Privacy Policy

API Skins is run by [operator name and address], who is responsible for your personal data on the service. For anything about your data, write to contact@apiskins.com. This policy explains what we collect, why, and what you can do about it. The Terms of Service cover the rest.

• Your Steam account: when you sign in, Steam tells us your Steam ID. We then read your public Steam name and avatar. We never see your Steam password.
• Your account here: your balance and every change to it, your subscriptions, and when you signed in.
• Top-ups: your deposit addresses and the deposits sent to them (amount, token, network, time). Transactions are public on the blockchain.
• The API: your API key (stored only as a hash, with its first characters to show you), and how many requests you make each month and minute.
• The robots: the marketplace API keys you connect (stored encrypted), what the marketplaces tell us about those accounts (name, balance, notes), and your offers and orders with their limits, prices and results.
• Technical data: our servers and hosting provider log requests (such as IP address, browser and time) to keep the service secure and fix problems. These logs are kept for a short time.

We do not use analytics, advertising or tracking tools, and we do not build profiles of you.

• To provide the service you asked for (our contract with you): signing you in, your balance and subscriptions, the price data, the API, and the robots trading on your behalf.
• To keep it safe and working (our legitimate interest): limits, preventing abuse and fraud, fixing problems.
• To meet legal duties, such as keeping payment records for accounting.

We use only the cookies the service needs to work, so we do not ask for consent to them:

• session: keeps you signed in, for up to 30 days. It holds a random token; we store only its hash.
• A sign-in cookie: while you sign in with Steam, it checks that the answer from Steam is for you. It lasts 10 minutes.

There are no third-party cookies. Our fonts are served from our own website.

We do not sell your data. It goes to others only to run the service:

• DMarket and Market.CSGO: the robots use your keys to act on your accounts there, as you set them up.
• Steam: we ask Steam for your public profile.
• LirChain (lirchain.com), our payment provider: it makes your deposit addresses, which we tag with your account's id, and tells us about the deposits to them.
• Blockchain networks: deposits are public transactions by nature.
• Our hosting and database providers, who store and process data for us under contract.
• Authorities, when the law requires it.

Some of these providers may be in other countries. Where the law requires it, we use safeguards such as standard contractual clauses for such transfers.

• Your account data, for as long as you have the account.
• Sign-in sessions end after 30 days, or when you sign out.
• Marketplace keys, until you disconnect the account; disconnecting deletes them along with its offers and orders.
• Payment records, for as long as accounting and tax law requires, even after your account is deleted.
• Server logs, for a short time, unless needed to look into a security problem.

Marketplace keys are encrypted (AES-256-GCM); API keys and session tokens are stored only as hashes; the website is served over HTTPS. No system is perfectly secure, so give the robots keys with only the permissions they need, and tell us at once if you think your account or keys were misused.

Depending on where you live, you can ask us to show you the data we have about you, correct it, delete it, give it to you in a portable form, or stop or limit using it. Write to contact@apiskins.com; we answer within a month. We may need to confirm the request comes from you, for example through your Steam sign-in.

You can also complain to the data protection authority where you live.

The service is not for anyone under 18, and we do not knowingly collect their data. If you think a child has an account, tell us and we will delete it.

We may update this policy. For important changes we give notice on the website before they apply. The date at the top shows when it last changed.