Privacy policy
Last updated: 28 October 2026.
Spire Coach is an unofficial companion for Slay the Spire 2, made by r33hab, Norway ("we", "us"). We are the controller of the personal data described here. Contact: [email protected].
What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Your Steam id, when you sign in with Steam | To know which runs and access are yours | Contract (Art. 6(1)(b)) |
| Your email address, if you join the beta waitlist | To confirm your signup and tell you when your access is ready | Consent (Art. 6(1)(a)) |
| Run files the desktop app uploads | To show your run reviews and insights | Contract (Art. 6(1)(b)) |
| If you use the in-game mod: the moves you make in each fight of an uploaded run (cards played and their targets, potions, choices, what you saw at the start of each turn) | To review your fights turn by turn | Contract (Art. 6(1)(b)) |
| The same runs, if you turn on "Contribute runs to training" | To train the coach's models | Consent (Art. 6(1)(a)) |
| Sign-in sessions and install tokens (stored only as one-way hashes) | To keep you signed in and link the app to your account | Contract (Art. 6(1)(b)) |
| For each app you link: platform, app version, an optional device name, when it was linked and last seen | So you can see and remove the devices linked to your account | Contract (Art. 6(1)(b)) |
| Your IP address, briefly, in memory | To limit abuse (rate limits) | Legitimate interests (Art. 6(1)(f)) |
Before a run file leaves your computer, the desktop app replaces every player's Steam id in it with a seat number (1 to 4). Your co-op partners' Steam ids are never sent to us. Run files do not contain your name.
We do not sell data, show ads, or use third-party tracking.
Who else handles it
- Steam (Valve) handles sign-in. We receive only your Steam id.
- Our hosting provider, Railway (Railway Corporation, USA), runs the service and stores the database in its EU West region (Amsterdam, Netherlands). Railway's own operations are mainly in the US; any transfer there is covered by the EU Standard Contractual Clauses in Railway's data processing agreement.
- Our email provider, Mailjet (Mailjet SAS, France, part of Sinch), sends waitlist and invite emails. It stores data in the EU.
Who can see your runs
Your runs are private. Only you see them, unless you share a run: then anyone with its link can see that run, without your Steam id.
How long we keep it
- Account, runs and settings: until you delete your account.
- Unconfirmed waitlist emails: 7 days. Confirmed ones: until you leave the list or claim your invite.
- Sign-in sessions: 30 days after you last used them.
- When you delete a run you had shared, we keep a one-way fingerprint of it (not the run itself), so copies of it cannot be uploaded again. This protects your erasure.
- Backups: we keep none at the moment, so deleting your account or a run removes it from the database straight away.
Cookies and storage
The website stores only what it needs to sign you in and to show the homepage, and nothing to track you:
| Name | What for | How long |
|---|---|---|
sc_login (cookie) | Ties a Steam sign-in to the browser that started it, so nobody can sign you in to their account | 10 minutes |
sc_session (cookie) | Keeps you signed in | 30 days after you last used it |
spire:intro-seen, spire:scroll (this tab's session storage) | Skips the homepage intro when you come back, and returns you to where you were | Until you close the tab |
These are needed for what you ask the site to do, so they need no consent. There are no analytics, advertising or third-party cookies, and the website loads no scripts, fonts or images from other sites.
Training
If you opt in, your eligible runs (finished solo runs without mods or debug changes) help train the coach. You can turn it off at any time in the app; from then on your runs are not used for new training. Models already trained hold statistical patterns, not your runs.
Your rights
You can see, correct, export or delete your data, withdraw consent at any time, and object to processing based on legitimate interests. Delete everything yourself in the desktop app (Settings, "Delete all my data") or on the website (Account), or email us. You can also complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).
Age
Spire Coach is not meant for children under 13, the minimum age for a Steam account.
Changes
If this policy changes in a way that matters, we will say so on the website and, for waitlist or account holders, by email.