Beast Market

Beast Market Privacy Policy

Last updated: 2026-07-16

Policy version: 2026-07-16.1

This English translation is provided for reference only. The Japanese version is the authoritative text. In case of any discrepancy, the Japanese version prevails.

ShiningStar Inc. (the "Operator"; the Operator's address and the name of its representative will be provided without delay upon request to the contact at the end of this Policy) establishes this Privacy Policy (this "Policy") regarding the handling of user information in the game "Beast Market" and related services (including trial, demo, playtest, beta, and other experimental offerings ("Trial Versions"); collectively, the "Service").

1. Information We Collect

The Operator collects the following information in providing the Service:

  1. Steam account information: SteamID and verification results of owned content (DLC). In our database, your SteamID is stored only as an irreversible pseudonymous key (a keyed one-way hash); the raw SteamID itself is not stored. The Operator never collects your Steam display name (persona name), Steam password, payment information (such as credit card numbers), or — when Steam Family Sharing is used — the SteamID of the license owner (a third party).
  2. Game data: progress, holdings of in-game currency, items, and equipment, in-game market transaction history, and play logs (last-seen time, quest results, etc.).
  3. Consent records: the version and timestamp of your acceptance of the Terms of Service (retained as evidence of consent).
  4. Transiently processed information (not stored): IP address (used only momentarily for connection handling and abuse prevention), client version (used only to determine whether an update is required), and technical anti-cheat information (results of communication/client integrity checks, etc.). Our application does not store any of these. Where a measure is taken against a violation of the Terms of Service, only the determination and the measure taken are recorded against the account. Note that the infrastructure of the cloud providers relaying communications (hosting, CDN, etc.) may retain the connecting IP address in access logs for a short period as part of those providers' standard operation.
  5. Inquiry information: contact details and inquiry content when a user contacts the support desk.
  6. Steam Inventory / Community Market information (once the corresponding feature is rolled out): records of in-game items issued (exported) to the Steam Inventory and of listings/transactions of those items on the Community Market, obtained via Valve Corporation. The Operator never obtains your Steam Wallet balance or payment information.
  7. Deletion-suppression record: after completing an erasure request, the Operator retains only the keyed one-way-hash pseudonymous account key, completion timestamp, and a fixed reason code to prevent the deleted account from being unintentionally recreated through an old session or renewed authentication. No raw SteamID, game data, free-form text, or contact details are stored in this record.

The Service does not ask for your name, address, phone number, or payment information.

2. Purposes of Use

Collected information is used for the following purposes:

  1. Providing the Service and saving/synchronizing game data;
  2. Detecting, preventing, and responding to misconduct (cheating, RMT, market manipulation, etc.);
  3. Incident response, quality improvement, and statistical analysis for game-balance adjustment;
  4. Responding to violations of the Terms of Service, and implementing and recording account measures;
  5. Responding to inquiries and complaints;
  6. Compliance with laws and regulations.
  7. Preserving completion of an erasure request and preventing unintended recreation of a deleted account.

3. Provision to Third Parties

The Operator does not provide user information to third parties except:

  1. With the user's consent;
  2. Where required by law (including lawful requests from courts, police, etc.);
  3. Where necessary to protect a person's life, body, or property and it is difficult to obtain the person's consent.

4. Outsourcing and Overseas Storage

  1. The Operator outsources data storage and processing to cloud service providers (server hosting, database services, etc.) for the operation of the Service. Contractors are selected to meet the requirements of the Act on the Protection of Personal Information (APPI) and are appropriately supervised. The principal contractors are currently the Japan (Tokyo) regions of cloud services operated by U.S. corporations.
  2. For Steam account authentication and DLC ownership verification, your SteamID and authentication ticket are sent to the Steam Web API of Valve Corporation (U.S.). Valve Corporation's handling of information is governed by its own privacy policy.
  3. Collected information is stored, as a rule, on cloud servers located in Japan (Tokyo region). If storage is ever moved outside Japan, the Operator will, pursuant to Article 28 of the APPI, understand the personal-information protection regime of the relevant country, ensure through contracts with the contractor the implementation of measures equivalent to those under Japanese law, update this Policy, and provide information about such measures upon request.

5. Retention Periods

  1. Game data and account-linked information are retained during the period the Service is provided.
  2. Records of responses to misconduct and Terms-acceptance records are retained for as long as needed for enforcement and as evidence of consent.
  3. Trial Version game data is deleted within a reasonable period after the Trial Version ends, or processed into a form that cannot identify individuals for statistical purposes.
  4. Data that has been deleted or erased may remain in disaster-recovery backups for up to 30 days; it is purged as backup generations rotate and is not referenced in ordinary operations.
  5. A deletion-suppression record is retained only for the purpose in Section 2, item 7 while the Service is provided, and is deleted within 30 days after termination of the Service or when no longer needed for that purpose, whichever is earlier. It is not used for marketing, profiling, or in-game enforcement decisions.
  6. Upon termination of the Service, information is deleted within a reasonable period, except where retention is required by law.

6. Security Measures

The Operator takes the following measures to prevent leakage, loss, or damage of collected information and otherwise manage it safely:

  1. Organizational measures: appointment of a handling manager; monitoring and inspection of handling status;
  2. Personnel measures: training of persons handling data;
  3. Physical and technical measures: access control, privilege management, encryption of communications and stored data (TLS in transit and encryption at rest), pseudonymization of account identifiers (no raw SteamID stored; only a keyed one-way hash), and countermeasures against unauthorized access;
  4. Understanding of the external environment: should personal data ever be stored in a foreign country, implementation of security measures based on an understanding of that country's personal-information protection regime (currently, data is stored in Japan).

Details of security measures will be provided without delay upon request to the contact below.

7. Requests for Disclosure, etc. (User Rights)

  1. Users may request from the Operator, pursuant to the APPI: disclosure of retained personal data; correction, addition, or deletion; suspension of use or erasure; suspension of third-party provision; and disclosure of third-party provision records.
  2. Requests are accepted at the contact below. The Operator will verify the requester's identity by reasonable means, such as confirming ownership of the relevant Steam account, and respond without delay in accordance with law.
  3. No fee is charged for such requests.
  4. If deletion of game data is requested, continued use of the Service may become impossible.
  5. You may also request access to and object to the legitimate-interest processing of the deletion-suppression record. If that record is erased, the Operator may no longer be technically able to prevent a new game account from being created when the same Steam account authenticates again.

8. Additional Information for Users in the EEA and the United Kingdom

If you reside in the European Economic Area or the United Kingdom, the following additional information is provided under the GDPR and the UK GDPR:

  1. Controller: the Operator identified in Section 11 is the controller of your personal data.
  2. Legal bases for processing:
    • Providing the Service and saving game data (Section 2, item 1): performance of a contract (GDPR Art. 6(1)(b));
    • Detection and prevention of misconduct and security (Section 2, item 2): legitimate interests (Art. 6(1)(f) — preserving a fair game environment and the shared economy);
    • Retention of consent records (Section 1, item 3): compliance with legal obligations and legitimate interests (Art. 6(1)(c), (f));
    • Compliance with laws (Section 2, item 6): legal obligation (Art. 6(1)(c)).
    • Maintaining erasure status through the deletion-suppression record (Section 2, item 7): legitimate interests (Art. 6(1)(f) — continuing to respect the user's erasure choice and preventing unintended recreation through old sessions or re-authentication).
  3. Your rights: you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests, as well as the right to lodge a complaint with the supervisory authority of your place of residence. Requests are accepted at the contact in Section 7.
  4. Transfers to Japan: your data is processed in Japan, a country that has received an adequacy decision from both the European Commission and the UK Government.
  5. Retention: as set out in Section 5.
  6. Automated decision-making: no automated decision-making producing legal effects (including profiling) is carried out. Measures resulting from automated anti-cheat detection can be contested through the contact in Section 7.

9. Children's Information

The Service is intended for users who meet Steam's age requirements. If the Operator learns that it has collected personal information of a child under Steam's minimum age (which varies by country/region and is 13 or higher) without the consent of a legal guardian, it will delete such information promptly.

10. Changes to This Policy

The Operator may change this Policy as necessary. Material changes will be announced before they take effect, by display within the Service or other appropriate means.

11. Contact for Inquiries and Complaints

Inquiries, complaints, and requests for disclosure, etc. concerning this Policy and the handling of personal information are accepted at:

contact@beastmarket.monster

End of document