This policy explains what personal data SkinWeb collects, why, how long we keep it, who we share it with, and what rights you have. It forms part of our Terms of Service.
We have written it to match what the site actually does. If something here does not match what you see, tell us at [email protected].
1. Who is responsible for your data
The data controller is the sole trader who operates SkinWeb, established in Sweden, and named in full in section 14.
Email: [email protected]
We have not appointed a data protection officer, because we are not required to. Send data protection questions to the address above.
2. Quick summary
- We do not sell your personal data. Ever.
- We do not run third-party advertising trackers.
- You sign in with Steam. We never see your Steam password.
- Your public Steam profile, your inventory and your trade listings are, by design, visible to other users.
- Direct messages and trade messages are stored in plain text and can be read by us, so that scams can be investigated. They are not end-to-end encrypted.
- If you give us your email address, we use it only for the alerts you switch on. No newsletters, no marketing, and one click turns them off.
- Our analytics (Umami) are self-hosted, do not use cookies, and do not identify you personally. We do not record your screen or sessions.
- You can ask us for a copy of your data, or to delete it, at [email protected].
3. What we collect, why, and on what legal basis
Under the GDPR we need a lawful basis for each use of your data. Here is the full list.
3.1 Account and Steam sign-in
What: your Steam ID (SteamID64), your Steam display name, your Steam avatar URL, and, if you provide one, your Steam trade URL. If you used an older version of the site that asked for an email address, we may also hold that email until you confirm or replace it under section 3.12.
Why: to create and run your account, to show your profile to other users, and to let other users send you trade offers.
Legal basis: performance of a contract with you (GDPR Article 6(1)(b)).
Note: we receive this from Valve through Steam OpenID sign-in. We never receive, request or store your Steam password or Steam Guard codes.
3.2 Your CS2 inventory
What: the items in your Counter-Strike 2 inventory as Steam reports them, including asset IDs, class IDs, item names, images, whether the item is tradable and marketable, applied stickers, float value, paint seed and paint index, and inspect links. We also store when we last refreshed your inventory.
Why: to show your inventory to you, to let you attach items to listings and offers, and to show items you have listed to other users.
Legal basis: performance of a contract with you (Article 6(1)(b)).
Note: we read your inventory from Steam's own inventory endpoint. What we can see depends on your Steam inventory privacy setting. Items you attach to a public listing become visible to everyone.
3.3 Trades, offers and comments
What: listings you create, offers and counter-offers you send and receive, their status and history, the items and cash or cryptocurrency amounts described in them, and comments you post.
Why: to operate the trade forum and offer system, to show your listings to other users, and to keep a record of what was proposed if a dispute arises.
Legal basis: performance of a contract with you (Article 6(1)(b)), and our legitimate interest in being able to investigate scam reports (Article 6(1)(f)).
3.4 Messages
What: the full content of direct messages and per-offer trade messages, who sent and received them, the trade or offer they relate to, whether they were read, and when they were sent.
Why: to deliver messages, and to detect, investigate and act on scams, fraud, harassment and other breaches of our Terms.
Legal basis: performance of a contract with you for delivery (Article 6(1)(b)), and our legitimate interest, and the legitimate interest of other users, in a platform where scams can actually be investigated (Article 6(1)(f)).
Please understand: messages are stored in plain text on our servers and can be read by the operator, whether or not anyone has reported you. They are not end-to-end encrypted. Never send passwords, Steam Guard codes, payment credentials, identity documents or other sensitive information through SkinWeb.
3.5 Wishlist and notification settings
What: the skins on your wishlist, your price thresholds, whether wishlist notifications are enabled, and the notifications we have generated for you.
Why: to run the wishlist and price alert features.
Legal basis: performance of a contract with you (Article 6(1)(b)).
3.6 Blocks
What: which users you have blocked, and when.
Why: to stop blocked users contacting you.
Legal basis: performance of a contract with you (Article 6(1)(b)).
3.7 Analytics
What: aggregate, privacy-preserving analytics, collected by Umami, an analytics tool we run ourselves on our own infrastructure (it is not a third-party service). Umami records:
- Page views: the page visited, the time of the visit, your referrer, your screen size, language, browser and device type, and an approximate country and city.
- Events: a small number of named actions, such as which marketplace you open from a skin's price list and for which item.
- Performance: how quickly each page loaded and responded in your browser (load, paint and responsiveness timings).
- Heatmaps: where on a page visitors click (as screen coordinates) and how far down they scroll, with the page and window size. Heatmaps record positions only. They do not record what is on the page, what you type, or your screen.
To count visits without a cookie, Umami derives an identifier from a one-way hash of your IP address and browser details, combined with a secret that changes regularly. Your IP address itself is not stored. Umami does not set a cookie and does not write anything to your browser's local storage. Your approximate location comes from the location data Cloudflare attaches to each request or from a database on our own server. Your IP address is not sent to any other service for this. We do not link this data to your account, and we do not use session recording (replay).
Why: to understand how the site is used, which pages, skins and features are popular, where pages are slow, and how to improve the site, without identifying individual visitors.
Legal basis: our legitimate interest in understanding site usage in a way that does not identify you (Article 6(1)(f)). Because the analytics we use cannot identify you and stores no cookie, it does not require consent under applicable cookie rules.
3.8 Acceptance of our Terms
What: which version of the Terms of Service and Privacy Policy you accepted, a cryptographic hash of the exact text you were shown, the date and time, your IP address, your browser user agent string, and the confirmations you ticked (that you are 18 or over, and that you understand we do not escrow or guarantee trades).
Why: to be able to prove what you agreed to, and when, if there is ever a dispute.
Legal basis: legitimate interest in establishing and defending legal claims (Article 6(1)(f)), and legal obligation where applicable (Article 6(1)(c)).
3.9 Moderation and safety records
What: whether your account is banned or timed out, when, the stated reason, any tags applied to your account, reports made by or about you, and the evidence attached to them.
Why: to enforce our Terms, protect users from scammers, prevent banned users from returning, and handle appeals.
Legal basis: legitimate interest in the safety and integrity of the Service and its users (Article 6(1)(f)), and, for illegal content, legal obligation (Article 6(1)(c)).
3.10 Server logs and security
What: standard web server and application logs, which can include IP address, timestamp, request path, status code and user agent.
Why: to keep the Service running, to debug, and to detect and stop abuse, scraping and attacks.
Legal basis: legitimate interest in the security and availability of the Service (Article 6(1)(f)).
3.11 Support and legal correspondence
What: the emails you send us and our replies, including anything you attach.
Why: to answer you, and to keep a record of reports, appeals and legal notices.
Legal basis: legitimate interest in handling correspondence (Article 6(1)(f)), and legal obligation where the correspondence is a legal notice (Article 6(1)(c)).
3.12 Email alerts
What: if you choose to add one, your email address, whether and when you confirmed it, an address waiting on its confirmation link together with a one-way hash of that link and when it was sent, which alerts you want (trade activity, wishlist), and when you last closed our request to add an address. For every email we send, we log that it was sent, to which account, what kind of email it was, whether delivery was accepted and, if not, the error. For confirmation emails we also log a keyed one-way hash of the address and whether the account was under a week old, so that no address can be sent more than a few confirmation emails a day, however many accounts ask.
Why: to send you the alerts you asked for: offers, counter-offers, replies and messages on your trades and offers while you are away from the site, skins from your wishlist being listed, and, if you win a giveaway, a note that you won. To check that the address is really yours before we send anything else to it. To stay within the number of emails we can send each day, and to look into delivery problems.
Legal basis: performance of a contract with you (Article 6(1)(b)). The alerts are a feature you switch on. You can switch each kind off, or remove the address, at any time in your email settings, and every alert has a one-click unsubscribe link that works without signing in.
Note: we never send marketing or newsletters, we never send alerts to an address you have not confirmed, and we never show your address to other users. An alert names the user and the trade or offer it is about, but never quotes what anyone wrote: comments, offer notes and messages stay on the site.
3.13 Giveaways
What: while a giveaway runs, a record of each listing and offer you create on the trade forum that counts as an entry, including the items and amounts in it, your offer note, and a snapshot of the items as they were when sent. If another user reports an entry as spam, we record who reported it, when, and how a moderator decided. When we draw the winner, we record the full ticket table at that moment, the winning ticket and the winner.
Why: to count tickets, to judge spam reports even after the trade or the items are gone, and to be able to show that the draw was fair.
Legal basis: performance of a contract with you (Article 6(1)(b)), and our legitimate interest in a fair, verifiable draw (Article 6(1)(f)).
Note: the giveaway page shows participants' Steam display names and ticket counts, and the winner's display name and avatar.
3.14 Minigames
What: the runs you play (score, rounds, answers and the round on screen), your best scores and totals per game, and your best score in each prize week. If you play without signing in, the run is not linked to anyone; signing in afterwards attaches the finished run to your account so the score is not lost.
Why: to run the games, to keep the leaderboards, and to award weekly prizes.
Legal basis: performance of a contract with you (Article 6(1)(b)).
Note: leaderboards show your Steam display name and avatar next to your scores.
3.15 Inspect servers and skin spawning
What: when you ask for a skin to be spawned for you on one of our CS2 inspect servers, the request (the item and its settings), the SteamID64 it is meant for, which server, who asked, and whether it was delivered. While you are connected to one of our servers, the server reports your SteamID64 to us, and we hold the list of connected players in memory only. Partners who run inspect servers through us can send spawn requests for players on their servers and can see which players are connected to their own servers, but nothing about anyone else's.
Why: to put the requested skin in your hands on the server you are on, and to show whether you are connected.
Legal basis: performance of a contract with you (Article 6(1)(b)) where you have a SkinWeb account. Players without one can join our servers too; for them, and for spawn requests a partner sends, the basis is our legitimate interest, and the partner's, in running the servers (Article 6(1)(f)). The list of connected players is never stored, and a request is deleted 7 days after it settles.
3.16 Render studio and public inventory lookups
What: when you paste a Steam profile link, trade link or SteamID into the render studio, we fetch that account's public CS2 inventory from Steam and hold the response in a cache for 10 minutes. It is not stored anywhere else and is not linked to your account. Your browser remembers the last link you pasted (section 5).
Why: to let you stage real items in a render.
Legal basis: our legitimate interest in offering the feature (Article 6(1)(f)). We only fetch what Steam already makes public for that account.
4. What we do not do
- We do not sell, rent or trade your personal data.
- We do not send marketing email, and we add no tracking pixels or click tracking to the emails we send.
- We do not run third-party advertising or behavioural retargeting trackers.
- We do not use tracking cookies for analytics, our analytics tool does not identify individual visitors, and we do not record your sessions or screen.
- We do not ask for, receive or store your Steam password, Steam Guard codes, or any payment card, bank or cryptocurrency wallet credentials.
- We do not handle money, so we hold no payment data.
- We do not make decisions with legal or similarly significant effects about you by automated means alone. Automated systems flag content and behaviour, but you can ask for a human review of any restriction under section 12.3 of the Terms.
- We do not knowingly collect data about anyone under 18.
5. Cookies and local storage
We set one cookie, and keep a few settings in your browser. Each one is strictly necessary for the site to work or remembers a choice you made. None of them track you, and none are shared with anyone. Nothing here requires consent.
Cookie
| Name | Purpose | Lasts |
|---|---|---|
| Authentication | Your signed-in session. An HttpOnly cookie holding a signed token. | 7 days |
Local storage (stays in your browser until you clear it)
| Name | Purpose |
|---|---|
| skinweb_sound_enabled:v1 | Whether notification sounds are on. |
| skinweb:guess-the-wear:muted, skinweb:higher-or-lower:muted | Whether you muted a minigame. |
| chickens:sound | Whether you turned on sound on the pet chickens page. |
| skinweb:skin-or-thing:muted | Whether you muted Skin or Thing. |
| skinweb:trades-theme:v1 | Your choice of look for the trade forum. |
| skinweb.render.quality | The texture quality you picked in the render studio. |
| render-studio:import-user | The last profile link, trade link or SteamID you imported into the render studio, so you do not have to paste it again. |
Session storage (deleted when you close the tab)
| Name | Purpose |
|---|---|
| skinweb:auth:return-to | The page to return you to after you sign in with Steam. |
| webber_filter_state | Your filters in the item browser, so going back does not reset them. |
| skinweb:higher-or-lower:pending-run, skinweb:skin-or-thing:pending-run | An unfinished minigame run, so a reload does not lose it. |
| skinweb:email-prompt:shown | That we already asked you to add an email address in this tab, so we do not ask twice. |
| skinweb:giveaway-strip-min | That you minimised the giveaway banner on the trade forum. |
Our analytics (section 3.7) sets no cookie and writes nothing to your browser's storage.
We use Cloudflare (section 6) to deliver the site. Cloudflare can set its own strictly necessary security cookies, for example when it needs to check that a request comes from a real browser. We do not use Cloudflare for analytics or advertising.
6. Who we share data with
We share personal data only in the situations below.
Other users, by design. Your Steam display name, avatar, profile, account tags, listings, offers, comments, and any items you attach to a listing or offer are visible to other users. Messages you send are visible to the user you send them to. Think of everything you post as public.
Valve Corporation (Steam). Sign-in uses Steam OpenID, which means Valve knows you signed in to SkinWeb. We read your inventory from Steam. Avatars and item images are loaded by your browser directly from Steam's servers, so Valve receives your IP address and browser details when those images load. The same happens when an alert email that shows an item picture is opened and your email app loads its images. Valve is an independent controller for what it does with your data, under its own privacy policy.
Hosting and infrastructure. Our servers, database and cache, including our self-hosted analytics, are hosted with Hetzner Online GmbH, in the European Union. They process data on our instructions as our processor. Analytics data is stored only on our own infrastructure.
Cloudflare. Every request to SkinWeb, including to our analytics, passes through Cloudflare, Inc., which protects the site from attacks and delivers it faster. Cloudflare therefore processes your IP address, the pages you request and your browser details, on our instructions as our processor. Cloudflare also delivers the emails we send (section 3.12), and so processes your email address and the content of those emails, also as our processor.
Inspect server partners. A partner who runs CS2 inspect servers through our partner programme can see which SteamID64s are connected to its own servers, and the spawn requests it sent itself (section 3.15).
Marketplaces you choose to open. When you follow a link from SkinWeb to a marketplace, that marketplace can see that you came from SkinWeb, and some of these links carry our referral code. We send the marketplace nothing about you.
Price data sources. We fetch item prices from public third-party marketplace sources. These requests are made by our server, about items, and do not include your personal data.
Authorities and legal claims. We disclose data where we are legally required to, where we believe in good faith it is necessary to prevent or investigate a crime, or where it is necessary to establish, exercise or defend legal claims. If another user reports you for a scam, we may use your messages, listings and offers to investigate, and may pass evidence to law enforcement or to Valve.
A successor. If the Service is transferred to someone else, we may transfer data with it. Your rights under this policy would carry over, and we would tell you first.
7. International transfers
Our servers are in the European Union.
Some third parties may process data outside the EEA:
- Valve Corporation is in the United States. Transfers to Valve arise from you choosing to sign in with Steam and from Steam images your browser loads, and are governed by Valve's own arrangements.
- Cloudflare, Inc. is in the United States and serves requests from a global network, so a request can be handled outside the EEA.
Where we transfer personal data outside the EEA, we rely on an adequacy decision where one applies, or on the European Commission's standard contractual clauses. You can ask us for details at [email protected].
8. How long we keep data
We keep personal data only for as long as we need it for the purposes in section 3, and no longer. Because those purposes differ, we set retention by the criteria below rather than by one fixed date for everything.
The criteria we apply
- Whether you still have an account. Most data exists only to run your account, and goes when the account goes.
- Whether a dispute could still arise. Trade records and messages are the only way to investigate a scam that surfaces months after the trade, so we keep them while a claim about that trade could still realistically be brought, and until any open report, appeal or claim concludes.
- Whether a ban still needs to hold. Ban records outlive the account, because deleting them would let a banned scammer return by signing up again.
- Whether the law requires it. Where a rule obliges us to keep something, we keep it for as long as that rule says.
- Whether we still need to identify you at all. Where only the aggregate is useful, as with analytics, we keep no identifying data in the first place.
What that means in practice
| Data | We keep it |
|---|---|
| Account, profile, trade link, wishlist and settings | While your account is open. Deleted or anonymised after closure. |
| Inventory snapshots | Refreshed on use. Deleted after account closure. |
| Listings, offers and comments | While your account is open, then anonymised, so the other party's trade history stays coherent without identifying you. |
| Direct and trade messages | While needed to investigate scams and to defend claims, and until any open report, appeal or claim concludes. |
| Notifications | While useful to you, then deleted. |
| Email address and alert settings | Until you remove the address or close your account. An unconfirmed address is replaced by the next one you add, and its link stops working after 48 hours. |
| Email send log | 30 days, then deleted. |
| Giveaway entries, spam reports and draw records | After the giveaway ends, while a question about the draw or the prize could still arise. |
| Minigame runs | 24 hours after the last move, then deleted. |
| Minigame scores and weekly prize standings | While your account is open, because they are the record of who won each week's prize. |
| Skin spawn requests | 7 days after they are delivered or expire, then deleted. |
| List of players connected to our inspect servers | In memory only, replaced every 30 seconds. Never stored. |
| Public inventory lookups (render studio) | 10 minutes in a cache. Never stored. |
| Analytics page views (Umami) | Never identifies you to begin with; retained in aggregate no longer than needed to understand traffic trends. |
| Terms acceptance records | While the account exists, and after closure while a claim about your use of the Service could still be brought. |
| Ban and moderation records | Beyond account closure, for as long as needed to keep the ban effective. |
| Server and security logs | A short period for debugging and abuse detection, unless kept for an active investigation. |
| Support and legal correspondence | While needed to deal with the matter and anything arising from it. |
Where we say "anonymised", we mean the data can no longer be linked back to you and is no longer personal data.
You can ask us at any time what we hold and ask us to delete it, under section 9. If we decline to delete something, we will tell you which of the criteria above we are relying on.
9. Your rights
If the GDPR applies to you, you have the right to:
- Access. Get a copy of the personal data we hold about you.
- Rectification. Have inaccurate data corrected.
- Erasure. Have your data deleted, where there is no overriding reason for us to keep it. Note that we may keep ban records and Terms acceptance records to protect other users and to defend legal claims, and we may keep evidence relating to an open scam report.
- Restriction. Ask us to stop processing your data while a dispute about it is resolved.
- Portability. Get the data you gave us in a structured, machine-readable format.
- Object. Object to processing we base on legitimate interests, including our analytics. We will stop unless we have compelling grounds that override your interests.
- Human review. Ask a person to review any automated moderation decision that significantly affects you.
How to exercise them. Email [email protected] from the address associated with your account, or contact us from within your account, and say what you want. We will respond within one month. If your request is complex we may extend that by two further months and will tell you if we do. We may ask you to confirm control of the Steam account, to make sure we do not disclose your data to someone else. Exercising your rights is free, unless a request is manifestly unfounded or excessive.
Complaints. If you think we have handled your data wrongly, please tell us first so we can fix it. You also have the right to complain to a supervisory authority. In Sweden that is the Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy.se. If you live elsewhere in the EU or EEA, you can complain to your own national authority.
10. Security
We protect your data with, among other things: HTTPS everywhere, HttpOnly and secure session cookies, signed session tokens, rate limiting, security headers, input validation, role-based access to administrative functions, and hosting in the EU.
No system is completely secure. If a breach happens that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours, and will tell you directly where the law requires it.
What you should do. Enable Steam Guard mobile authenticator. Do not reuse passwords. Never send credentials through SkinWeb messages. Treat any message asking for your login details, Steam Guard code or trade URL as a phishing attempt, and report it to [email protected].
11. Children
The Service is for adults. You must be 18 or over to hold an account. We do not knowingly collect personal data from anyone under 18. If you believe a child is using the Service, tell us at [email protected] and we will close the account and delete the data.
12. Automated processing
We use automated systems to flag likely scams, spam and abuse, and to rank and search content. These systems can be wrong.
We do not make decisions producing legal or similarly significant effects about you solely by automated means. A restriction applied automatically can always be reviewed by a person on request, under section 12.3 of the Terms.
13. Changes to this policy
We may update this policy. Each version is dated and versioned.
When we make a material change, we will ask you to review and accept it again the next time you sign in, and we record which version you accepted. Minor changes, such as correcting a typo, take effect when published.
14. Contact and controller details
Email: [email protected]
Put "Data protection" in the subject line for privacy requests, so we can route them quickly.
Who the controller is
- Service: SkinWeb
- Controller: Aron Loreskär, sole trader
- Country of establishment: Sweden
Document fingerprint (SHA-256): 90a536c4ef704526c05ef75d83d1a1752931cd8a5e29b9d3e0c5256ad706b63f
Recorded against every acceptance of this version, so the exact wording above can be verified later.