Skin Scope

Privacy Policy

Effective from 5 November 2026

This policy explains what personal data is processed when you use Skin Scope (cs2skinscope.com), why, and what rights you have. The short version: there are no accounts, no analytics and no advertising trackers, and we collect as little as we can to run the site.

1. Who is responsible

The controller of your personal data is Nejc Miholic s.p., Ješenca 23f, 2327 Rače, Slovenia. Contact: [email protected].

2. What we process and why

Technical data when you visit

Like every website, when your browser loads a page it sends technical data: your IP address, the date and time, the page requested, the browser and operating system (user agent) and the referring page. This data passes through our content-delivery and security provider and reaches our web server, where it can be written to technical logs.

We use it only to deliver the site, keep it secure (for example to block attacks and abuse) and fix errors. Legal basis: our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR). Server logs are rotated automatically and kept no longer than 30 days, unless a specific entry is needed to investigate an attack.

Visitor statistics

To understand how the site is used, we count page views without cookies and without storing anything in your browser. For each page you open we record the page, the website that linked you to us (only its domain), your country (looked up by our content-delivery provider from your IP address), your device type (desktop, mobile or tablet), browser and operating system family (not versions), and the time. Searches you run on the search page are counted with the search term. While a page is open, your browser also sends a short signal once a minute so we can see how many people are on the site right now.

To count unique visitors, we combine your IP address and browser user agent with a random value that changes every day and run them through a one-way hash. We never store the IP address or user agent themselves, and each day's random value is deleted automatically within two days, after which nobody, including us, can link the statistics to you or tell whether you came back on another day. Known bots are ignored. Legal basis: our legitimate interest in understanding and improving the site (Article 6(1)(f) GDPR). The statistics are kept for up to 13 months.

Clicks on offers

When you click an offer to visit a marketplace, we record which item, variant and exterior it was for, which marketplace, where on the page the link was, your language and currency setting, and the time. We don't store your IP address or any other identifier with this record, so it can't be linked to you. We use these statistics to understand which marketplaces are useful and to settle affiliate and sponsorship arrangements.

The redirect is sent with Referrer-Policy: no-referrer, so the marketplace isn't told which page of our site you came from. If the link is an affiliate link, it contains our affiliate code, which tells the marketplace the visit came from Skin Scope — see our Affiliate Disclosure. Once you are on the marketplace's site, its own privacy policy applies.

Your settings

If you choose a display currency or language, that choice is stored in a cookie in your browser. It contains only the setting itself. Legal basis: it is needed to provide the feature you asked for. See the Cookie Policy.

Loadouts and likes

You can publish a loadout without an account. A published loadout shows the name you gave it, the author name you entered (if any), the skins in it and when it was published, to everyone. The author name is optional and can be any nickname; please don't use your real name or other personal information. Names are checked automatically for offensive words, and we remove loadouts that break our Terms.

To stop spam and fake likes, we store a keyed one-way hash of your IP address with each loadout you publish and each like you give. We never store the IP address itself, and the hash is only used to limit how many loadouts or likes can come from one network. When you like a loadout, a voter cookie with a random id is set so your browser can like each loadout only once; we store only a hash of that id with your like. Legal basis: our legitimate interest in keeping these community features fair and free of abuse (Article 6(1)(f) GDPR). Likes and hashes are kept as long as the loadout they belong to; you can ask us to delete a loadout you published.

A loadout you are still building, and the author name you last used, are saved only in your browser's local storage, not on our servers, until you publish.

Searches

Search terms you type are sent to our server to find matching items. We don't keep a search history tied to you; searches you run on the search page are counted anonymously in our visitor statistics (see above), and like any request they can appear in the technical logs described above.

Emails you send us

If you email us, we process your email address, name (if given) and the content of your message to reply and handle your request. Legal basis: our legitimate interest in answering messages (Article 6(1)(f) GDPR), or taking steps you asked for before a contract (Article 6(1)(b) GDPR), for example about a partnership. We delete correspondence once it is no longer needed, normally within 2 years, unless we must keep it longer by law or to establish, exercise or defend legal claims.

Disclosure to authorities

We pass personal data to courts, authorities or other parties only where the law requires us to (Article 6(1)(c) GDPR), or where it is needed to establish, exercise or defend legal claims, for example after an attack on the site (Article 6(1)(f) GDPR).

We don't sell personal data, don't use it for advertising, and don't make automated decisions about you.

3. Service providers

We use these providers to run the site. They process data on our behalf, under data processing terms, and only as needed for their service:

4. Content loaded from other services

Some content on our pages is loaded by your browser directly from other services. When that happens your browser connects to them, so they receive your IP address and technical browser data, and they are responsible for what they do with it:

We use these to show you what an item looks like (legitimate interest, Article 6(1)(f) GDPR).

5. Transfers outside the EU

Some providers (Cloudflare, MongoDB, and the services in section 4) are based in or may process data in the United States or other countries outside the European Economic Area. Where they do, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

6. Your rights

Under the GDPR you have the right to:

To use any of these rights, email [email protected]. We will reply within one month. Because we store so little, we often won't hold any data that can be linked to you.

You also have the right to complain to a data protection authority. In Slovenia that is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si. You can also contact the authority in the EU country where you live.

7. Children

The site can be browsed by anyone and has no accounts or sign-ups. We don't knowingly collect personal data from children. If you believe a child has sent us personal data, for example by email, contact us and we will delete it.

8. Security

The site is served only over encrypted connections (HTTPS). Access to our servers and database is restricted and protected by strong authentication.

9. Changes to this policy

If what we process changes — for example if we ever add analytics — we will update this policy before the change takes effect. The date at the top shows when it was last changed.

Last updated: 5 November 2026