HLSR privacy policy
1. Who we are
HLSR is an independent free launcher for Windows and Linux. It installs, checks, updates and launches supported game builds. Contact: contact@hlsr.pro.
2. Where this policy applies
This page covers hlsr.pro, the HLSR launcher and its requests to api.hlsr.pro. The main website has no advertising trackers. Steam sign-in uses a necessary cookie to bind the Steam response to your browser; it expires within 15 minutes. You enter your Steam password on Valve's website. HLSR does not receive it.
Signing in to HLSR is optional. Without it, the launcher uses a local profile: games are installed, updated and launched as usual, while your profile, play time and achievements stay on your computer and are not sent to the server. Steam sign-in is available only after you confirm that you have read this policy and accept the terms of use.
3. Data used
- Steam ID, to verify account ownership and link your profile;
- Steam display name and avatar, to show profiles and friends;
- friends, to show your Steam friends and find those already in HLSR; a permanent server copy of the list is not kept;
- your first verified HLSR sign-in, play time, recent launches and badges;
- status, pronouns, country and links that you choose to add;
- a verified speedrun.com account link and your selected published record;
- unlocked achievements, reactions to feed posts and the "Hide SteamID" setting;
- moderation decisions about your profile: type, reason, duration and time (section 7).
Profiles do not require your Steam password, Steam email address, payment details or your entire game library. Friends use available Steam Web API data or the local Steam client. A private friend list may be unavailable through the Web API.
4. Optional technical statistics
Technical statistics are off by default: none are collected with a local profile. They are turned on together with Steam sign-in, when you accept this policy, and turned off when you sign out of HLSR. Events include a random installation identifier, a session identifier, launcher starts, game installation, downloads, updates and repairs, safe error codes, launcher version and language. Files, full paths, passwords and crash dump contents are not sent automatically.
These are pseudonymous technical statistics, not a promise of complete anonymity. Steam ID is not included in these packets. The random installation identifier is not derived from Steam ID, computer name or a hardware fingerprint.
5. What is not tracked today
HLSR does not record keystrokes, your screen or private messages. The technical game contract for maps, chapters, speedruns, restarts and in-game personal bests is not connected yet. Profiles use separate game sessions to measure play time. HLSR cannot verify the accuracy of an old local statistics file.
6. Your Steam profile in the launcher
Sign-in opens in your browser and is verified through Steam. The server creates a profile linked to your Steam ID. Its join date is the first verified HLSR sign-in, rather than the old local installation date.
After an update, old statistics migrate in the background once you sign in to the corresponding account. They are shown as history from before the update. New time is calculated by the server from when active game-session requests arrive. A client-supplied total does not overwrite this counter. Disconnected time remains local history and is not added to verified hours.
Your name, Steam ID, badges, play time, status, pronouns, chosen country, social links and pinned record can be viewed by other signed-in HLSR users. Profiles can be searched by name or Steam ID. If you turn on "Hide SteamID", other users do not see it in your profile or in search results. Technically it is still sent to a signed-in user's launcher, because it is used to open the profile. Feed posts show their author's name, avatar and a link to the author's HLSR profile.
To verify speedrun.com, you enter your API key once. It is used to request your speedrun.com profile and is not saved by HLSR. HLSR keeps the verified account identifier and the chosen verified record for a supported game. You can revoke the key on speedrun.com.
7. Moderation
Profiles must follow the terms of use. HLSR administrators can suspend an account temporarily or permanently, stop it from changing its status, reset its status, temporarily show its Steam ID64 instead of its name, and show the default Steam avatar instead of its avatar. A hidden name or avatar is restored when you change it in Steam.
Each decision records its type, reason and duration, and you receive a notification in the launcher. A suspended profile is hidden from other users. Until the suspension ends, play time is not counted and online features are unavailable; you can still see the reason and duration, sign out and delete the profile. Installing and launching games keeps working.
Decisions are recorded in a moderation log: type, reason, duration, time, which administrator made the decision and who lifted it. The Steam ID in the log is encrypted. The log is not deleted with the profile, so that a suspension cannot be lifted by deleting the account. To dispute a decision, write to contact@hlsr.pro.
8. Why data is used
Profile data enables synchronization across devices, friends, search, badges and play time. Online counts are published as aggregate active game-session counts without player lists. Optional technical statistics help identify errors and improve installations and updates. We do not sell these data or use them for advertising.
9. How to turn statistics off
Sign out of HLSR in profile settings. No new technical events are created or sent, and the local event queue is deleted. The launcher switches to a local profile, and installing, updating and launching games keep working.
While you are signed in, online-profile features synchronize profiles, friends and game sessions. With or without sign-in, the news feed is downloaded from api.hlsr.pro and updates from hlsr.pro and GitHub, and the launcher may fetch the public playing-now count once a minute. Use of Steam, speedrun.com and Discord is also governed by those services' policies.
10. IP address and diagnostics
Your IP address is technically processed for internet connections, request-rate limits and server protection. It is not added to technical-statistics packets as your user identifier. Diagnostic ZIP archives and crash dumps are created when you request them and are not sent automatically. Discord Rich Presence can be disabled in settings; it does not include Steam ID or file paths.
11. Storage and deletion
You can schedule deletion in profile settings. Confirmation requires agreeing to the terms and waiting 20 seconds. You can keep signing in for 7 days after the request. Signing in does not cancel deletion; a separate cancel button is available before the deadline.
After 7 days, your profile, statistics, customization, account links and badges are deleted. Device tokens stop working. The next sign-in creates a fresh profile, and old history already migrated on this device is not imported again. Installed games and Steam files on your computer are not removed. The moderation log is kept (section 7).
Raw technical events are kept for a limited time, after which aggregated figures remain. Previously collected pseudonymous technical statistics are not linked to your Steam profile and do not become personal history on a new sign-in. Data questions: contact@hlsr.pro.
12. Security and changes
Data travels over HTTPS. HLSR does not handle Steam passwords. Steam ID and customization fields are encrypted in the database, with keys stored separately. Device secrets are stored as hashes, and profile changes require verified sign-in. Display name remains a searchable field. Saved sign-in uses the operating system's protected storage; where it is unavailable, the session lasts only until the launcher closes.
This page is updated when the data used changes. The current version is at hlsr.pro/privacy/.