Privacy
This policy describes what SKINOX collects, why, who else sees it, and how long it is kept. It covers the website skinox.trade and the SKINOX Trade Helper browser extension. It is written from what the service actually does.
What we never ask for. SKINOX never asks for your Steam password, a Steam Guard code, or your Steam cookies, and never will. Nobody from SKINOX will ever ask you for them either.
What we collect
When you use SKINOX, we keep:
- Your Steam account. Signing in with Steam gives us your Steam ID. From Steam's public profile we also keep your Steam name, avatar, the date your Steam account was created and whether your profile is public, and refresh them from time to time.
- Your trade link. The Steam trade URL you give us, so the other side of a trade can send or receive the item. It is shown only to the person you are trading with.
- Your inventory. A copy of your public CS2 inventory each time it is synchronised: the items, their attributes (such as float and pattern) and the pictures Steam serves for them. When one of your listings is bought, we read it again to confirm the item is still there.
- What you buy and sell. Listings, orders, bargains, buy orders, trade offers and their status, reviews you write, and when each thing happened.
- Money. Top-ups, your Balance, fees, payouts, refunds, referral commissions and withdrawals, as entries in our ledger. For a withdrawal we keep where you asked it to be paid: your SofizPay account, or your CCP account number and the account holder's name.
- Referrals. Your referral code, who invited you (if anyone), and the commissions earned from the people you invited.
- Support. The messages and screenshots you send in a support ticket, and our replies.
- Notifications. The notifications we send you, and, if you turn on browser notifications, the push address your browser gives us for this device.
- Security records. Your signed-in sessions (with the browser they were opened from), and a log of important actions — signing in, money moving, operator decisions — so they can be checked later.
We do not use advertising or analytics trackers, and we do not sell your data to anybody.
Cookies and browser storage
SKINOX sets only the cookies it needs to work:
- A session cookie that keeps you signed in, for up to 30 days.
- A short-lived cookie, for 10 minutes, that protects the Steam sign-in against forgery.
- If you arrive through somebody's invite link, a cookie holding their referral code for 30 days, so they are credited when you sign up.
Your browser also remembers a few conveniences on your own device only — for example the payment method you last used, the name, phone and email you last typed for a card payment, and the account you last withdrew to — so you do not have to type them again. They are not sent to us until you submit a payment or withdrawal.
The browser extension
Sellers use the SKINOX Trade Helper extension to send and track the Steam trade offers for their own sales, from their own browser.
- It uses the Steam session already in your browser only to talk to Steam: to send your trade offers and to read their status. Your Steam cookies and access token stay in your browser and are never sent to SKINOX or anyone else.
- It sends SKINOX only facts about your own SKINOX trades: which offer was sent for which sale, and what became of it (accepted, declined, countered).
- To prove a trade happened, it can produce a cryptographic proof of what Steam's own servers answered about that trade. The proof is checked by SKINOX's verification service and carries only that answer, not your login.
- It keeps its own working state on your device: which offers it sent, when it last checked them, and a short-lived copy of Steam's access token.
Who else sees it
Only these third parties receive anything:
- Valve (Steam). When we read your public profile, your public inventory or an item's price, and when trade offers are sent. They already hold this — it is your Steam account.
- SofizPay. Our payment provider. For a card payment (CIB or Edahabia) they receive the amount and the name, phone and email you enter, and you pay on their payment page: SKINOX never sees or stores your card details, and does not keep that name, phone or email. SofizPay payments and SofizPay withdrawals move over the Stellar network, where a transfer's amount and accounts are public, as on any blockchain.
- Algérie Poste. For a CCP withdrawal, the account number, holder name and amount, so the money can be paid in.
- The 3D viewer. When you open an item in 3D, the viewer's service receives the item you are looking at. That item data is already public, but the fact that you looked is disclosed to them.
- The person you trade with. Your Steam name, avatar, trade link and the details of the trade between you. Reviews you write are public.
- Your browser's push service. If you turn on browser notifications, the notification is delivered through the service your browser uses (for example Google or Mozilla).
We will also hand over information when the law of Algeria requires it, and only what is required.
Where it is kept
SKINOX runs on a server rented from Contabo GmbH, in its data centre in Lauterbourg, France. Our database, uploaded screenshots and backups are stored there.
How long we keep it
- Your inventory copy is replaced each time it is synchronised.
- Sessions end after 30 days, or when you log out.
- A device's push address is removed when you turn notifications off, or when the browser stops accepting them.
- Server logs, which record each request and the account it came from, rotate out as they fill up. Backups are kept for 30 days.
- Orders, trades and financial records are kept indefinitely. They are append-only — never edited or deleted — because they are the evidence of a transaction between you and another person, and neither of you can be left without it.
Your choices and asking us
You can change your trade link, turn notifications off, or log out of a device at any time. To ask what we hold about you, to correct it, or to close your account, open a ticket on the Support page. We will tell you what we hold. We cannot delete orders or financial records tied to completed transactions, for the reason above, and we will say so plainly rather than quietly ignore the request.
When this policy changes, the date below changes with it.