Legal
Privacy Policy
What we collect, why, who we share it with, and the rights you have over your data. Plain language wherever the law lets us use it.
Last updated: 14 July 2026
01 Introduction
This Privacy Policy explains what information CSSkinLab collects when you use the website at csskinlab.com, the CSSkinLab browser extension, and any related services (collectively, the "Service"), how we use that information, and the choices you have over it. We aim to comply with applicable data-protection law, including the EU General Data Protection Regulation (GDPR) for users in the European Economic Area and analogous regimes elsewhere.
Using the Service means you have read this policy. If anything here is unclear, email [email protected] and we will explain.
02 Data controller
CSSkinLab operates the Service and decides how personal data is processed. A formal legal entity will be named in this section once incorporation is complete. Until then, you can reach the people responsible for data-protection decisions at [email protected].
03 Information we collect
Information you provide. When you sign in with Steam OpenID we receive your public Steam identifier (SteamID), persona name, and avatar URL. If you supply an email address through Better Auth, we store it along with your email-preference settings. If you hold a legacy PLUS subscription (no longer sold — see the Terms of Service), we retain a Stripe customer identifier and subscription state — your card details are entered on Stripe's hosted checkout and never reach our servers.
If you use product features that store data, we keep what you create: virtual-inventory entries, virtual-inventory sales, market-balance transactions, saved trade-ups, trade-up completions, portfolios and their names and descriptions, loadouts, and any extension authentication tokens you generate. Support emails you send us are retained as long as needed to handle the conversation.
Information collected automatically. Each request to the Service includes your IP address and user-agent string; we use these for rate-limiting and abuse detection rather than persistent profiling. We also store a Better Auth session cookie to keep you signed in, and we record when your account was last active so we can compute aggregate usage metrics (daily/monthly active users).
Usage analytics (self-hosted Plausible). We run a self-hosted instance of Plausible Analytics on our own infrastructure to count page views and understand which features are used. It is cookieless, does not follow you across other websites, and produces only aggregate statistics; the data never leaves servers we operate and is not shared with any analytics vendor.
Error monitoring (self-hosted Sentry). When something breaks, a self-hosted instance of Sentry on our own infrastructure records the error together with technical context (the request involved, your user identifier if signed in, IP address, and user-agent) so we can diagnose and fix it. Like our analytics, this data stays on infrastructure we operate.
04 Legal basis for processing (GDPR Art. 6)
Where GDPR applies, we rely on the following legal bases: contract performance — to operate your account, run subscription billing, and deliver the features you request; legitimate interests — to keep the Service secure, prevent abuse, and improve the product through aggregate analytics; consent — for any optional communications you opt into; and legal obligation — when we are compelled by law to retain or disclose information. Where consent is the basis, you may withdraw it at any time by emailing [email protected].
05 How we use your information
We process the data described above to authenticate sessions, run billing for legacy subscriptions through Stripe, sync your Steam inventory when you ask us to, calculate trade-up outcomes and save your contracts, surface price history and market analytics, deliver transactional email and the optional email you have enabled (account, billing, security notices, digests, alerts), understand aggregate feature usage through self-hosted analytics, diagnose errors through self-hosted monitoring, prevent abuse and fraud, and comply with legal obligations.
06 Email communications
We send two kinds of email. Transactional email — account confirmations, sign-in notices, billing receipts for legacy subscriptions, security alerts, and similar operational messages — is part of the Service and cannot be disabled while your account is active.
Optional email — the weekly digest, price alerts, product updates, and occasional promotions — is controlled per category from the Email settings page in your profile. Every optional email also carries a one-click unsubscribe link that works without signing in. Unsubscribing from optional email never affects transactional messages.
08 International data transfers
Some of our processors — notably Steam and Stripe — operate globally and may process your data outside your country of residence under their own safeguards. Their respective privacy policies describe the legal mechanisms (such as Standard Contractual Clauses) they rely on for cross-border transfers.
10 Your rights
Subject to applicable law, you have the right to access the personal data we hold about you, to correct inaccurate data, to request erasure ("the right to be forgotten"), to restrict or object to certain processing, to receive your data in a portable format, and to withdraw any consent you have given. To exercise any of these rights, email [email protected] from the address tied to your account; we may need to verify your identity before acting.
If you are in the European Economic Area, the United Kingdom, or another jurisdiction with a data-protection authority, you also have the right to lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first, but the right to complain is yours regardless.
Some data — such as billing records and subscription history — must be retained for legal or accounting reasons and may not be eligible for immediate deletion.
11 Data retention
We keep account data for as long as your account is active. If you request deletion, we erase associated personal data within 30 days, except for records we are legally required to keep (for example, billing and tax records, which we retain for the period required by applicable law).
Server logs and request-level data (IP, user-agent) are kept on a short rotation sufficient for security and abuse-detection purposes and are not retained against your user record long-term.
12 Data security
We protect your data with HTTPS encryption in transit, hashed and rotated session credentials, scoped database access, and infrastructure segregation between user-data systems and the price-aggregation pipeline. We follow standard practices for vulnerability management and review access regularly. No system is perfectly secure, and we cannot guarantee absolute security; if we ever discover that your data has been compromised, we will notify you in line with applicable law.
13 Children's privacy
The Service is not intended for children under 16. We do not knowingly collect personal data from anyone in that age group. If you believe a child has provided us with personal data, contact [email protected] and we will delete it.
14 Changes to this policy
We may update this Privacy Policy as the Service evolves or as the law changes. The "Last updated" date below reflects the most recent revision. For material changes we will post a notice in the application or send an email where feasible. Continued use of the Service after a change constitutes acceptance of the updated policy.
15 Contact us
For any privacy-related question or to exercise the rights described above, email [email protected].
Last updated 14 July 2026. Questions? [email protected]