Draft to be reviewed by a lawyer — do not publish as is.
This English version is provided for convenience; the French version prevails in case of discrepancy.
Privacy policy
This policy explains how SkinFlip processes your personal data, in accordance with Regulation (EU) 2016/679 (the "GDPR") and French law no. 78-17 of 6 January 1978 ("Informatique et Libertés"). How the extension works is detailed on a dedicated page: Gardien extension privacy. Cookies are described in the Cookie policy.
1. Controller
- Controller: [TO COMPLETE: company name, legal form, registered office, RCS] (see the Legal notice).
- Contact for your data: privacy@skinflip.app.
- Data protection officer: [TO COMPLETE: whether a DPO is appointed, and contact details].
2. Our principles
- Data minimisation: we only collect what the service needs.
- Your Steam credentials never leave your browser. Our servers never collect, receive or store: your Steam password, Steam Guard codes, Web API key, Steam session cookies or tokens, Steam login QR codes,
identity_secret,shared_secret, maFile or revocation code. Any such data sent to our API by mistake is automatically rejected (a check covered by automated tests). - Steam data fetched only at your request: when you sign in and accept our terms, or when you ask for your inventory to be imported.
- Hosting in the European Union: France (application, Paris) and Germany (database, Frankfurt).
- No sale of data, no ad targeting, no profiling for advertising.
3. Data processed
| Category | Data | Source |
|---|---|---|
| Steam identity | SteamID64, persona name, avatar, profile URL | Steam OpenID (sign-in) and the Steam Web API |
| Steam trust information | Steam level, account creation date (if the profile is public), profile and inventory visibility, bans (VAC, community, trade/economy ban) | Steam Web API (GetPlayerSummaries, GetPlayerBans, GetSteamLevel), cached for 24 h |
| SkinFlip account | language, role, account state, sign-up date, declaration of legal age, versions and acceptance dates of the Terms of use, Terms of sale and Active Trading terms, settings | you |
| Trade offer link | URL, partner identifier, token | you |
| Inventory | item identifiers (assetId, classId, instanceId), name, type, rarity, wear (float), pattern seed, paint index, phase, stickers, charms, inspect link, image, tradability, trade protection | the extension (at your request) or a server-side import at your request |
| Listings and searches | items offered, items wanted, note, status, boosts | you |
| Matches, proposals and trades | participants, items, scores, statuses, Steam offer identifiers, timestamps, Gardien and D+8 checks | computed by us, the extension |
| Reputation | number of definitive trades, cumulative value, account age, cancellations, abusive reversals, confirmed reports, score | computed by us |
| Messaging | messages between participants of a proposal, moderation flags | you |
| Moderation | notices, decisions and statements of reasons, appeals, linked-account signals, list of banned SteamIDs | you, other users, us |
| Active Trading | rules, whitelist, planned offers and their statuses, Steam error codes, substitution alerts, consent | you, the extension, computed by us |
| Extension devices | device identifier, hash of the pairing token, version, browser, last activity, results of pre-flight checks (booleans) | the extension |
| Credits and payments | balances, credit ledger entries, Stripe references, subscription, invoices | us, Stripe |
| Technical and security logs | audit log of sensitive actions, hashed IP address, user agent, timestamps | automatically |
| Support | exchanges with our team | you |
We do not process special categories of data within the meaning of Article 9 GDPR. Steam does not send us any e-mail address. Stripe may ask for an e-mail address at payment to send the receipt.
4. Purposes and legal bases
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Account creation and management, authentication through Steam OpenID | performance of the contract (Terms of use) |
| Display of the Steam profile and trust badges | performance of the contract; legitimate interest (scam prevention) |
| Inventory import, listings, search, matches, trade proposals, messaging | performance of the contract |
| Offer checks by Gardien | performance of the contract |
| Trade-history reporting by the extension | consent (an option you can enable and withdraw in the extension) |
| Reputation computation and D+8 verification | performance of the contract; legitimate interest (trade reliability) |
| Active Trading (planning, signed batches, statuses) | performance of the contract (specific terms expressly accepted) |
| Payments, invoicing, accounting | performance of the contract; legal obligation (accounting retention) |
| Moderation, handling of notices, statements of reasons, appeals | legal obligation (DSA); legitimate interest |
| Automatic message analysis (scam keywords) | legitimate interest (scam prevention) |
| Linked-account signals, list of banned accounts | legitimate interest (fraud prevention and prevention of sanction evasion) |
| Security, rate limiting, audit log | legitimate interest (security); legal obligation where applicable |
| Look-alike domain monitoring (phishing) | legitimate interest (user protection) |
| Technical error tracking (Sentry) | legitimate interest (service reliability) |
| Affiliate-link click statistics | legitimate interest (aggregated measurement) |
| Responding to requests from authorities | legal obligation |
| Non-essential cookies | consent (none at launch, see the Cookie policy) |
Where processing is based on legitimate interest, you may object to it (section 7).
5. Automated decisions and profiling
- Reputation score: an automated computation based solely on trades definitive at D+8, cancellations, abusive reversals, confirmed reports and account age. It is shown on your public profile and used for access thresholds (three-way loops, Active Trading). Its method is described on the Transparency page.
- Automatic message analysis: it may show a warning, mask a link or create a report; it never imposes a sanction.
- Linked-account signals: reviewed by a human moderator; never an automatic ban.
- Automatic suspension of Active Trading after a substitution alert: a protective, reversible measure for your account, which you can have reviewed by a person.
No decision based solely on automated processing that produces legal effects or similarly significantly affects you is taken without human involvement: sanctions are always decided by a moderator.
6. Who sees your data
- Other members and visitors: your public profile (persona name, avatar, SteamID64, Steam level, account age if public, warning badges, reputation, number of definitive trades, sign-up date) and your listings.
- Your partners in a trade proposal: your messages, the items concerned and your trade offer link, which is needed to create the Steam offer.
- Other signed-in members: your tradable items (name, wear, pattern, stickers, charms, image, indicative price), unless you have turned off receiving offers.
- Members who send you an offer, unless you have turned off receiving offers: the token of your trade offer link is sent to their extension in a signed batch, solely for the purpose of sending the offer.
- Our team (moderators, administrators), on a least-privilege basis. Moderators only access a conversation's content in case of a notice, an automatic flag or an investigation.
- Our processors (section 8).
- Authorities, upon a lawful request.
- Valve, only when we report an account involved in a scam.
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability, objection (in particular to processing based on legitimate interest), to withdraw consent at any time, and, under French law, to set instructions regarding your data after your death (Article 85 of the Informatique et Libertés law).
- Export of your data (JSON format) and account deletion: directly from your settings.
- Other requests: privacy@skinflip.app. Your identity is verified through your Steam sign-in; no identity document is required unless there is reasonable doubt.
- We respond within one month, extendable by two months for complex requests.
- You can lodge a complaint with the CNIL (www.cnil.fr) or with the supervisory authority of your country of residence.
8. Processors and technical recipients
| Provider | Role | Data location | Safeguards |
|---|---|---|---|
| Vercel Inc. (USA) | application hosting | EU (Paris); possible technical access from the USA | data processing agreement (Article 28 GDPR), EU-US Data Privacy Framework and/or standard contractual clauses [TO VERIFY] |
| Neon, Inc. (USA) | database and backups | EU (Frankfurt); possible technical access from the USA | data processing agreement (Article 28 GDPR), EU-US Data Privacy Framework and/or standard contractual clauses [TO VERIFY] |
| SteamApis.com [TO VERIFY: legal name and country] | reading members' public Steam inventories | [TO VERIFY] | [TO VERIFY: data processing agreement (Article 28 GDPR) and transfer safeguards] |
| SteamWebAPI.com [TO VERIFY: legal name and country] | reading members' public Steam inventories | [TO VERIFY] | [TO VERIFY: data processing agreement (Article 28 GDPR) and transfer safeguards] |
| Stripe Payments Europe, Limited (Dublin, Ireland) | payments, subscription, VAT calculation (Stripe Tax) | EU; possible transfers to Stripe, Inc. (USA) | EU-US Data Privacy Framework and/or standard contractual clauses. Stripe also acts as an independent controller for its own obligations (know-your-customer, anti-money-laundering, fraud prevention) |
| Sentry — Functional Software, Inc. (USA) | technical error tracking, without SteamID or IP address | EU data region (Frankfurt); possible access from the USA | EU-US Data Privacy Framework and/or standard contractual clauses [TO COMPLETE: to be verified] |
| [TO COMPLETE: e-mail provider — only if e-mail notifications are added] | — | — | — |
Valve Corporation is not our processor. Steam is the source of the public data we retrieve through the Steam Web API with our own key, and the platform on which trades take place, under the Steam Subscriber Agreement. Item images are loaded from Steam's servers: your browser then sends your IP address to Valve.
The reference price provider receives no personal data.
9. Hosting and transfers outside the EU
Your data, including data obtained from Steam, is stored in the European Union (France and Germany), in accordance with the Steam Web API terms. The only possible transfers outside the EU are those listed in section 8 (Vercel, Neon, Stripe, Sentry), covered by the safeguards indicated.
10. Retention periods
| Data | Period |
|---|---|
| Account and profile | life of the account; deleted or anonymised no later than 30 days after closure |
| Steam snapshots (level, bans, visibility) | the latest one while the account is active; history 12 months |
| Trade offer link | life of the account |
| Inventory items | while the account is active; items no longer present deleted after 90 days |
| Listings | life of the account; withdrawn or expired listings deleted after 12 months |
| Proposals, Active Trading offers, verifications, reputation | life of the account, then kept pseudonymised for 3 years after closure (disputes, fraud), then deleted |
| Messages | 12 months after the last message; if linked to a notice, until the case is closed + 12 months |
| Notices, moderation decisions, statements of reasons, appeals | 5 years after the decision (Article 2224 of the French Civil Code) [TO COMPLETE: to be validated] |
| List of banned SteamIDs | while the ban is in force, reviewed every 3 years |
| Linked-account signals | 12 months |
| Substitution alerts | 3 years |
| Extension devices | until revoked + 90 days |
| Sessions | 30-day cookie; records deleted 30 days after expiry |
| Pairing codes | valid 10 minutes; deleted 24 hours after expiry |
| Audit and security logs (hashed IP) | 12 months |
| Invoices, Stripe references, credit ledger | 10 years (Article L123-22 of the French Commercial Code), pseudonymised after account closure |
| Proof of acceptance (versions and dates of the Terms of use, Terms of sale, Active Trading terms) | life of the account + 5 years |
| Cookie-choice cookie | 6 months |
| Alerts and notifications | 90 days |
| Affiliate-link clicks | 13 months, then anonymous aggregation |
| Sentry events | 90 days, personal data filtered out (no SteamID, no IP) |
| Encrypted backups | daily backups kept 30 days, weekly backups kept 12 weeks: erased data disappears from backups within 90 days at most |
[TO COMPLETE: the lawyer will confirm whether SkinFlip, as a host of user-generated content (listings, messages), must retain the identification data of content authors for 1 year (LCEN and decree no. 2021-1362 of 20 October 2021). The current design only keeps hashed IP addresses.]
11. Security
Encrypted connections (TLS, HSTS), session and pairing tokens stored only as hashes, encrypted and tested backups, mandatory two-factor authentication for moderators and administrators, audit log of sensitive actions, least privilege, hashed IP addresses, filtering of personal data in error reports. In case of a personal data breach posing a risk, we notify the CNIL within 72 hours and, if the risk is high, the persons concerned.
12. The Gardien extension
The extension processes the Steam pages the service needs locally and only sends SkinFlip limited information, with your agreement. It never collects your Steam credentials or secrets. Details: Gardien extension privacy.
13. Minimum age
The service is reserved for persons aged 18 and over. For information, in France a minor may consent alone to the processing of their data for information society services from the age of 15; this threshold does not apply here since the service is reserved for adults. If we learn that an account belongs to a minor, it is closed and its data deleted, subject to legal retention obligations.
14. Changes
Any material change to this policy is announced on the website before it takes effect. The date of the latest update appears at the top of this page.