Privacy Policy
1. Introduction
This Privacy Policy ("Policy") describes how SkinStash ("we", "us", "our") collects, uses, shares, and protects information about you when you use our website at skinstash.gg (the "Website" or "Service").
We are an independent platform that facilitates even-value trading of Counter-Strike 2 ("CS2") in-game items between Steam users. We are not affiliated with, endorsed by, or sponsored by Valve Corporation or any other game publisher.
This Policy is designed to comply with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the California Consumer Privacy Act ("CCPA"), and other applicable privacy laws.
By using SkinStash, you acknowledge that you have read and understood this Policy.
2. Definitions
For the purposes of this Policy:
- "Personal Data" means any information relating to an identified or identifiable natural person.
- "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
- "Data Controller" means the entity that determines the purposes and means of Processing Personal Data. SkinStash is the Data Controller of the Personal Data we collect from you.
- "Service" means the SkinStash platform, including the website, related features, and any associated services.
- "User", "you", or "your" means an individual using the Service.
3. Information We Collect
3.1 Information You Provide Through Steam Authentication
When you sign in to SkinStash using Steam OpenID, we receive the following public information from Steam:
- Steam ID (a unique 17-digit numeric identifier for your Steam account)
- Display name (your public Steam profile name)
- Avatar URL (a link to your public Steam profile picture)
We do not receive your Steam password, email address, payment information, or any other credentials. Authentication is handled entirely by Steam.
3.2 Information You Provide Voluntarily
If you choose to provide additional information through your SkinStash profile or support communications, we may collect:
- Email address (optional)
- Steam trade URL (required to send and receive trade offers)
- Communications you send to us, including support requests and feedback
3.3 Information Generated by Your Use of the Service
When you use SkinStash, we automatically record:
- Trade history: records of trades you have initiated or completed, including items involved, prices at the time of trade, timestamps, and trade status
- Inventory snapshots: cached information about your CS2 inventory at the time it is loaded into our platform
- Session information: an encrypted session identifier used to keep you logged in
- Login records: timestamps of when you sign in
3.4 Information Collected Automatically
When you visit our Website, our servers automatically log:
- IP address
- Browser type and version
- Operating system
- Pages visited and timestamps
- Referring URL
3.5 Aggregated and Anonymized Data
We may aggregate or anonymize the data described above so that it can no longer reasonably be used to identify you. We may use and share aggregated or anonymized data for any purpose, including service improvement, analytics, and reporting.
4. How We Use Your Information
We Process your Personal Data for the following purposes, on the legal bases identified:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Authenticating you and maintaining your session | Performance of contract (Art. 6(1)(b)) |
| Loading and displaying your Steam inventory | Performance of contract |
| Processing and recording trades | Performance of contract |
| Communicating with you about trades or support requests | Performance of contract |
| Sending occasional marketing communications, promotional updates, and giveaway notifications (only if you provide an email address) | Consent (Art. 6(1)(a)) |
| Preventing fraud, abuse, and securing the platform | Legitimate interests (Art. 6(1)(f)) |
| Maintaining system logs for security and troubleshooting | Legitimate interests |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Defending legal claims | Legitimate interests |
We do not use your Personal Data for:
- Targeted advertising or selling your data to advertisers
- Profiling
- Automated decision-making that produces legal or similarly significant effects
- Any purpose not described in this Policy
5. Automated Decision-Making
We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. Trade validation involves automated price comparisons, but final approval of trades is performed manually by SkinStash administrators.
6. Sharing of Your Information
We do not sell your Personal Data. We share your Personal Data only as described below:
6.1 Service Providers
We may disclose Personal Data to the following categories of third parties as necessary to operate our Service:
- Providers of hosting, maintenance, and security services retained by us to run the Website (these companies may be located anywhere in the world but are mainly located in the European Union)
- Providers of backup and data-storage services (which may be located outside the European Economic Area, in which case the data is encrypted before transfer using strong encryption with keys controlled solely by SkinStash)
- Providers of market and pricing data services (we send only item identifiers, which do not contain Personal Data, to obtain current market prices)
- Live chat support provider (Tawk.to): only if you accept optional cookies and use the live chat. Tawk.to receives the contents of your chat messages and basic technical information (IP address, browser, page URL) needed to operate the chat widget. See Section 9.2.
We do not share user identities or Personal Data with our pricing providers.
6.2 Steam / Valve Corporation
To facilitate trades and load inventory, we communicate with Steam's public APIs. The information we send to Steam (such as your Steam ID, item asset IDs, and trade URLs) is information already associated with your public Steam account.
6.3 Legal and Safety Disclosures
We may disclose your Personal Data to government authorities (including tax authorities, law enforcement, and courts, mainly within the European Union but potentially in any jurisdiction) and to other third parties where we reasonably believe disclosure is necessary to:
- Comply with applicable law, legal process, or government requests
- Enforce our Terms of Service
- Protect the rights, property, or safety of SkinStash, our users, or others
- Investigate, prevent, or address suspected fraud or security issues
6.4 Business Transfers
If SkinStash is acquired, merged with another entity, or sells its assets, your Personal Data may be transferred to the acquiring party, subject to the same protections as this Policy.
6.5 With Your Consent
We may share your Personal Data with third parties when you give us explicit consent to do so.
7. International Data Transfers
Our primary infrastructure is located within the European Union. Some of our service providers (such as those used for encrypted backup storage) may be located outside the European Economic Area ("EEA").
Where Personal Data is transferred outside the EEA, we rely on appropriate safeguards including:
- Standard Contractual Clauses approved by the European Commission, where applicable
- Encryption at rest and in transit
- Compliance frameworks such as the EU-U.S. Data Privacy Framework, where applicable
The countries where the data may be transferred may not provide an equivalent level of data protection as the EEA, but we have taken appropriate steps to ensure your Personal Data is safeguarded in accordance with this Policy and applicable law.
You may request a copy of the safeguards in place by contacting us at the email address in Section 16.
8. Data Retention
We retain your Personal Data only as long as necessary for the purposes described in this Policy:
| Data Type | Retention Period |
|---|---|
| Account data (Steam ID, profile) | Until account deletion or 24 months of inactivity |
| Trade history | 7 years from the date of trade (for dispute resolution and regulatory purposes) |
| Session data | Until session expires (typically 30 days) |
| Server logs | 90 days |
| Encrypted backups | Rolling 30 days |
| Support communications | 3 years from the last communication |
After applicable retention periods, Personal Data is either securely deleted or anonymized. We may retain anonymized data indefinitely.
If you request account deletion (see Section 10), we will delete your Personal Data within 30 days, except where we are required to retain it to comply with legal obligations or to defend legal claims.
9. Cookies and Similar Technologies
9.1 Essential Cookies
SkinStash uses a session cookie named connect.sid, which contains an encrypted session identifier. This cookie is strictly necessary for authentication and login functionality. Without it, the Service cannot function. No consent is required for strictly necessary cookies under applicable law.
9.2 Optional Cookies (Live Chat)
If you accept optional cookies through our cookie banner, our live chat support service (provided by Tawk.to) may set additional cookies to enable the chat widget, maintain conversation continuity, and prevent abuse. These cookies are set by Tawk.to as a third-party service provider. You can review Tawk.to's privacy practices at tawk.to/privacy-policy .
If you reject optional cookies, the live chat widget will not be loaded, and no Tawk.to cookies will be set. You can still contact us via email at [email protected].
You can withdraw consent at any time by clearing cookies for skinstash.gg in your browser. The cookie banner will reappear, and you can make a new choice.
9.3 What We Do Not Use
We do not currently use:
- Analytics cookies
- Advertising cookies
- Tracking pixels
- Web beacons or device fingerprinting
If we add any new cookies or tracking technologies in the future, we will update this Policy and request your consent where required by law.
10. Your Rights
Depending on your location, you may have the following rights regarding your Personal Data:
10.1 Rights Under GDPR (EEA, UK, Switzerland)
- Right to access: You may request a copy of the Personal Data we hold about you
- Right to rectification: You may request correction of inaccurate or incomplete data
- Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data, subject to legal retention requirements
- Right to restrict processing: You may request that we limit how we use your data
- Right to data portability: You may request a copy of your data in a structured, machine-readable format
- Right to object: You may object to processing based on legitimate interests, including processing for direct marketing purposes
- Right to withdraw consent: Where Processing is based on consent, you may withdraw it at any time without affecting prior Processing
- Right to lodge a complaint: You may file a complaint with your local data protection supervisory authority
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before fulfilling your request.
10.2 Rights Under CCPA (California Residents)
If you are a California resident, you have the following rights:
- Right to know: what categories of Personal Data we collect, the sources, purposes, and recipients
- Right to access: a copy of the specific Personal Data we have collected about you
- Right to delete: your Personal Data, subject to legal exceptions
- Right to opt out of sale: note that we do not sell Personal Data as that term is understood in the CCPA
- Right to non-discrimination: we will not discriminate against you for exercising your privacy rights
To exercise these rights, contact us at [email protected].
11. Data Security
We implement reasonable technical and organizational measures to protect your Personal Data, including:
- HTTPS encryption for all traffic between your browser and our servers
- Encryption of backups at rest using strong cryptography
- Access controls limiting who can access systems containing Personal Data
- Regular security updates to our infrastructure
- Firewalls and intrusion detection on our servers
- Principle of data minimization: we collect only what we need
No system is completely secure, and we cannot guarantee absolute security. If a data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify affected users as required by law.
12. Children's Privacy
SkinStash is not directed at children under the age of 18, and our Service is intended for adults. We do not knowingly collect Personal Data from anyone under 18.
For the purposes of data protection law, a child means:
- Any individual under 16 in the European Union (or the lower age set by national law, where applicable)
- Any individual under 13 in the United States
If we become aware that we have collected Personal Data from a child under these thresholds, we will delete it as quickly as possible. If you are a parent or legal guardian and believe your child has provided us with Personal Data, please contact us at [email protected].
13. Marketing Communications
If you choose to provide your email address, we may use it to send you occasional marketing and promotional communications, including:
- Notifications about giveaways and promotions
- Updates about new features or significant platform changes
- Other occasional updates from SkinStash
Providing your email address constitutes your consent to receive these communications. When sending marketing communications, we will:
- Clearly identify the message as a marketing communication
- Provide an easy mechanism to opt out (such as an unsubscribe link in every marketing email)
- Honor opt-out requests promptly
You may withdraw your consent at any time by clicking the unsubscribe link in any marketing email, removing your email from your profile, or contacting us at [email protected]. Withdrawing consent will not affect the lawfulness of Processing carried out before the withdrawal.
Service-related communications (such as trade notifications, account verification, and support responses) are not considered marketing and are necessary for the operation of the Service. These are sent regardless of marketing preferences.
14. Third-Party Links and Services
The Service may contain links to or interact with third-party websites and services, including Steam. We are not responsible for the privacy practices of those services. We encourage you to review their privacy policies:
- Steam Privacy Policy: https://store.steampowered.com/privacy_agreement/
15. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:
- Update the "Last Updated" date at the top of this Policy
- Notify users prominently on the Website
- Where required by law, request your renewed consent
We encourage you to review this Policy periodically.
16. Contact
If you have any questions, concerns, or requests regarding this Policy or your Personal Data, please contact us:
- Email: [email protected]
- General inquiries: [email protected]
If you are located in the EEA, UK, or Switzerland, you also have the right to contact your local data protection supervisory authority. A list of authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en .