隐私政策

01Summary

• You can use SeeSkyn without an account. There are no ads, no analytics, no tracking cookies and no third-party trackers.
• Fonts, images and scripts are served from our own servers; your browser does not contact Google Fonts or ad networks. The only exception: if you sign in with Steam, your Steam avatar is loaded from Steam’s image servers.
• We only store personal data when you sign in with Steam or send us a message, and only what is needed for that. You can delete your account and its data yourself at any time.
• We do not sell or share personal data for advertising.

02When you browse the site

Like every website, our servers receive your IP address, your browser’s user-agent string and the address of the page you request. We use them to deliver the page and to protect the service:

• Rate limits. Your IP address is used as a key for request limits on Steam sign-in, your account actions, the contact form and the 3D viewer. These are short-lived counters on our servers: they are not written to our account database and expire after at most one day (the window of the longest limit).
• 3D viewer. Before it loads a model, the viewer asks for a 15-minute viewer session and sends a few technical facts about the browser (for example whether it is remote-controlled by automation software, whether graphics run in software, and how many languages it lists: yes/no values and counts, no identifiers). Together with your user agent and the network your IP address belongs to, they decide whether the session is granted directly, after a Cloudflare Turnstile check, or refused, to protect the 3D models from automated copying. Sessions and model tickets are bound to a short one-way hash of your IP address and user agent so they can’t be reused elsewhere, and the number of different models and finishes opened per day is counted per session, IP address and network. These counters reset after at most one day. Each session carries a random number that is hidden as a tiny, invisible change in the model geometry, so a copied model can be traced to a network and a day.
• Server and network logs. Our hosting and network providers may keep standard access and error logs (IP address, time, requested address, user agent) for security and troubleshooting, for a limited time. Our own security log (refused requests, sign-ins, 3D viewer sessions) never contains your IP address, email or name: addresses appear only as a keyed hash that changes every day, together with the network block (for example the first three parts of an IPv4 address) and the network operator’s number.

03Stored in your browser

A few preferences are saved in your browser’s local storage. Unless noted below they never leave your device and are not sent to us; you can delete them at any time by clearing the site data in your browser.

• theme: light or dark theme, if you used the theme switch.
• seeskyn:viewer-env, seeskyn:viewer-sound, seeskyn:viewer-audio: 3D viewer background, sound and volume settings.
• seeskyn:viewer-hud: first-person HUD settings (the nickname you typed, team, money display, round timer). The nickname is only shown on your own screen and in screenshots you save.
• seeskyn:3d-autostart, seeskyn:3d-paused-until and, for the current tab only, seeskyn:3d-cooldown: whether the 3D viewer opens by itself.
• seeskyn:favorites: items you saved with the heart while signed out. When you sign in, they are moved into your account and removed from the browser.
• seeskyn:recent: the last 60 items you viewed. If you are signed in, this list is merged into your account when you open your profile, and it is cleared from the browser when you sign out.
• seeskyn:player-prefs: viewer settings from your profile page (HUD name, side, gloves, map, mouse sensitivity) while signed out. Signed in, they are saved to your account instead.
• For the current tab only, seeskyn:3d-session and seeskyn:3d-session-backoff: the 3D viewer session described above (sent to us with each 3D request), and when to ask for a new one after a refusal.
• For the current tab only, seeskyn:me: a five-minute copy of your own account data, so pages don’t ask our server again on every click.

04Cookies

Browsing the encyclopedia sets no cookies. We only set cookies when you sign in, and all of them are strictly necessary for signing in; none is used for tracking:

• __Host-cs3d_session: a signed, HttpOnly session cookie that keeps you signed in for up to 30 days (renewed while you use the site). It refers to a session record on our server, so signing out ends it everywhere it was copied.
• ss_auth: a random value without any meaning of its own, set and removed together with the session cookie. It only tells our pages that they should load your account; visitors without it never contact our account endpoints.
• ss_oid: set for at most 10 minutes while you sign in with Steam, to check that the answer from Steam belongs to the sign-in you started. It is deleted as soon as you return.

05Sign in with Steam and your profile

Signing in with Steam is optional. When you click “Sign in with Steam”, you sign in on Steam’s own website (steamcommunity.com, operated by Valve); we never see your Steam password. Steam then tells us your public Steam ID, and we read your public Steam profile through the Steam Web API. We store:

• your Steam ID, Steam name, avatar address, profile address and, if your Steam profile shows one, your country. We refresh them when you sign in and at most once a day;
• the items you save as favorites (and which of them you chose to show on a public profile), your recently viewed items (when you open your profile) and your viewer settings;
• one session record per signed-in browser (creation and expiry time), deleted when you sign out;
• the time of your last sign-in and when the account was created;
• a one-time code from each Steam sign-in, to stop the same sign-in from being replayed. It is stored without your Steam ID or any other personal data, and codes older than 10 minutes are deleted at the next Steam sign-in.

Your profile page is private. A public profile is off by default; if you turn it on, anyone with its link sees your display name, avatar, country, the month you joined and only the favorites you marked as public. Public profiles are not indexed by search engines. Your Steam ID is never shown on it.

Your avatar is loaded directly from Steam’s image servers (avatars.steamstatic.com and its mirrors), so those servers see your IP address when it is shown. See Valve’s privacy policy for how Steam processes data.

You can sign out on one device or everywhere, and delete your account yourself in the Account tab of your profile. Deletion is immediate and permanent: it removes your account, Steam data, favorites, history, settings and sessions. You can also send a deletion request through the contact form.

06Contact form

When you send a message through the contact form, we receive your name (optional), your email address, the topic, your message and the language of the page. We use them only to answer you. The message is stored in our database and forwarded to our support inbox by email through Resend. Messages are deleted after 365 days at the latest; ask us if you want yours deleted sooner. Your IP address is used for the form’s rate limit and is not stored with the message.

To keep out spam, the form uses Cloudflare Turnstile, which checks your browser and sends signals such as your IP address to Cloudflare to tell people from bots. Turnstile does not set advertising cookies.

07Service providers

We share personal data only with providers that run parts of the service for us:

• our hosting, database and network providers, which run the servers, the database and the content delivery network;
• Resend, which forwards contact messages to our inbox;
• Valve (Steam), when you choose to sign in with Steam: you sign in on Steam’s site, we look up your public Steam profile through the Steam Web API, and your avatar is loaded from Steam’s image servers;
• Cloudflare, which runs the Turnstile check on the contact form and, for requests that look automated, in the 3D viewer;

Some of them are located in the United States or other countries; transfers are covered by their data processing terms and standard contractual clauses where required. We may also disclose data if the law requires it.

08Your rights

Depending on where you live (for example under the GDPR in the EU and UK), you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict its use, and complain to your data protection authority. We process account data to provide the service you signed up for, contact messages to answer you, and IP addresses in our legitimate interest of keeping the service secure. If you signed in, you can delete your account yourself on your profile page; send other requests through the contact form. The site is not directed at children under 13 (16 in the EEA), and they should not create an account.

09Changes

We will update this policy when the site starts collecting something new or stops collecting something; the date at the top shows the current version. Our Terms of Use cover the rest of the rules for using the site.