Privacy / KVKK Notice
Data we process
Steam ID, public Steam profile name, avatar and avatar hash, signed session identifier, CS2 and Rust inventory descriptions and tradability state, encrypted or access-controlled Steam trade URL, Skinup inventory and Upoin ledger, daily reward qualification and claim date, trade and game history, security events, IP address, request identifiers and essential preference records.
Purposes
Authentication, verifying daily promotional reward eligibility, providing requested inventory features, maintaining an auditable asset and Upoin ledger, preventing fraud and duplicate settlement, securing the service, resolving support issues, satisfying legal obligations and defending legal claims.
Legal bases
The final operator must map every purpose to a valid legal basis under applicable law. Depending on the activity, these may include performance of a user agreement, compliance with a legal obligation, establishment or defence of rights, legitimate interests that do not override user rights, and explicit consent where legally required.
Recipients and international transfers
Steam/Valve receives authentication and trade interactions initiated by the user. Hosting, database, security and support providers may process limited data under written agreements. Any international transfer mechanism must be documented before launch.
Retention
Sessions and preferences are kept only as long as operationally necessary. Financial-equivalent ledgers, trade records, security logs and dispute evidence require a documented retention schedule based on legal obligations and limitation periods. Data should then be securely deleted or anonymized.
Your rights
Subject to applicable law, you may request information about processing, access, correction, deletion, restriction, objection, portability where applicable, and information about recipients. Turkish users also have the rights listed in Article 11 of Law No. 6698. The operator's verified request channel must be published before launch.
Security
Skinup uses signed HttpOnly sessions, restrictive browser headers, request verification, rate limits, database transactions and audit ledgers. No system is perfectly secure; suspected incidents should be reported through the operator's published support channel.