Privacy Policy

1Summary

• Skinrush is a simulator with play money. There are no purchases, deposits or cash-outs – we don’t process any payment data.
• For an account, we need a username, an email address and a password or a connected account (Discord, Steam). As a guest you play without these details, under a randomly assigned name.
• The app shows ads through Google AdMob – personalized only if you consent. Rewarded videos only play when you start them yourself. We don’t sell data.
• The website uses no tracking cookies and no analytics tools.
• You can delete your account in the app at any time – your data is then permanently removed.

2Website

When you open skinrush.app, your browser necessarily transmits data to our server: IP address, date and time, the address requested, the previously visited page, and browser and operating system. We need this to deliver the site and protect it from abuse (Art. 6(1)(f) GDPR), and keep it only as long as operation and security require.

Images of cases and skins come from cdn.skinrush.app via the network of Cloudflare, Inc. (USA). The band showing the current Live Event loads public data from api.skinrush.app. The same technical data is transmitted in each case.

We serve fonts ourselves; no data goes to Google or other font providers.

If you choose a language with the switch, a cookie (“locale”, one year) remembers your choice so skinrush.app greets you in that language next time. Whether sounds are on or off is stored locally by your browser. Both serve only the function you chose and are permitted without consent (Section 25(2) no. 2 TDDDG).

The games to try out (cases, Mines, Provably Fair) run entirely in your browser; nothing is sent to us.

3Playing in the browser (play.skinrush.app)

On play.skinrush.app the app runs in your browser – with the same account and the same data as on your phone (see the following sections). When you open it, your browser transmits the same technical data as for the website.

To keep you signed in, your sign-in token is kept in this site’s local browser storage (localStorage), together with your settings (such as language and sounds) and cached game data so the page loads faster. This is necessary for the game and permitted without consent (Section 25(2) no. 2 TDDDG). When you sign out, we remove the token and the game data.

There are no ads, no push notifications and no usage statistics in the browser.

When you sign up in the browser, Cloudflare Turnstile (Cloudflare, Inc., USA) checks that a human is filling in the form, so nobody creates accounts automatically in bulk. To do so, Turnstile evaluates data about your browser and your connection, including your IP address; our server checks the result with Cloudflare and sends your IP address along. The legal basis is our legitimate interest in protecting accounts and the game from abuse (Art. 6(1)(f) GDPR). More in Cloudflare’s privacy policy at cloudflare.com/privacypolicy.

4Your account

When you sign up in the app or in the browser, we store:

• username – visible to other players, for example in Battles, Trades and the Leaderboard
• email address – visible only to you; for codes to verify it, reset your password, change your email and delete your account
• password – only as a hash, never in plain text
• app language, so emails and notifications arrive in your language
• time of sign-up

If you play as a guest, we store neither an email address nor a password – only a randomly assigned username, the app language and the time you started. A guest account can only be reached through the sign-in token on your device until you secure it in Settings with an email address or a connected account. Until then you don’t appear on any leaderboard or in player search.

The legal basis is the contract of use (Art. 6(1)(b) GDPR): without this data we cannot provide you with an account. To keep you signed in, the app stores a sign-in token in your device’s secure storage (Keychain or Keystore), the browser in the local storage of play.skinrush.app.

5Signing in with Discord or Steam

If you connect a Discord or Steam account, we receive from that service:

• Discord: account ID, display name, profile picture and – if verified with Discord – your email address. To keep name and picture up to date, we store a Discord refresh token.
• Steam: Steam ID, display name and profile picture.

The profile picture of a connected account may appear as your profile picture in Skinrush. The privacy policies of Discord Inc. and Valve Corporation (both USA) also apply to signing in. You can disconnect at any time in Settings; we then delete that account’s data (Art. 6(1)(b) GDPR).

6Progress and social features

For the game to work, we store what you do and own in Skinrush: coins and diamonds with their transaction history, inventory and loadout, drops, Upgrader, Trade Ups, Mines rounds, Battles, Shop purchases, Bank, level, XP, statistics, playtime for Playtime Rewards and the seeds for Provably Fair (Art. 6(1)(b) GDPR).

Friends, friend requests, trades and gifts are stored with the accounts involved. Who may see your profile with inventory and statistics is up to you in Settings: everyone, friends only or no one. Other players see your username and profile picture wherever you play or trade together.

7Emails

We send emails with codes (verify address, reset password, change email, delete account) via Plunk (useplunk.com) as a processor. Plunk receives your email address and the message for this. We don’t send newsletters or advertising.

8Push notifications

If you allow notifications, the app registers a push token for your device and the platform (iOS or Android) with our server. We send notifications – for example about friend requests, trades, gifts or a full vault – via Expo’s push service (650 Industries, Inc., USA), which forwards them to Apple or Google. The token and the text of the message are transmitted.

You choose which notifications you get in Settings, and you can revoke permission at any time in your system settings (Art. 6(1)(a) GDPR). Tokens of signed-out devices are deleted automatically.

9Usage statistics in the app

To understand which screens and features are used, the app sends usage data to our analytics tool Portus (portus.sh):

• screens viewed – without usernames or item IDs in the address
• selected actions: sign up, start as a guest, sign in, open case, Upgrader, Trade Up, create battle, start Mines, Shop purchase, apply sticker, rewarded video watched
• a random installation ID, app version, build, platform and operating system version
• your user ID while you’re signed in, plus username and profile picture when you sign in

Passwords, sign-in tokens and email addresses are never transmitted. We use the data only to improve Skinrush, not for advertising (Art. 6(1)(f) GDPR). You can object at any time by email.

10Ads in the app (Google AdMob)

The app is funded by ads: an ad when you open the app, ads between list entries (labelled “Ad”) and rewarded videos you start voluntarily. The ads come from Google AdMob, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); data may also go to Google LLC (USA). The website shows no ads.

So that ads can be delivered, counted and checked for fraud, Google processes:

• your device’s advertising ID (iOS: IDFA, only if you allow it; Android: advertising ID)
• IP address and an approximate location derived from it, device model, operating system, language and app version
• interactions with ads: whether an ad was shown or tapped, or a video was watched to the end

On first launch, the app uses Google’s consent dialog (Google User Messaging Platform) to ask whether Google may store and access information on your device and show you personalized ads (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). On iPhone, iOS also asks whether the app may track you across apps (App Tracking Transparency). Without consent, Google shows only limited, non-personalized ads. You can change your choice at any time in the app under Settings → Privacy options, and the tracking permission in the system settings, where you can also reset the advertising ID.

Rewarded videos: so that we can credit the reward, the app includes your user ID and the type of reward (such as “coins”) in its request to Google. When you’ve watched a video to the end, Google reports this to our server with a transaction number, your user ID and the reward. From this we store when you received which reward, for the daily limits, for 30 days (Art. 6(1)(b) GDPR).

Google explains how it uses this data at policies.google.com/technologies/partner-sites and in its privacy policy (policies.google.com/privacy).

11Servers and security

A hosting provider runs our server and database on our behalf. The server processes your IP address with every request: we use it to limit abuse, such as too many sign-ups or failed sign-ins (for this it is kept only briefly in memory), and it appears in server logs for troubleshooting. We don’t store IP addresses in the database (Art. 6(1)(f) GDPR).

12Error reports

If an error occurs in the app, on the website or on our server, an error report is sent to GlitchTip, our debugging tool, which we run ourselves on our own server. A report contains the error message with the location in the code, the app or website version, device model, operating system or browser, and the steps shortly before the error, such as pages visited and requests to our server (without their content).

We don’t add cookies, sign-in tokens, passwords, request contents or your IP address. We use the reports only to find and fix errors and delete them after 90 days (Art. 6(1)(f) GDPR).

13Recipients and transfers to third countries

We only pass data to the service providers named, insofar as they need it for their task. Some are based in the USA (Cloudflare, Expo, Discord, Valve, Apple, Google). Transfers are based on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, otherwise on the European Commission’s standard contractual clauses (Art. 46 GDPR).

14Retention and deletion

We store your data as long as your account exists. You can delete it at any time in the app under Settings; for security, you confirm with a code sent by email (without an email address on file, for example as a guest, confirming in the app is enough). We then permanently delete your account, inventory, history, friendships, connected accounts and push tokens. In Battles with other players your seat remains, but your name is replaced with “Deleted user”.

Guest accounts that were never secured and haven’t been used for a year are deleted automatically – without a way to sign in they can no longer be reached anyway.

Codes sent by email expire after a short time and are deleted once used.

15Your rights

You have the right to:

• access the data stored about you (Art. 15 GDPR)
• rectification of incorrect data (Art. 16 GDPR)
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on our legitimate interest (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

Much of this works directly in the app: change your email address and password, disconnect connected accounts, set profile visibility and notifications, and delete your account.

16Children and young people

Skinrush is for ages 13 and up (see Terms of Use). We don’t knowingly collect data from younger children; if we learn of it, we delete the account.

17Changes

If features or service providers change, we update this policy. The version published here applies; the date at the top shows when it was last updated.