never leaves the device and hubmix stores only the public half, so nothing in our database could be used to forge a report from your machine.
Alongside it we store the agent version, the build fingerprint of the binary, your operating system and architecture, a monotonic counter that makes a replayed heartbeat detectable, and when it was last seen.
The server side of this is built and live; the client that would enrol against it is not published yet.
The agent reports a stable hardware identifier for your machine. It is hashed with a server-held key before storage; the raw value is never written down. Two accounts presenting the same hash are linked to each other for a reviewer to look at, which is the whole reason it is collected.
The same treatment applies to every other cross-account identifier: device ids, IP addresses, TeamSpeak identities and Steam lender ids in the ban-evasion graph are all stored as keyed hashes and never as values.
The client is designed to look at the Counter-Strike process and the modules loaded into it, from user space, and to report what it finds about that process. It is not a kernel driver.
It is not a general file scanner, it will not read your documents, and it will not touch your microphone or camera. What the platform is trying to detect is the effect of a cheat inside the game, not an inventory of your computer.
Nothing on this platform accepts a scan result today: there is no endpoint that takes a process description or a module list, so none has ever been sent or stored. When the client ships, the exact contents of a report will be written here before it collects anything.
Described in advance on purpose — a disclosure written after the fact is not a disclosure.
Playing a match creates a permanent public record and a temporary private one.
For every match: your team, the result, kills, assists, deaths, damage, rounds played, clutches, entry kills, and your rating before, after and the difference. This is public — it is what a profile, a leaderboard and a match page are made of.
The game server computes a small set of aggregates per player per match and sends them over a signed channel: rounds, shots fired, shots that hit, hits on an enemy the shooter could not see, how many first-shot engagements were measured and how many of those were faster than a human reaction.
These are bounded aggregates, not a recording of your inputs. hubmix does not parse demos on the backend and does not log your mouse movement.
Every match is recorded as an HLTV demo and archived with a checksum, so the file a case is decided on is provably the file the server produced. How long the file lives is decided by the highest premium tier present in that match — one Ultra player keeps that match’s demo for a year, for everyone who was in it.
How long you can reach a demo is a different clock, set by your own tier. A demo referenced by evidence on an open integrity case is never deleted, whatever the retention clock says.
What happens when the platform, or another player, has a concern about an account.
Detectors, player reports and the anti-cheat all produce graded signals about a player, and signals accumulate into a case. Each case carries an append-only, hash-chained event stream: every note, escalation, assignment and decision, in order, tamper-evident.
That structure exists so a reviewer can be held to what they actually saw, and so that a decision taken about you can be reconstructed and, if wrong, reversed.
Accounts that present the same hashed hardware id, device, IP address, TeamSpeak identity or Steam lender are linked to one another. When one of them is banned, the others are flagged for a human.
A shared IP address is treated as weak evidence and a shared machine as strong, but no link on its own ever bans anything. Families share computers and cafés share addresses, and only a person can weigh that.
Every security-relevant action, including every staff action taken about your account, is written to an append-only, hash-chained audit log with the actor, the action, the resource, the IP and the user agent. The application can insert into it and cannot update or delete from it.
Stated as flatly as the rest, because a privacy page that only lists collections tells you half the truth.
There is no advertising network, no analytics product, no tracking pixel and no session recorder on this site. Your data is not sold, rented or shared for marketing, and there is no marketing.
This is enforced rather than promised: the site ships a Content-Security-Policy that permits scripts, styles, images, fonts and connections from hubmix’s own origins only. Fonts are served from our servers, not from a font provider. A third-party tracker could not load here even if someone added one by mistake.
hubmix processes no payments. Premium tiers are bought with in-app Coins that are earned by playing. No card number, bank detail or billing address is ever asked for, sent or stored, and the browser is instructed to refuse payment APIs outright.
Hardware identifiers and fingerprints are stored only as keyed hashes. Refresh tokens, verification tokens and recovery codes are stored only as hashes. Two-factor secrets and any third-party access tokens are stored encrypted. None of these is ever logged in plaintext.
The real clocks, as the system runs them.
Some of these are short by design and some are permanent by necessity. A ledger you can delete from is not a ledger, and an audit log you can edit proves nothing, so those two are append-only for as long as the platform exists.
A closed account is marked closed and cannot sign in. The row survives as a tombstone with its personal fields emptied, because deleting it outright would break things that must not break: the scoreboards of the matches you played in, the ledger entries of other people’s Coins, the audit chain, and any Trust & Safety case that names the account.
We would rather tell you that plainly than describe an erasure that leaves ten other players’ match history inconsistent.
hubmix operates into Romania, so the EU data-protection rights apply. Here is the honest state of the tooling behind them.
A copy of what we hold about you. A correction of anything wrong. The closure of your account and the erasure of what can be erased. An explanation of a decision taken about your account. An objection to a specific use of your data.
Two of them you do yourself, in Settings under "Your data". The export builds a copy of everything we hold about you as one file, on demand, and tells you which categories it withholds and why. Deleting your account starts there too: a single-use link to your verified email address, then a 14-day wait in which the account works normally and one click stops it. That page states, before you confirm anything, what deletion removes and what it does not.
Corrections, explanations of a decision, and objections to a particular use are handled by a person. Write to support@hubmix.net from the email address on your account; we confirm receipt and answer within one month.
Some things cannot be erased on request: the append-only Coin and premium ledgers, the hash-chained audit trail, Trust & Safety records — and, while your account is banned, suspended, cooling down or the subject of an open case, the record that keeps that enforcement enforceable.
If you are not satisfied with how we handled a request, you can complain to your national data-protection authority. In Romania that is the ANSPDCP.
How this page changes, and who reads the replies.
This page changes when the platform changes. Its version and date are at the top, and a change that widens what is collected is announced in-platform rather than edited in quietly.
Everything on this page — a question, a correction, a request, a complaint — goes to support@hubmix.net.
One more thing
Anything on this page can be questioned, and it should be. Write to support@hubmix.net and we will answer with what the system actually holds about your account.