Draft to be reviewed by a lawyer — do not publish as is.

This English version is provided for convenience; the French version prevails in case of discrepancy.

"Gardien" extension privacy

This page supplements SkinFlip's Privacy policy. It also serves as the privacy policy for the extension's listings on the Chrome Web Store and on Firefox Add-ons (AMO).

1. The extension's single purpose

Gardien (French for "Guardian") is SkinFlip's browser extension for Chrome and Firefox. Its single purpose is to secure and facilitate SkinFlip trades on Steam: check that a trade offer matches what was agreed, import your inventory at your request, check security prerequisites and, if you enable Active Trading, send from your browser the offers you have authorised.

Its source code is open (MIT licence): [TO COMPLETE: link to the public repository].

2. Permissions requested

Permission	Why
`storage`	store locally the pairing token, your settings and the state of pending offers
`alarms`	periodically check for new instructions or status changes, without running permanently
`notifications`	alert you (offer to confirm, substitution alert "Don't confirm anything on your phone")
access to `steamcommunity.com`	read trade offer pages, your list of sent offers, your inventory and the API key page, and send Active Trading offers
access to `skinflip.app`	communicate with the SkinFlip API

The extension requests no other permission and has no access to any other website.

3. What is processed locally and never sent

The following are read only in your browser and are never sent to SkinFlip:

the content of Steam pages (trade offer page, list of sent offers, inventory, steamcommunity.com/dev/apikey page) — only the information listed in section 4 is extracted from them;
the sessionid value of the steamcommunity.com page, used solely to send offers from that same page;
the text of the Steam Web API key: the page is parsed only to find out whether a key exists and which domain is declared; the key itself is discarded immediately and never stored.

3a. Your Steam friends' inventories (optional)

If you turn it on ("Also look in my Steam friends' inventories", off by default), the extension reads, in your browser, your Steam friends list and their public CS2 inventories to suggest items of a similar value to yours. This data:

stays in the extension, until you run the scan again or turn the option off, and in the page you are viewing;
is never sent to or stored by SkinFlip: only item names are sent to get indicative prices, without any person's identifier;
is only used to show you suggestions; each offer to a friend is sent only after your click in the extension's window, then your confirmation in Steam Guard.

You can turn this option off at any time; the cache is then cleared. [TO COMPLETE: legal basis (user's legitimate interest, local processing) to be validated by the lawyer, see docs/compliance-flags.md F16]

4. What is sent to SkinFlip

Data	When	Why
Pairing code	once, at pairing	link the extension to your account
SteamID64	pairing and requests	identify your account
Inventory items (assetId, classId, instanceId, name, type, rarity, tradable or not, trade protection, inspect link, image URL, stickers, charms)	when you open SkinFlip's trade screen and SkinFlip cannot read your inventory itself (read by the extension in your browser, without asking for confirmation), or when you click "Send my inventory to SkinFlip" on Steam	listings, matches, whitelist
Pre-flight check results (booleans): mobile authenticator active, trade-hold days, API key present, declared domain, confirmation that you created the key, inventory public, check date	when Active Trading prerequisites are checked, with your agreement	verify activation conditions
Active Trading offer statuses (job identifier, status, Steam offer identifier, Steam error code, timestamp)	after each send and status change	tracking offers, credits, limits
Trade-history events (accepted, reversed, declined, cancelled + Steam offer identifier)	only if you have enabled this option	updating proposals, reputation and credits
Substitution alerts (reason, offer identifier, job identifier, SteamID64 of the suspicious partner)	when an alert is raised	immediate suspension of Active Trading, moderation
Extension version and browser	pairing and requests	compatibility and support

5. What is stored in the extension

The pairing token, the device identifier, the public key used to verify signed batches and its identifier, your settings, a copy of your local Active Trading rules (whitelist, maximum overpay, daily cap) and the recent state of sent offers. This data stays on your device and is deleted when you unpair or uninstall the extension.

6. What the extension never collects

your Steam password;
your Steam Guard codes;
your Steam Web API key;
your Steam session cookies or tokens (steamLoginSecure, sessionid, access or refresh tokens);
Steam login QR codes;
your identity_secret, your shared_secret, a maFile or your revocation code;
your browsing history or the content of other websites;
no telemetry beyond the trade events described above.

The extension shows no advertising and no data is sold.

7. Server-side protection

The SkinFlip API automatically rejects any request from the extension containing data that looks like one of the secrets listed in section 6, before any processing. This check is covered by automated tests.

8. Your choices and consents

Inventory import only concerns your own account, when you open SkinFlip's trade screen or when you click from your Steam inventory page. To prevent it, unpair or uninstall the extension.
Trade-history reporting is an option, off by default, which you can withdraw at any time in the extension settings.
Prerequisite checks and Active Trading only work with your explicit agreement (see the Active Trading terms).

9. Limited use and sharing

Data received from the extension is used only to provide the features described in section 1. It is not sold, not used for advertising or to determine creditworthiness, and not transferred to third parties other than the processors listed in the Privacy policy and as required by law.

10. Retention

Retention periods are those of the Privacy policy (in particular: extension devices until revoked + 90 days; Active Trading offers for the life of the account).

11. Revocation and uninstalling

You can unpair the extension at any time from the extension itself or from the "Devices" page of your account, which immediately invalidates its token. You can also uninstall the extension from your browser.

12. Security of the extension

Open-source code, reproducible builds, every release subject to approval by two people, public changelog, minimal permissions. Offer batches are signed by our servers and the extension rejects any batch that is unsigned, expired or inconsistent with your local rules.

13. Contact

privacy@skinflip.app (personal data) — security@skinflip.app (vulnerabilities).