Privacy Policy

Who we are

SkinLab ("we", "us") runs the marketplace at skinlab.gg. For any privacy question, write to contact@skinlab.gg.

What we collect

When you sign in with Steam

• Your public Steam ID, display name and avatar, which Steam shares with us when you sign in. We never see your Steam password.
• Your Steam trade URL, if you add it, so we can send you trade offers.
• Your public CS2 inventory, read from Steam when you open the sell page.

When you trade

• Your purchases, sales, trade offer IDs and their status.
• Your balance history: deposits, purchases, earnings and withdrawals.
• For deposits, the crypto address we created for you. For withdrawals, the wallet address you give us.

Merchants

• Email address and a securely hashed password.
• Details of the Steam accounts you connect (login, password, Steam Guard file and proxy). These are encrypted and only used to trade on your behalf.

Technical data

Our servers keep standard logs (such as IP address, browser and time of request) for security and to fix problems. We use two strictly necessary cookies: one keeps you signed in, one keeps merchants signed in. We don't use advertising or tracking cookies. We count page views with Vercel Web Analytics, which uses no cookies and doesn't identify you.

How we use it

• To run the marketplace: show you items, send and track Steam trades, and keep your balance correct.
• To keep it safe: prevent fraud, chargebacks and money laundering, and enforce our Terms.
• To meet legal duties, such as keeping transaction records.

Who we share it with

• Valve / Steam, because every trade happens through Steam.
• Our payment processor, to create deposit addresses and confirm deposits.
• Hosting and database providers that store data for us under contract, including Vercel, which hosts the website.
• Authorities, when the law requires it.

We never sell your data.

How long we keep it

We keep transaction and balance records for as long as the law requires for financial records, even if you stop using SkinLab. Money earned from trades stays pending for about 7 days because Steam can reverse trades during that time; the related records are kept at least that long. Other data is deleted when it's no longer needed.

Your rights

Depending on where you live, you can ask to see, correct, export or delete your data, or object to how we use it. Write to contact@skinlab.gg. Some records (like completed transactions) may have to be kept by law.

Security

Data is sent over encrypted connections. Sessions are signed, merchant passwords are hashed and merchant account secrets are encrypted at rest. No system is perfectly secure, so please keep your Steam account protected with Steam Guard.

Changes

We'll update this page when our practices change and show the date of the latest version at the top.