What leaves your machine

The one-paragraph answer

Compy Deadlock reads Deadlock replay files and shows you what is in them. On this website that reading happens inside your own browser tab; in the Windows app it happens inside a program running on your own PC. In neither case is a replay file, or anything derived from one, sent to us. We have no server that could receive it: this site is static files on a content host, and the Windows app's server runs on your own machine and listens only to itself.

Where your replays are read

• On this website. When you point the Replays tab at a folder, or drop a .dem file on it, your browser downloads a WebAssembly build of our replay reader from cdn.compydeadlock.com and runs it in a background worker in your own tab. The replay file is handed to that worker as a local file handle. It is read in slices out of your disk and never sent over the network. What the reader produces is written to your browser's own storage for this site and nowhere else.
• In the Windows app. The app runs a small service on your own PC that reads replays from your Deadlock install and writes its output under %LOCALAPPDATA%\DeadlockCoach\. That service listens on your machine only; the app's own screens are the only thing that talks to it.

That the website has no upload path is not a promise we are asking you to take on faith — it is checked automatically. A test in the repository walks the whole module graph the web build is compiled from and fails the build if any code that can reach one of our own write endpoints ever ends up in it. Every network call the website makes is a download, and every one of them is listed below.

What this website downloads, and from where

All of these are plain downloads of public files. None of them carries anything about you: no account id, no match id, no file name, no query string describing what you are looking at.

• compydeadlock.com (this site). The pages themselves, the hero roster, the item catalogue, the skill-tree data and the reference figures the comparisons are drawn against.
• cdn.compydeadlock.com (our storage bucket). The WebAssembly replay reader (large — tens of megabytes, downloaded once and cached by your browser), the database engine the comparison screens query, and the reference data those queries read: summary slices, and for some views a larger match-statistics file. These are aggregates over many players' matches. They contain nothing about you and are the same bytes for every visitor.
• Fonts, icons and the short looping clip above the fold are served from this site itself.

The third parties, named

deadlock-api.com — hero and rank art

Hero portraits and rank badges are not copied onto our servers; your browser loads them straight from assets-bucket.deadlock-api.com and api.deadlock-api.com, which are run by deadlock-api.com, a community project. This is a normal image request, so it carries no data about you in the URL — but it is a direct connection from your browser to someone else's server, which means that server can see your IP address, your browser's user-agent string and the fact that you were on a Compy Deadlock page. It cannot see your Steam account, your replays or anything you have parsed. The home page also opens that connection early, before the first image is requested, to make the hero grid load faster. We name this because it is the request a careful reader will find in their developer tools, and it should not be a surprise when they do.

YouTube — nothing until you click

The clip on the home page is our own video file served from this site, not an embed. Nothing is requested from YouTube until you actually click it; at that point the real player loads and the visit counts as an ordinary YouTube view, with whatever YouTube normally does. If you never click, your browser never contacts YouTube.

Our web host

This site is served by Cloudflare Pages. Like any web host, it handles the requests for the pages and files above and can see the ordinary things a web server sees — your IP address, the file requested, the time. We do not add analytics on top of that, and we do not build visitor profiles from it.

Does a Steam ID ever leave your machine?

On this website: no.

The website asks you to confirm which player in your own replays is you. That number is stored in your browser's local storage for this site and is used to pick your rows out of replays you have already parsed. It is not sent to us, it is not sent to anyone else, and there is no request anywhere in the web build that carries it. An earlier version of this feature did look your account up over the network; that lookup was removed and the code that made it is gone.

In the Windows app: yes, to Valve — and that is what the app is for.

• The app signs in to your own Steam account and talks to Deadlock's game coordinator as you, to list your own matches and get the credentials needed to download your own replays. This is the same mechanism the game itself uses, and it goes to Valve, not to us.
• Replays are then downloaded from Valve's own replay servers (replay<n>.valve.net). The request names the match and the download key the game coordinator gave you.
• Your Steam sign-in is kept on your PC so you do not have to repeat it. It is a plain-text file at %LOCALAPPDATA%\deadlock-gc\refresh_token.txt. It is a live credential for your Steam account: treat it the way you would treat a password file, do not share it, and note that it sits outside the app's own folder, so deleting the app's data folder does not remove it.
• For ranks, the app reads public data files published by data.deadlock-api.com (deadlock-api.com's hourly data export). The request names a broad range of match numbers, not your match and not your account; the filtering down to specific players happens on your machine after the file is downloaded.
• To fill in details a replay does not carry, the app asks api.deadlock-api.com for one match at a time, at /v1/matches/<match id>/metadata. The match number is the only thing in that request. No Steam ID, no player name, no replay content, no sign-in, no request body — it is a plain read of a public record that anyone with that match number could make. This request is made by the Windows app only; the website does not make it.

No accounts, no analytics, no advertising

• There is nothing to sign up for and no account on this site.
• There are no analytics, no telemetry, no error reporting, no advertising and no third-party tracking scripts. The only scripts either page loads are our own, from this site.
• This site sets no cookies.
• The Windows app writes a log file on your own PC so you can send it to us if something breaks. Nothing uploads it — if you want us to see it, you attach it yourself.
• We do not sell or share anything, because we do not collect anything.

What is stored, and how to delete it

In your browser

Stored under this site's own origin, visible to nobody but you:

• Parsed replay data. For each replay you parse: the full match timeline and the summary built from it. Because a replay describes a whole match, this includes the other players in your games — that is what a Deadlock replay is, and none of it goes anywhere.
• Which files you have already handled, so the same replay is not offered to you twice — file names, sizes and modification times, not contents.
• A handle to the folder you connected, so the browser can reopen it without asking again.
• The Steam ID you confirmed as yourself, and the player you last chose to view.
• Your crash-report choice, if the app has offered one and you made it — a single on/off word.
• Screen preferences — which panels are folded, which filters are on, which comparison you last picked.

To delete all of it: clear this site's data in your browser. In Chrome or Edge that is Settings, then Privacy and security, then the site data list, then remove compydeadlock.com; in Firefox it is Settings, Privacy & Security, Manage Data. That one action removes everything in the list above. Using a private window keeps it all out of the way to begin with — at the cost of re-downloading the replay reader and re-parsing every time.

Or do it inside the app: at the foot of every page of the app is a line that begins "Everything this site keeps" with a button, Delete everything this site stored. It first shows you what will go — how many parsed replays, and which Steam ID will be forgotten — and deletes only when you confirm. Afterwards it lists each store and whether it was removed; if one could not be (another tab of this site still holding it open is the usual reason), it says so rather than claiming success. The one thing it keeps is an explicit "crash reports off" choice, if you have made one, so that forgetting your data never turns reporting back on.

On disk, if you run the Windows app

• %LOCALAPPDATA%\DeadlockCoach\ — parsed replay output and per-match summaries, match metadata, your saved folder choices, logs, prepared map assets, and the downloaded app components. Deleting this folder resets the app; it re-creates what it needs.
• %LOCALAPPDATA%\deadlock-gc\refresh_token.txt — the saved Steam sign-in described above. Delete this separately.
• Recordings the app makes, if you use that feature, go to %USERPROFILE%\Videos\DeadlockCoach\.
• Replays the app downloads are written into your Deadlock replay folder, the same place the game puts them.

Who we are, and how to reach us

Compy Deadlock is an independent fan project run by one person. It is not affiliated with or endorsed by Valve Corporation, and Deadlock and its artwork are Valve's.

If something on this page turns out to be wrong, that is a defect and we want to hear about it — it is the one page here where being approximately right is the same as being wrong.