You can read the site, use the tracker, and submit Run Scores without an account. SteamHardware.io does not run newsletters, preorder alerts, notify-me forms, site-run waitlists, gated downloads, affiliate tracking, or advertising profiles. An optional Steam connection is available only for the private Steam Machine and Steam Deck library workspace; the normal one-game contribution flow remains available without it.

What we collect

SteamHardware.io may process:

• Basic request data needed to load and protect the site, plus aggregate analytics when analytics are enabled.
• Tracker submissions such as product, model or SKU, country, state or region, milestone dates, reservation timing, and product-specific outcomes.
• Run Scores submissions containing a Steam App ID, a selected device or Steam Frame context, an anchored 1–5 score, and optional structured performance, compatibility, stream, runtime, network, issue, or settings fields. Steam Machine and Steam Deck remain separate cohorts. Historical scoreless Frame observations can remain readable, but new Frame reports and revisions need a score.
• Public game-catalog metadata used to find games and publish results, and reviewed external evidence used for sourced Run Scores. Exact source links for reviewed Community observations stay server-side and are not published with the observation.
• Random public report IDs, a server-generated anonymous Run Scores contributor ID, and keyed hashes of browser secrets and private tokens. Raw private token values are not stored.
• If you choose the Steam library workspace, the SteamID64 returned by Steam, a private identity-to-contributor link, keyed hashes of account-session and one-time sign-in secrets, and connection, expiry, merge, and revocation timestamps. We request owned games only after you choose Load library or Reload library. The response is reduced to App IDs, names, and a yes-or-no value indicating whether Steam returned a last-played time within the previous two weeks. The server uses the App IDs to keep only owned games that the Run Scores database currently marks as rateable. It also derives transient counts for all games Steam returned, the rateable intersection, and the recent-rateable subset so the workspace can explain filtering and empty states. The raw last-played time and every playtime value are discarded. We do not store the library, any of those counts, the recent-play value, profile name, avatar, selection, or a library draft. Only reports you publish are stored.
• Browser shortcuts and preferences, email sent directly to us, and short-lived hashes used to limit spam and automated abuse.

Steam Frame has no Steam login, cross-game identity, free-text field, hardware fingerprint, or screenshot upload. Frame counts are submitted reports, not verified unique players. Its optional foveated-rendering value describes that dated VR run only. Steam Deck display context records only confirmed `external`; a missing value means it was not provided, not that built-in use was confirmed. Steam Machine does not accept a display-context value.

What not to submit

The tracker, Steam Frame, and ordinary one-game Run Scores flow do not ask for Steam credentials, Steam IDs, usernames, email addresses, order or reservation numbers, tracking numbers, street addresses, ZIP codes, screenshots, documents, account handles, payment data, or government identifiers. The optional library workspace receives a SteamID64 from Steam after sign-in; do not type or send it to us yourself. Steam sign-in happens on Steam's site. SteamHardware.io never asks for or receives your Steam password, cookies, or credentials.

Do not include those details in reports, tracker issues, or source tips. If an email contains unnecessary personal information, we may delete, ignore, or redact it.

Run Scores contribution terms

Submit only a good-faith observation that you made or are authorized to provide. Do not submit false, manipulated, duplicate, or automated reports to distort the results.

You retain any rights you have in a contribution. You give SteamHardware.io a non-exclusive, worldwide, royalty-free permission to store, publish, display, format, summarize, and aggregate the structured report to operate, explain, preserve, and improve Run Scores. We may accept, reject, moderate, limit, or remove a contribution to protect the service and keep the results useful.

Run Scores combine anonymous community reports, reviewed Community observations, and cited external performance evidence. Community observations do not create a contributor, report owner, private link, or My Reports entry. Their source URLs remain private. Sourced evidence is separate from reader contributions and may remain in internal audit history after withdrawal or public-policy exclusion. An included sourced row may appear in public Activity; an excluded row does not. The combined score is not a controlled benchmark, performance guarantee, official Valve decision, or purchasing advice.

A report created through the Steam library workspace is an ordinary community report. Connecting Steam does not verify a performance claim, prove hardware ownership, add a public badge, or give the report extra aggregate weight.

The Steam library feature remains off until a current Steam Web API Terms review confirms the actual countries where Steam-linked data is stored for this policy, reviews public terms substantially equivalent to the API Terms' Sections 7 and 8, and reconciles the Section 3 brand and link requirements with the site's own brand rules. This policy does not guess those operational facts or substitute draft legal language for that review.

How we use information

SteamHardware.io uses limited information to:

• Publish pages and keep the site available.
• Build aggregate tracker and Run Score summaries.
• Let readers reopen or update their own reports through private links.
• Let a connected reader choose owned games and reopen Machine or Deck reports across browsers.
• Prevent spam, abuse, and automated flooding.
• Understand which pages and features are useful.
• Respond to email, corrections, source tips, and tracker issues.

Private report links

Public tracker summaries may show counts, queue movement, shipping times, confidence, and recent milestones. Each report has a random public ID and a private update link. The server stores a hash of the update token, not the token itself. Anyone with the full link may be able to edit the report, so keep it private. Lost tracker links cannot be recovered because there is no account to verify ownership.

Run Scores use a protected browser cookie containing a random secret. The server stores only a keyed hash. A first authorized save can create one private My Reports link for the collection at `/game-settings/my-reports/#collection=...`; anyone with the full link can view, edit, or delete the reports it covers, so keep it private. The link does not create an account and cannot be recovered if lost.

An optional anonymous public profile link shows current accepted, non-deleted reports in a read-only view. It exposes no name, account, contributor ID, private link, or edit token, and it is not indexed or placed in the sitemap. The owner can replace or revoke it, which turns off the old URL. Older report-specific links remain limited to the report they were issued for. Browser access expires after 30 days without use; private links remain until they are revoked, rotated, or the report is deleted.

The optional Steam connection uses a separate protected browser-session cookie with a keyed server-side hash and a short-lived sign-in-state cookie. The browser sees only `Steam connected`, never the SteamID64 or Steam profile. Signing out revokes only that browser session. Disconnecting requires a fresh confirmation on Steam, removes the stored Steam identity and every Steam account session, and leaves the reports anonymous and available through newly rotated browser access and any still-valid private report or collection links. Completing a contributor merge invalidates the collection and public-profile links held by both pre-merge contributors. The connected account can mint a new collection link afterward, so neither old bearer link gains access to the combined report set.

Game reports are not linked to hardware tracker reports. The site does not infer that two records belong to the same person from browser storage, network data, dates, locations, or matching fields.

Local browser storage

Tracker shortcuts and preferences stay in the browser where they were saved. Clearing browser storage can remove a saved shortcut or private update link. Run Scores keeps its contributor secret in the protected cookie rather than local or session storage. A bounded weekly entry experiment may save only a category, a generic device, an opaque game slot, a week marker, and bounded entry markers. It does not save a game name, report ID, search query, or private value.

Steam library counts, selection, the derived two-week activity value, filters, headline drafts, bulk changes, and the review batch stay in page memory. Connecting Steam or changing device does not load owned games automatically. Reloading, changing device, or leaving the workspace discards the transient response and working batch. The server returns the library response with `no-store` and persists only a successfully published atomic report batch.

Analytics and abuse prevention

When enabled on the canonical production site, SteamHardware.io uses Umami for aggregate analytics. Automatic tracking is disabled. URL queries and fragments are removed. A referring HTTP or HTTPS URL, when available, is reduced to its scheme and hostname before delivery; its path, query, fragment, credentials, and port are not sent. Site-authored events use allowlisted page and action values. A public Game Settings page view may include its canonical public game slug and device. Events may otherwise include broad device or browser categories, coarse location, and basic actions, but not game names, report IDs, contributor IDs, private links or tokens, scores, settings, issue details, or free text. Analytics events also exclude Steam IDs, Steam account/session IDs, owned-game lists, library selections, and library search text. Tracker events use broad categories rather than report or account details. Referrer values are optional and spoofable, so they are used only for aggregate attribution and never as an access-control or abuse signal.

Requests are rate-limited to reduce spam and automated abuse. This can use a short-lived purpose-specific hash made from request information, including IP-related forwarding headers. It is used for throttling, not to follow readers across editorial pages. SteamHardware.io does not sell personal information or use analytics for advertising, affiliate attribution, sale tracking, personalized content, or user accounts.

Email and service providers

If you email us, we use the message for the reason you sent it. We do not add correspondents to a newsletter, use email as a tracker identifier, require it for downloads, or build an advertising audience from it.

SteamHardware.io uses service providers for hosting, database storage, analytics, static assets, DNS, security, and email delivery. If you use the optional connection, Steam provides sign-in and the owned-games response. Those providers may process the technical data needed to provide their services.

Retention and privacy requests

Published pages, source lists, public tracker summaries, and aggregate Run Score results may remain available while they are useful. Active reports may be kept for queue, shipping, and Run Score summaries unless removed from public use.

Imported external research may remain in immutable audit history after withdrawal, supersession, or public-policy exclusion. A source author or publisher may email us to request a correction, public-removal review, or erasure assessment. A Run Scores delete action removes a report from public pages and aggregates by marking it deleted. The underlying row, access hashes, and moderation metadata may remain, and the service does not promise a fixed automatic erasure date.

One-time Steam sign-in attempts expire after 10 minutes. Active Steam account sessions expire after 30 days without use. Disconnecting deletes the Steam identity and its sessions; private merge audit counts and existing report rows may remain. Disconnecting does not delete reports, because they remain ordinary anonymous contributions. Use their private controls or the request process below to update or remove them.

Use a private update link for ordinary corrections. For privacy, removal, or erasure requests, email admin@steamhardware.io with a public report ID and enough context to identify it. Do not send a private link, token, or unnecessary personal information. SteamHardware.io is a U.S.-based independent publication, and the same address can be used for privacy-rights questions.

Source-backed settings recipes

Source-backed settings recipes are operator-reviewed external research, not reader profile fields. A recipe may show a bounded game build, Proton version, source publication date, measured FPS, render scale, frame-generation state, named graphics settings, an explicit `high`, `medium`, or `limited` confidence label, and the public source link. Internal research IDs, batches, hashes, policy records, and reviewer data are not public.

Contact

For privacy, corrections, source tips, and tracker issues, email admin@steamhardware.io.