Privacy policy

Effective October 13, 2026 · SkinTally

SkinTally™ is independently developed. This policy describes the iPhone and Android apps, website and inventory service. For privacy questions or requests, please email us at skintally@gmail.com.

Information used to provide the app

• Public inventory lookup: the profile URL or SteamID you submit is sent over HTTPS to our service, which asks Steam for that profile's public inventory. SteamIDs and returned inventory metadata are used to display the requested collection.
• Steam sign-in: Steam authenticates you on its own page. Our service verifies the returned SteamID using OpenID and temporarily pairs it with your app. We never receive your Steam password or Steam Guard code and cannot perform trades.
• Manual imports, favorites and planning: manual inventory JSON is parsed on your device and is not uploaded as an import. Inventory snapshots and favorites are saved locally. On versions with Saved trade-ups, plans you choose to save include a plan name, the selected skins and inventory asset IDs, floats and entered costs. Saved plans stay on your device unless you choose to share a copy. Unsaved calculator selections and Discover searches/filters stay in app memory.
• Trade-up sharing: when you choose Share contract or Share plan, SkinTally creates a link containing the plan name, skin identifiers, variants, floats and optionally entered costs. SteamIDs, owned asset IDs and login details are excluded. On versions with short links, opening Share contract or Share plan uploads this allowlisted snapshot to our server to prepare a short address. Shared copies are stored without an account identifier and remain until removed through support or the sharing service is retired. Older or fallback links contain the snapshot in a URL fragment, which is not sent to our server on opening. Your chosen messaging service, clipboard and browser can retain the complete link. Anyone with it can read and forward it; deleting the original does not revoke shared copies. Shared plans are imported only after your confirmation and start as hypothetical inputs.
• Safari sharing: on supported versions, the Share extension reads the inventory JSON displayed on the Steam data page you choose to share. The page URL and inventory data are passed locally to SkinTally for review. The extension does not read passwords or cookies or send the import to our server.
• Market data: our service downloads shared Skinport price catalogs and, when enabled, bulk marketplace data through CSPriceAPI and European Central Bank reference exchange rates. For price lookups, the app and website can send public skin market names and paint identifiers to our service. These requests exclude your SteamID, owned asset IDs, entered costs and private import JSON. Our service matches shared feeds; it does not forward your skin selection or inventory to the pricing providers.
• Network and support information: servers and image providers receive connection information such as an IP address and requested resource. Our service temporarily uses IP addresses to limit abuse. If you email us, we receive your email address, message and any attachments you choose to send.

Storage and retention

In the mobile apps, saved profiles, inventories, imports, favorites and saved trade-up plans are encrypted with AES-256-GCM. The key is protected by Apple's device-only Keychain on iPhone and Android Keystore-backed storage on Android. Personal records remain until you clear them; disconnecting keeps favorites and saved trade-up plans for each profile. Saved trade-ups can be reopened, updated or removed in the calculator. Unsaved calculator inputs and Discover search state are not saved between app restarts. Public prices and image files may be cached for performance. This protects stored records but is not a guarantee against every device or account compromise.

Pending Safari shares use a temporary local folder shared only by SkinTally and its bundled extension. These files use iOS Data Protection and are excluded from backups. They are deleted after import or discard. Files older than 24 hours are removed the next time the import inbox is accessed. Delete my local data also clears pending shares.

On versions with Copy all inventory data, the optional Share-panel button writes the displayed inventory response to the clipboard only when tapped. This copy is restricted to the current device, with a 10-minute expiration. Save import does not use the clipboard.

Our inventory service has no permanent profile database. Public inventory pages expire from its memory cache after 60 seconds. Pending sign-in and replay-prevention records expire after at most eight minutes. Active requests may retain information while finishing. Network/operational logs held by hosting or other providers follow those providers' retention policies. Support email is retained as needed to resolve requests and meet applicable legal requirements; you can request deletion.

The website saves your last-viewed inventory (including manual imports), favorites, saved trade-up plans and preferred market in this browser on this device. Favorites and preferences use localStorage; inventory snapshots, saved plans and public price caches use IndexedDB. Saving locally does not upload these records to SkinTally or pricing providers. Records remain until you delete them or the browser clears site data; private browsing may discard them when its session ends. Browser records do not use the iPhone app’s Keychain-backed encryption. They are available to anyone who can access this browser profile. Automatic account and cross-device sync are not enabled. Public inventory lookup and explicit trade-up sharing still involve our server as described above. Your browser can separately cache images and retain its Steam login.

Optional 3D preview

Choosing a 3D preview sends the catalog finish, paint index, seed, float and StatTrak selection directly to Skinshotter. Its renderer also receives your IP address and normal browser request details. A custom name tag is included only when you explicitly enable it. Steam credentials, inventory asset IDs and inspect links are excluded. Shared preview URLs contain only the finish and preview settings. Viewing 2D artwork does not contact Skinshotter.

Services involved

The backend is hosted on Render in the United States. Public inventory requests can pass through our Supabase Edge Function; Supabase receives the requested SteamID and public inventory response, but no Steam passwords, cookies or manual imports. The relay stores aggregate usage, timing and cooldown counters, not SteamIDs or inventory contents. Provider operational logs follow their own retention policies. Steam handles sign-in and inventory data. Catalog metadata comes from ByMykel/CSGO-API; images are requested directly from allowlisted Steam/GitHub content hosts. These hosts receive normal network requests, including IP addresses and requested image URLs. Skinport, enabled CSPriceAPI feeds, and the European Central Bank receive shared feed requests from our server; direct CSFloat access is disabled in this pricing service. Support email is handled through Gmail. These independent services also have their own terms and privacy practices: Steam, Render, Supabase, GitHub, and Google.

Mobile banner advertising

Versions with mobile advertising use Google AdMob and Google's User Messaging Platform for consent. Older versions and the website do not show these banners. SkinTally requests non-personalized ads; this does not mean no data is collected. Google's SDK can receive IP addresses (including approximate location derived from them), device and app identifiers, technical diagnostics and ad interactions to deliver and measure ads and prevent fraud. SkinTally does not send SteamIDs, inventory contents, item selections, trade-up plans or Steam credentials in ad requests. We do not request Apple's tracking permission or Android's advertising-ID permission.

Before requesting ads, the app updates consent information and presents Google's consent form where required. If this check fails, ads remain hidden. Use Settings → Ad privacy options to review or change available choices. Consent records are separate from the inventory vault and are not removed by Delete my local data; manage them through Ad privacy options. Google handles and retains its records under its own privacy policy; see how Google uses information from apps that use its services. Test versions use Google test ads. SkinTally has no purchases or payment collection in this release.

Your choices and deletion

Steam sign-in is optional. Discover and hypothetical catalog planning work without a Steam identity. Open Privacy & saved data → Delete my local data to remove saved profiles, inventories, imports, favorites, all saved trade-up plans, the preferred-market setting and public price caches. On web this clears SkinTally’s personal records from localStorage and IndexedDB on this site; other open SkinTally tabs reload to discard their copies. A nonpersonal reset marker remains to prevent older tabs or interrupted work from restoring deleted data. On iPhone deletion also removes the encryption key, pending Safari shares and app image/file caches. Deletion cancels pending app work. It does not erase hosted shared-contract copies, original JSON files, clipboard contents, device backups, provider logs, the browser’s own image cache or your separate Steam browser session. It never removes your Steam items or account.

To stop remote processing, stop making inventory/market requests or stop using the app. Temporary server records expire as described above. To request removal of a hosted shared copy, contact support with its link; we do not have an account association for that copy. Removing a hosted link does not erase copies already opened or forwarded in another format. Visit Help & contact for support-record deletion or other privacy requests. Do not include credentials. We may ask for limited information to verify a request before responding.

Children and changes

SkinTally is not directed to children under 13. If you believe a child has supplied personal information to us, please email us at skintally@gmail.com. We will update this page and its effective date when practices change.