Steam AI Disclosure: turning a niche into a working micro-SaaS

I keep a personal notebook of in-demand niches. Not "wouldn't it be cool to build X," but "here is where someone's hair is on fire and they'd pay to put it out." One of those lines turned into a real, paid tool that now lives on this site: the Steam AI Disclosure Generator. This post is the full story: the idea, where it came from, how it's built, what it's worth, why I bothered, and the one part people always get wrong: what that generated PDF protocol legally is and isn't.

The idea, in one line

Steam AI Disclosure walks a game developer through a short questionnaire, decides what they must declare about AI in Valve's Steamworks Content Survey, and hands them ready-to-paste disclosure text plus a dated "compliance protocol." The verdict is free. The paste-ready pack is paid.

It sounds narrow. The narrowness is the point.

How it came about

The niche surfaced during one of my regular sweeps for fresh, concrete pain. The signal was sharp: in January 2026 Valve rewrote the AI-disclosure form on Steam, and developers suddenly didn't know what they were supposed to declare.

A bit of context on why that's painful at all:

In 2023, Steam rejected games built with AI-generated assets when the developer couldn't show they had the rights to what the model was trained on.
In 2024, Valve formalized a policy: AI is allowed, but you must disclose it in the Content Survey.
In January 2026, Valve clarified the scope. You disclose AI content that ships in the build and is consumed by players, not behind-the-scenes "efficiency" tools.
The volume exploded: by various counts, roughly 8,000 games disclosed AI use in the first half of 2025, versus about 1,000 in all of 2024. More games, more confusion.

This is textbook forced demand: not "nice to have," but "get it wrong and your review is delayed or your page is pulled." And the part that mattered to me personally: it's gamedev, a domain I know from the inside. Real pain ∩ my expertise.

The pivot: it's not "three paragraphs"

The first thing I did was try to kill the idea. The obvious objection: why pay when ChatGPT writes the text for free? And that's true: a model will happily write the paragraphs. So the product can't be the text.

The value lives somewhere else, in the things a chat model can't credibly give you:

A current ruleset. ChatGPT confidently serves 2024-era rules or hallucinates. Valve changes the form and enforces with delisting. Keeping the rule set synced to the live policy is the actual moat.
Dated proof of good faith. A protocol stamped with the policy version, the date, and a rationale per category. A paper trail for when a report or a rule change shows up later.
Backlash-safe wording. How you phrase the disclosure to players, so you don't get review-bombed, is judgment, not text.

That teardown became the spine of the product: a free verdict as the lead magnet, and a paid unlock for currency, evidence, and careful phrasing, not for prose.

What it solves for the developer

The user is an indie dev or a small studio about to publish on Steam. Their jobs-to-be-done:

Kill the gray-zone anxiety. "AI-upscaled textures, disclose? AI-assisted animation? Placeholder VO that an actor replaced?" The tool answers against Valve's taxonomy: Pre-Generated, Live-Generated, exempt, or a flagged gray zone with the policy's own wording.
Fill the form correctly the first time, with no review delay and no takedown.
Get the exact text for each Steamworks field (including the mandatory guardrails description for runtime AI) and a calm, player-facing store note.
Keep evidence that the review was done in good faith against a specific policy version.

Practical applications, and what happens when you get it wrong

Where it actually earns its keep:

An indie ships AI concepts a human repainted. Disclose or not? (If a human's final art shipped, no; if the AI art ships as-is, yes.) The tool settles it in a minute instead of half a day of forum-diving.
A studio adds an LLM-driven NPC. That's Live-Generated, and Valve additionally requires a description of the guardrails that stop it from producing illegal content. This is the field people forget, and the tool supplies both the text and the reminder.
AI in the store capsule. Capsule art and screenshots are player-facing, and AI there draws extra community scrutiny. The tool flags it as a high-attention area and helps you word it honestly.
The January 2026 policy change. Games already shipped under the old rules suddenly need re-checking, which is exactly where a dated protocol plus rule-change monitoring becomes recurring value rather than a one-off.

The cost of getting it wrong: a delayed review (a blown launch window), a rejected page, in the worst case a delisting. And almost always a reputational hit and review-bombing if players decide the studio hid something. The downside is the lost launch you worked a year for. Against that, a small fee for certainty and a paper trail is insurance, not a text purchase.

How it's built (the technical part)

The site is Nuxt 4 (Vue 3), Firebase Firestore (Admin SDK only), a Nitro server, deployed on Firebase App Hosting. The decisions that matter:

1. A deterministic core; AI is only a writer. The verdict is computed in code from a versioned rule set: ten asset categories mapped to pre / live / exempt / gray. This is the moat, the free lead magnet, and the predictability all at once. The AI never decides what to disclose:

// One pure function decides what must be disclosed — no AI involved.
export function classifyAudit(answers: SteamAuditAnswers): SteamAuditClassification {
  const perCategory = RULESET_CATEGORIES.map((cat) => {
    const answer = answers[cat.id] ?? 'none'
    return { id: cat.id, ...cat.classify(answer) } // outcome: 'pre' | 'live' | 'exempt' | 'gray'
  })
  return {
    rulesetVersion: RULESET_VERSION, // e.g. '2026-01-17'
    perCategory,
    hasLive: perCategory.some(c => c.outcome === 'live'),
    mustDisclose: perCategory.some(c => c.outcome === 'pre' || c.outcome === 'live'),
  }
}

OpenAI is called only on the paid step, and only to turn that already-decided verdict into polished prose (the Steamworks field text + a backlash-safe store note). No "let the model decide what's disclosable."

2. Payment: Stripe Checkout, webhook as the source of truth. What confirms a sale isn't the browser redirect (the tab can be closed). It's the webhook, which marks payment and kicks off generation idempotently:

// The Stripe webhook is the source of truth. Generation runs once, after payment.
export async function markPaidAndGenerate(id, email, sessionId, config) {
  const snap = await audits.doc(id).get()
  if (!snap.exists || snap.data().status !== 'awaiting_payment')
    return // already handled — idempotent against Stripe retries & duplicate events

  await audits.doc(id).set(
    { status: 'paid', customerEmail: email, paidAt: nowIso() },
    { merge: true },
  )
  void runGenerationThenEmail(id, config) // fire-and-forget so we ack Stripe fast
}

The whole flow:

3. Access without an account. The result opens via a signed (JWT) link, and also lands in the user's account history if they're logged in. Anonymous purchases work too, and the link is emailed.

4. Resilience. The valuable part (answers + verdict) is persisted before payment, so generation can always be retried for free. There are transient retries to OpenAI, an auto-retry on failure, and a "your payment is safe, retrying doesn't charge you again" screen.

5. PDF in the browser. The protocol prints via window.print() from already-stored data, so there's no server-side PDF pipeline and fewer points of failure.

6. SEO/AEO from day one. The page is prerendered; the static HTML carries real text, a single-source FAQ (visible text == structured data), and a full Schema.org graph:

useToolPageSchema({
  offer: { price: '39', currency: 'usd' },
  howTo: { name: 'How to complete your Steam AI content disclosure', steps },
  faq: faqItems, // the same array is rendered visibly → schema ↔ content parity
})

One note of engineering humility: there's no ML research and no heavy infrastructure here. The "magic" is careful deterministic logic and a rule set kept current by hand.

The business value

Forced demand. A purchase made out of fear of delisting converts better than "would be handy."
The moat is currency, not code. Anyone can clone the UI over a weekend; few will spend weeks keeping the rule set synced to Valve and shipping a dated artifact.
A path to recurring revenue. The one-off is the entry; retention is built on rule-change monitoring ("we watch the policy and keep your disclosures valid").
A wedge into something bigger. AI disclosure is a narrow, hot doorway into the larger, money-ier niche of "Steam/console submission readiness": the whole Content Survey, age ratings, regional compliance, a pre-release checklist.

Honestly, on its own this is a modest micro-SaaS, not a venture rocket, and that's fine. I designed it as a precise, cheap-to-maintain tool with clear economics.

Why I built it

A few layers:

Productizing niche research. Turning a line from my notebook into a live product on prod, fast, is a test of my whole pipeline: find pain → kill weak ideas → ship.
Domain leverage. I know the Steamworks pain from the inside, so this is cheaper and more credible for me to run than for an outsider.
An asset and a showcase. I'm making ravy.pro a home for small tools like this. Each one is potential revenue, a portfolio piece, and content (this article is part of the same loop).
An option on more. If the narrow doorway proves demand, a much larger compliance product for studios sits right next to it.

The legal standing of the PDF protocol, honestly

This matters, so let me be precise and not oversell it.

The protocol is not a certificate, not a guarantee of compliance, and not legal advice. It does not make Valve approve your game, and it confers no immunity. Any tool that promises "one-click compliance" is setting you up. The cautionary tale here is the $1M FTC settlement against accessiBe for marketing an accessibility widget as guaranteed compliance. Over-claiming is the trap.

What the protocol is: contemporaneous, dated, ruleset-versioned documentation of a good-faith review. Its value is evidentiary, and it comes from three properties:

It's dated. It records when you made the determination, ideally at or before submission.
It's version-pinned. It states exactly which policy version you reviewed against (e.g. v2026-01-17). When Valve changes the rules later, you can show you complied with the rules that existed when you shipped, rather than being judged by a policy that didn't exist yet.
It's reasoned. It captures your answer and the rationale for each category, so "we decided X because Y" is on the record instead of "we think we were fine."

In practice that's useful in exactly the moments disputes happen: a platform query, a marketplace takedown appeal, a publisher or partner asking how you handled AI, or an internal record for your own team. It doesn't win those situations by fiat. It lets you demonstrate diligence with a credible, time-stamped trail instead of a vague recollection. That's the difference between "trust us" and "here is what we determined, when, and against which policy."

Being honest about this isn't only safer. Post-accessiBe, it's a genuine differentiator. "Detection + documentation of good faith" is a claim you can stand behind; "guaranteed compliant" is not.

This tool, and this article, are informational, not legal advice. For anything with real stakes, talk to a lawyer.

Takeaways and a pre-upload checklist

The big lesson, for me, isn't about Steam. It's about method: the most valuable part of a product is almost never where it first appears. Here it wasn't three paragraphs of text. It was current rules and dated evidence. Finding that real value is the whole job.

If you're shipping a game on Steam, here's the short version you can apply without any tool:

Did any AI output ship in the build and get seen, heard, or read by players? → disclose it (Pre-Generated).
Does the game generate anything via AI at runtime? → disclose it (Live-Generated) and describe your guardrails.
Was AI only a development/efficiency tool, not player-facing? → generally not disclosed.
Did a human replace AI placeholders before release? → it didn't ship; not disclosed.
Marketing capsule, screenshots, or trailer made with AI? → player-facing; disclose and confirm you hold the rights.
Cloned or trained on a real person's voice? → keep written consent on file.
Unsure whether something reaches players? → disclose.
Keep a dated record of your determination and the policy version you reviewed against.

If you'd rather not do that by hand, the free verdict takes about three minutes.