Privacy Policy

1. Who we are & contact

skinrat is the data controller for the personal data described in this policy. The operating legal entity, registered address, and data-protection officer will be published before public launch (pending legal review). To exercise your rights or ask a question, contact us at skinratstudio@gmail.com.

2. What we collect

Account data

• Steam profile — SteamID64, display name, and avatar URL, received via Steam OpenID when you sign in. We never receive or store your Steam password.

Inventory & marketplace data

• CS2 inventory — your public Steam inventory, fetched to display your portfolio and calculate portfolio value.
• Marketplace API keys — if you choose to connect a marketplace account, we store the API key you provide to fetch your listings and transaction history. You can disconnect at any time from Settings.

Usage & technical data

• IP address — used for rate limiting, anonymous chat metering, and abuse prevention. Not linked to your account unless you sign in.
• Device & browser info — user-agent string, screen size, and OS, collected for compatibility and debugging.
• Usage events — page views, clicks, and feature interactions, collected only with your analytics consent via PostHog (see Cookies & analytics below).

AI chat data

• Chat messages — your questions and the AI responses are stored to provide conversation history. Chat data is processed by third-party AI model providers (see section 5).
• Review & improvement — chat conversations may be reviewed, in an automated or manual capacity, by skinrat or its AI service providers to monitor for abuse, ensure safety, debug issues, and improve the quality of AI responses. Please do not share sensitive personal information (such as government IDs, payment card numbers, or health information) in the chat.

3. How we use your data

• Provide the service — price charts, portfolio tracking, AI chat, and skin search.
• Secure your account — authentication, session management, and token refresh.
• Prevent abuse — rate limiting, anonymous chat metering, and detecting automated access.
• Improve the service — anonymized usage analytics (only with your consent).

We do not sell your personal data.

4. Legal bases (GDPR Art. 6)

• Performance of a contract — processing needed to provide the service you signed up for (account, portfolio, chat).
• Legitimate interests — security, abuse prevention, and basic service operation. We balance these against your rights and do not use this basis for marketing.
• Consent — analytics and any future marketing cookies. You can withdraw consent at any time via the cookie preferences (see below) or by contacting us.

5. Third parties & processors

We share data only as needed to run the service. We do not sell or rent your data to third parties for their own purposes.

6. International data transfers

Our infrastructure is hosted in the EU (Hetzner, Germany). Analytics data is processed by PostHog's EU instance. AI chat messages may be processed by model providers outside the EU; where this is the case, we rely on Standard Contractual Clauses (SCCs) or an adequacy decision to safeguard your data.

7. Cookies & local storage

We use cookies and browser storage for the following purposes:

Analytics and marketing cookies are off by default and only activate after you explicitly opt in. They never load before your choice.

8. Data retention

• Account data — kept for as long as your account is active. Deleted when you delete your account.
• Chat history — retained while your account is active. Deleted on account deletion.
• Usage logs & IP addresses — retained for up to 90 days for security and abuse-prevention, then deleted or anonymized.
• Analytics data — anonymized on collection; retained per PostHog's standard retention policy.

9. Your rights

Under the GDPR and applicable data-protection laws, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten"). You can also delete your account from Settings.
• Restriction — request that we limit how we process your data in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — for analytics or marketing, at any time via cookie preferences or by contacting us. Withdrawal does not affect the lawfulness of prior processing.

To exercise any of these rights, contact us at skinratstudio@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data-protection supervisory authority.

10. Children

skinrat is not intended for children under 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it promptly.

11. Security

We use industry-standard measures to protect your data, including encrypted connections (TLS), encrypted storage for sensitive credentials (marketplace API keys), and access controls on our infrastructure. No system is perfectly secure — if you discover a vulnerability, please report it to skinratstudio@gmail.com.

12. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via the website. The "Last updated" date at the top reflects the latest revision. Continued use of skinrat after changes constitutes acceptance of the updated policy.