プライバシーポリシー

01Summary

• You can use SeeSkyn without an account. There are no ads and no advertising cookies. We use Google Analytics to see how the site is used: in the EEA, the UK, Switzerland and Brazil only if you accept it, elsewhere until you turn it off (see Analytics).
• Fonts, images and scripts are served from our own servers; your browser does not contact Google Fonts or ad networks. The exceptions: Google Analytics, as described below, and, if you sign in with Steam, your Steam avatar, which is loaded from Steam’s image servers.
• We only store personal data when you sign in with Steam or send us a message, and only what is needed for that. You can delete your account and its data yourself at any time.
• We do not sell or share personal data for advertising.

02When you browse the site

Like every website, our servers receive your IP address, your browser’s user-agent string and the address of the page you request. We use them to deliver the page and to protect the service:

• Rate limits. Your IP address is used as a key for request limits on Steam sign-in, your account actions, the contact form and the 3D viewer. These are short-lived counters on our servers: they are not written to our account database and expire after at most one day (the window of the longest limit).
• 3D viewer. Before it loads a model, the viewer asks for a 15-minute viewer session and sends a few technical facts about the browser (for example whether it is remote-controlled by automation software, whether graphics run in software, and how many languages it lists: yes/no values and counts, no identifiers). Together with your user agent and the network your IP address belongs to, they decide whether the session is granted directly, after a Cloudflare Turnstile check, or refused, to protect the 3D models from automated copying. Sessions and model tickets are bound to a short one-way hash of your IP address and user agent so they can’t be reused elsewhere, and the number of different models and finishes opened per day is counted per session, IP address and network. These counters reset after at most one day. Each session carries a random number that is hidden as a tiny, invisible change in the model geometry, so a copied model can be traced to a network and a day.
• Server and network logs. Our hosting and network providers may keep standard access and error logs (IP address, time, requested address, user agent) for security and troubleshooting, for a limited time. Our own security log (refused requests, sign-ins, 3D viewer sessions) never contains your IP address, email or name: addresses appear only as a keyed hash that changes every day, together with the network block (for example the first three parts of an IPv4 address) and the network operator’s number.

03Stored in your browser

A few preferences are saved in your browser’s local storage. Unless noted below they never leave your device and are not sent to us; you can delete them at any time by clearing the site data in your browser.

• theme: light or dark theme, if you used the theme switch.
• seeskyn:viewer-env, seeskyn:viewer-sound, seeskyn:viewer-audio: 3D viewer background, sound and volume settings.
• seeskyn:viewer-hud: first-person HUD settings (the nickname you typed, team, money display, round timer). The nickname is only shown on your own screen and in screenshots you save.
• seeskyn:3d-autostart, seeskyn:3d-paused-until and, for the current tab only, seeskyn:3d-cooldown: whether the 3D viewer opens by itself.
• seeskyn:favorites: items you saved with the heart while signed out. When you sign in, they are moved into your account and removed from the browser.
• seeskyn:recent: the last 60 items you viewed. If you are signed in, this list is merged into your account when you open your profile, and it is cleared from the browser when you sign out.
• seeskyn:player-prefs: viewer settings from your profile page (HUD name, side, gloves, map, mouse sensitivity) while signed out. Signed in, they are saved to your account instead.
• For the current tab only, seeskyn:3d-session and seeskyn:3d-session-backoff: the 3D viewer session described above (sent to us with each 3D request), and when to ask for a new one after a refusal.
• For the current tab only, seeskyn:me: a five-minute copy of your own account data, so pages don’t ask our server again on every click.
• seeskyn:analytics-consent: whether you accepted or rejected analytics, and when (asked again after 12 months).

04Cookies

Our own cookies are only set when you sign in, and all of them are strictly necessary for signing in; none is used for tracking:

• __Host-cs3d_session: a signed, HttpOnly session cookie that keeps you signed in for up to 30 days (renewed while you use the site). It refers to a session record on our server, so signing out ends it everywhere it was copied.
• ss_auth: a random value without any meaning of its own, set and removed together with the session cookie. It only tells our pages that they should load your account; visitors without it never contact our account endpoints.
• ss_oid: set for at most 10 minutes while you sign in with Steam, to check that the answer from Steam belongs to the sign-in you started. It is deleted as soon as you return.

Google Analytics sets its own cookies (_ga, _ga_<ID>) only when it is allowed to run for you; see Analytics.

05Analytics cookies (Google Analytics)

We use Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which processes the data for us as our processor. It tells us which pages are visited and how the site is used, so we can see what to improve. We do not use any of its advertising features.

• Only with your consent where the law requires it. If you are in the European Economic Area (the EU, Iceland, Liechtenstein and Norway), the United Kingdom, Switzerland or Brazil, or if we can’t tell where you are, Google Analytics is not loaded and your browser sends nothing to Google until you click “Accept” in the cookie banner. To find out your country, your browser asks our network provider Cloudflare (the address /cdn-cgi/trace on our own domain); the answer is only used in your browser and is not stored. Everywhere else, Google Analytics is loaded without a banner and you can turn it off at any time.
• What is collected: the pages you view (address, title and the page you came from), your interactions as Google Analytics measures them by default (for example scrolling, clicks on links to other sites, site searches and file downloads), your device type, operating system, browser, screen size and language, and your approximate location (country, region and city), which Google derives from your IP address. Google Analytics 4 does not log or store IP addresses. We do not send Google your name, email, Steam ID or any other account data.
• Cookies: _ga (a random identifier that tells visits from the same browser apart) and _ga_<ID> (the state of your current visit), set on our domain. They expire after up to 2 years, counted from your last visit.
• Retention: Google Analytics keeps the data linked to these identifiers for 14 months and then deletes it; we only keep aggregated reports that don’t identify anyone.
• No advertising: advertising storage, ad personalization and Google signals are switched off, and the data is not used to show you ads or to build a profile of you across sites.
• Legal basis: your consent in the regions listed above (for example Art. 6(1)(a) GDPR and the UK GDPR, the Swiss data protection act and Art. 7(I) LGPD), and our legitimate interest in understanding how the site is used elsewhere, where you can object at any time.
• Transfers: Google may process the data in the United States and other countries. Google LLC is certified under the EU-U.S. Data Privacy Framework (with its UK and Swiss extensions), and Google uses standard contractual clauses for other transfers.

Changing your mind. Use Cookie settings (also at the bottom of every page) to accept or reject at any time. If you reject after accepting, we switch Google Analytics off and delete the _ga cookies. Your choice is saved in your browser for 12 months (seeskyn:analytics-consent, see above), after which we ask again. You can also block Google Analytics with Google’s opt-out browser add-on.

More about how Google processes this data: Google’s Privacy Policy and how Google uses information from sites that use its services.

06Sign in with Steam and your profile

Signing in with Steam is optional. When you click “Sign in with Steam”, you sign in on Steam’s own website (steamcommunity.com, operated by Valve); we never see your Steam password. Steam then tells us your public Steam ID, and we read your public Steam profile through the Steam Web API. We store:

• your Steam ID, Steam name, avatar address, profile address and, if your Steam profile shows one, your country. We refresh them when you sign in and at most once a day;
• the items you save as favorites (and which of them you chose to show on a public profile), your recently viewed items (when you open your profile) and your viewer settings;
• one session record per signed-in browser (creation and expiry time), deleted when you sign out;
• the time of your last sign-in and when the account was created;
• a one-time code from each Steam sign-in, to stop the same sign-in from being replayed. It is stored without your Steam ID or any other personal data, and codes older than 10 minutes are deleted at the next Steam sign-in.

Your profile page is private. A public profile is off by default; if you turn it on, anyone with its link sees your display name, avatar, country, the month you joined and only the favorites you marked as public. Public profiles are not indexed by search engines. Your Steam ID is never shown on it.

Your avatar is loaded directly from Steam’s image servers (avatars.steamstatic.com and its mirrors), so those servers see your IP address when it is shown. See Valve’s privacy policy for how Steam processes data.

You can sign out on one device or everywhere, and delete your account yourself in the Account tab of your profile. Deletion is immediate and permanent: it removes your account, Steam data, favorites, history, settings and sessions. You can also send a deletion request through the contact form.

07Contact form

When you send a message through the contact form, we receive your name (optional), your email address, the topic, your message and the language of the page. We use them only to answer you. The message is stored in our database and forwarded to our support inbox by email through Resend. Messages are deleted after 365 days at the latest; ask us if you want yours deleted sooner. Your IP address is used for the form’s rate limit and is not stored with the message.

To keep out spam, the form uses Cloudflare Turnstile, which checks your browser and sends signals such as your IP address to Cloudflare to tell people from bots. Turnstile does not set advertising cookies.

08Service providers

We share personal data only with providers that run parts of the service for us:

• our hosting, database and network providers, which run the servers, the database and the content delivery network;
• Resend, which forwards contact messages to our inbox;
• Valve (Steam), when you choose to sign in with Steam: you sign in on Steam’s site, we look up your public Steam profile through the Steam Web API, and your avatar is loaded from Steam’s image servers;
• Cloudflare, which runs the Turnstile check on the contact form and, for requests that look automated, in the 3D viewer;
• Google Ireland Limited, which runs Google Analytics for us (see Analytics);

Some of them are located in the United States or other countries; transfers are covered by their data processing terms and standard contractual clauses where required. We may also disclose data if the law requires it.

09Your rights

Depending on where you live (for example under the GDPR in the EU and UK), you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict its use, and complain to your data protection authority. We process account data to provide the service you signed up for, contact messages to answer you, and IP addresses in our legitimate interest of keeping the service secure. Analytics is based on your consent or our legitimate interest, depending on where you are (see Analytics); you can withdraw your consent or object at any time with Cookie settings. If you signed in, you can delete your account yourself on your profile page; send other requests through the contact form. The site is not directed at children under 13 (16 in the EEA), and they should not create an account.

10Changes

We will update this policy when the site starts collecting something new or stops collecting something; the date at the top shows the current version. Our Terms of Use cover the rest of the rules for using the site.