Privacy Policy

Effective date: May 27, 2026

1. Controller

Korydian Labs Ltd.
Centris Business Gateway, Level 4/W, Triq is-Salib ta' L-Imriehel, Zone 3, Birkirkara CBD 3020, Malta
Represented by: Justin Hennies (Sole Director)
Company Registration No.: C115846 · VAT No.: MT32853425
Email: info@korydian.com / contact@skinfolio.net

No Data Protection Officer has been appointed as the requirements for doing so are not met.

2. Overview

SkinFolio is a portfolio tracker for CS2 skins. We only process the data necessary to operate the service. We use no third-party marketing cookies and no tracking pixels. For reach measurement we use two tools: Google Analytics 4, whose cookies are only set with your consent (details, including the cookieless Google Consent Mode signals, in Section 5.3), and Plausible Analytics, which works cookieless (Section 5.5). For affiliate attribution and to measure the effectiveness of our marketplace links we operate a first-party tracking system on our own infrastructure (see Section 5.4).

3. Data We Collect

3.1 Account Data

When you register and sign in:

• Email/password login: Email address and encrypted password
• Steam login: Steam ID and Steam display name (via Steam OpenID). This data is only transmitted when you actively use Steam login.
• Steam account linking: You can link an email account to your Steam account later. After a server-verified Steam sign-in that you actively initiate, your Steam ID is permanently associated with your account and stored in an internal registry that ensures one Steam ID can only be linked to one account.

3.2 Portfolio Data and Settings

Data you enter to use the service:

• Investments (skin name, purchase price, purchase date, marketplace)
• Sold items (sale price, sale date)
• User settings (preferred marketplace, currency, display name, linked Steam ID, friend code and — optionally — your Steam trade URL, see the Giveaways section)

3.3 Technical Data

• IP address: Processed by Cloudflare as part of hosting and in server-side security and error logs (e.g. rate limiting, failed Steam sign-ins)

4. Legal Basis

• Art. 6(1)(b) GDPR (Contract performance): Account and portfolio data are processed to provide you with the service.
• Art. 6(1)(a) GDPR (Consent): Steam login and optional features that you actively use.
• Art. 6(1)(f) GDPR (Legitimate interest): Technical data for the security and operation of the website.

5. Cookies and Local Storage

5.1 Cookies

SkinFolio does not set any cookies of its own for core functionality. Authentication via Firebase uses IndexedDB (a browser-internal storage mechanism). Cloudflare may set technically necessary cookies for bot detection (__cf_bm). These are required for secure operation and do not require consent (Maltese ePrivacy implementation, S.L. 586.01, implementing Art. 5(3) of the ePrivacy Directive 2002/58/EC).

We use no third-party marketing cookies and no tracking pixels. The only first-party cookie we set without consent is sf_ref for affiliate attribution — see Section 5.4.

5.2 localStorage and IndexedDB

We use your browser's localStorage and IndexedDB to store price data, settings, and offline caches locally. This data remains on your device and is not transmitted to our servers. This storage is required for the features you use (S.L. 586.01 / Art. 5(3) ePrivacy Directive).

5.3 Google Analytics 4 (Consent Mode v2, “Advanced”)

We use Google Analytics 4 (GA4) by Google Ireland Limited / Google LLC for usage statistics. In full transparency, this is how it works technically:

• The GA4 script is loaded on every page view — for technical reasons via our own domain (first-party delivery through the Cloudflare infrastructure).
• Without your consent (before you decide, or after “Reject all”) no cookies are set and no persistent identifiers (client ID) are assigned. Only cookieless, aggregate signals (“pings”) are then sent to Google for statistical traffic modeling; they do not allow recognizing an individual user across page views. As with any internet request, your IP address is transmitted to Google at the transport level; Google states it does not log it for these signals.
• Only after you click “Accept all” does GA4 set the cookies listed below and measure your usage across sessions.

Legal basis: For setting cookies, Art. 6(1)(a) GDPR (consent) in conjunction with the Maltese ePrivacy implementation (S.L. 586.01); for the cookieless aggregate signals, Art. 6(1)(f) GDPR (legitimate interest in aggregate reach measurement without device access).

Data processed: Pages visited, session duration, device type, browser, referrer, and in-app interaction events (e.g. adding or selling a portfolio item, including item name and value — without your name or account ID). GA4 masks IP addresses by default.

Data recipient: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Transfer mechanism: EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses (SCCs).

Cookies set by GA4:

Withdrawal of consent: You can withdraw your consent at any time by clicking “Cookie Settings” in the footer of any page. Upon withdrawal, all analytics cookies are deleted; the service then remains in the cookieless mode described above (aggregate signals without identifiers).

Google Privacy Policy · Google Analytics Opt-Out Browser Add-on

5.4 First-Party Affiliate Attribution and Marketplace-Click Statistics

To measure the effectiveness of our affiliate links and to understand which content drives users to marketplaces, we operate a first-party tracking system on our own infrastructure (Cloudflare KV). This data is never shared with third parties, never used for personalized advertising, and never combined with profiles from external services.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the effectiveness of the affiliate model that finances the free operation of SkinFolio). You may object at any time via contact@skinfolio.net (Art. 21 GDPR).

What is collected:

This data is stored in Cloudflare KV inside our own account. Cloudflare acts as a processor under Art. 28 GDPR.

5.5 Plausible Analytics (cookieless)

For privacy-friendly reach measurement we use Plausible Analytics (Plausible Insights OÜ, Estonia — EU hosting). The script and measurement events run through our own domain (first-party proxy) and are forwarded from there to Plausible; your IP address and user agent are transmitted to Plausible and processed there only transiently for visitor counting (daily-rotating hash, no persistent storage of the IP). Plausible is cookieless and sets no cross-device identifiers; only aggregate metrics (e.g. page views, referrer, country, device type) are evaluated, with no identification of individual users.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly reach measurement); no access to information stored on your device within the meaning of S.L. 586.01 takes place. You may object to this processing at any time via contact@skinfolio.net (Art. 21 GDPR).

6. Third-Party Data Sharing

We share your data with third parties only to the extent necessary to operate the service.

6.1 Google / Firebase (USA)

Firebase is used for authentication (Firebase Auth) and data storage (Firestore). The following data is processed: email address, encrypted password, IP address, session tokens, and your portfolio data. Data is stored on servers in the USA.

Transfer mechanism: EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses (SCCs). A Data Processing Agreement (DPA) with Google is in place per Art. 28 GDPR.
Google Privacy Policy

6.2 Cloudflare (USA)

Cloudflare is used for hosting, CDN, security, and server-side data storage (Workers KV, D1). IP addresses and technical metadata are processed. Cloudflare is ISO 27001 and C5:2020 certified.

Transfer mechanism: EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses (SCCs).
Cloudflare Privacy Policy

6.3 Valve / Steam (USA)

When using Steam login or Steam account linking, your Steam ID and display name are transmitted by Valve. This only occurs when you actively initiate the process (legal basis: Art. 6(1)(a) GDPR, consent). For features such as the inventory viewer and giveaways we additionally fetch publicly accessible Steam profile data (display name, avatar, public inventory, VAC/trade-ban status) via the Steam interfaces.
Steam Privacy Policy

6.4 Price Data Sources

Market prices are fetched server-side from the APIs of multiple trading platforms (e.g. Skinport, CSFloat, Steam, SkinBaron, Tradeit). No personal data of our users is transmitted to these services during these requests. If you click a marketplace link you are taken to the respective platform, whose own privacy policy applies.

6.5 Plausible Insights OÜ (EU)

Recipient of the cookieless reach measurement described in Section 5.5 (IP address and user agent transiently, measurement events in aggregate). Processing takes place on EU servers; a Data Processing Agreement per Art. 28 GDPR is in place with Plausible.
Plausible Privacy Policy

6.6 Hetzner Online GmbH (EU)

For price history, search, and portfolio history data we operate a database on servers of Hetzner Online GmbH (Germany/Finland, EU). Pseudonymous user IDs with portfolio history values are processed there; Hetzner acts as a processor under Art. 28 GDPR.
Hetzner Privacy Policy

7. Giveaways

On /giveaway we run free prize draws (details in the Giveaway Terms). In doing so we process:

• Entry: Your account ID, your Steam ID, and a snapshot of your public Steam display name and avatar. Entering requires a proven Steam identity (Steam login or Steam account linking).
• Public display: The giveaway page publicly shows the display names and avatars of recent entrants and — after the draw — the winner’s name, avatar, and masked Steam ID (Art. 6(1)(b) GDPR; on winner publicity see also §15 of the Giveaway Terms). The draw data (seeds, hashes, winner index, any re-draw history) remains permanently viewable as the public fairness record.
• Automated eligibility pre-check: On entry, the cached public VAC/trade-ban status of your Steam account is checked (an entry requirement under the Giveaway Terms). Prize awarding and delivery are handled by humans.
• Prize handling: If you submit a claim as a winner, we store your Steam trade URL and, optionally, a contact and message. If you store your trade URL in Settings, we additionally keep it in a server-side cache (up to 12 months) so prize claims can be prefilled and prizes delivered promptly.
• Disclosure to giveaway hosts: If a giveaway is hosted by a partner creator (identified on the page), that host receives the winner data required for prize delivery (Steam ID, display name, trade URL, contact if provided) — solely for their own giveaway (Art. 6(1)(b) GDPR).

8. Additional Features

• Friends system: Optionally, you can generate a friend code and send/accept friend requests. Your friends see your display name and aggregate portfolio figures (snapshots) (Art. 6(1)(b) GDPR).
• Public share cards (“Wrapped”): If you actively create a share card, the image you generate with portfolio figures is made available under a public URL (retained roughly 90 days or per the option you choose).
• Feedback widget: If you send feedback, we store the category, message text, page, truncated user agent, and — if signed in — your account ID for 90 days (Art. 6(1)(f) GDPR).
• Public inventory viewer: SkinFolio can display and value the public Steam inventory of any Steam ID. This data comes exclusively from publicly accessible Steam interfaces and is cached briefly (inventory ~6 hours, profile data ~24 hours). The legal basis is Art. 6(1)(f) GDPR; as the holder of a Steam account you can block the display of your inventory on SkinFolio at any time via the inventory page or by contacting contact@skinfolio.net.

9. Data Retention

• Account and portfolio data: Retained until you delete your account
• Trade URL (server-side cache): Up to 12 months from the last save
• Feedback and click statistics: 90 days
• Share card images: ~90 days or per the option you choose
• Giveaway draw data: Permanent, as the public fairness record (see Section 7); draw-related entries (e.g. entry index, masked winner data) are unaffected by account deletion
• Inactive accounts: We reserve the right to delete accounts after an extended period of inactivity
• Technical data (Cloudflare): Per Cloudflare's retention policies

10. Your Rights

Under the GDPR, you have the following rights:

• Access (Art. 15): What data we store about you
• Rectification (Art. 16): Correction of inaccurate data
• Erasure (Art. 17): Deletion of your data
• Restriction (Art. 18): Restriction of processing
• Data portability (Art. 20): Export of your data in a common format
• Objection (Art. 21): Object to processing
• Withdrawal of consent (Art. 7(3)): You may withdraw any given consent at any time. The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise your rights, contact: contact@skinfolio.net

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority in Malta:

Information and Data Protection Commissioner (IDPC)
Level 2, Airways House, High Street, Sliema SLM 1549, Malta
https://idpc.org.mt

12. Children

We do not knowingly collect data from children under 16. If we become aware of such data, we will delete it immediately.

13. Automated Decision-Making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. The automated eligibility pre-check for giveaways (Section 7) enforces the Giveaway Terms; prize awarding is done by humans.

14. Changes

We may update this privacy policy as needed. The current version is always available on this page.

15. Contact

For questions about data protection:
Email: contact@skinfolio.net