Draft to be reviewed by a lawyer — do not publish as is.
This English version is provided for convenience; the French version prevails in case of discrepancy.
Cookie policy
This policy describes the cookies and trackers used on skinflip.app, in accordance with Article 82 of the French Informatique et Libertés law and the CNIL guidelines and recommendation of 17 September 2020 (deliberations no. 2020-091 and no. 2020-092).
1. What is a cookie?
A cookie is a small file stored on your device when you visit a website. This policy also covers similar technologies (for example the browser's local storage).
2. Our approach
- At launch, SkinFlip only uses cookies that are strictly necessary for the website to work, which do not require your consent.
- No advertising cookies, now or in the future. No social-network trackers.
- Any non-essential cookies (audience measurement) are disabled by default and only set after your consent.
3. Strictly necessary cookies
| Name (indicative) | Purpose | Duration | Characteristics |
|---|---|---|---|
st_session |
keep you signed in after signing in through Steam | 30 days | httpOnly, Secure, SameSite=Lax; contains a random token of which only a hash is kept on our servers |
| OpenID sign-in state cookie | secure the return from Steam's sign-in page (replay protection) | 10 minutes | httpOnly, Secure, SameSite=Lax |
| anti-forgery (CSRF) cookie, if used | protect forms against forged requests | session | httpOnly, Secure |
NEXT_LOCALE |
remember the chosen language (French or English) | 12 months [TO COMPLETE: duration to be confirmed with the configuration] | interface personalisation requested by the user |
st_consent |
remember your cookie choices | 6 months | — |
[TO COMPLETE: final cookie names and list of any data stored in the browser's local storage by the interface.]
4. Cookies requiring consent
| Category | Current use |
|---|---|
| Audience measurement | none at launch [TO COMPLETE: if an audience-measurement tool is added, state its name, cookies, duration (13 months maximum) and any consent exemption under the CNIL's conditions] |
| Advertising | none, ever |
5. Banner and managing your choices
- If cookies requiring consent are used, a banner is shown on your first visit with three buttons of equal level and equal prominence: "Reject all", "Accept all" and "Customise". Rejecting is as easy as accepting.
- Closing the banner without choosing counts as a refusal.
- You can change or withdraw your consent at any time through the "Manage cookies" link in the footer.
- Your choice is kept for 6 months, after which you are asked again.
6. Third-party services
- Steam sign-in: sign-in takes place on steamcommunity.com, Valve's website, which sets its own cookies under its own policy.
- Stripe payment: we use Stripe's hosted payment page (Stripe Checkout); cookies needed for payment and fraud prevention are set on Stripe's domain, under its own policy.
- Item images: they are loaded from Steam's servers, which receive your IP address; we do not control any cookies those servers may set.
- Error tracking (Sentry): configured without cookies [TO COMPLETE: to be verified during integration].
- Affiliate links: when you click a link labelled "affiliate link", the partner website may set its own cookies, under its own policy.
7. Browser settings
You can also configure your browser to block or delete cookies. Blocking strictly necessary cookies prevents you from signing in.
8. Contact
privacy@skinflip.app — see also the Privacy policy.