1. Controller and contact
SkinQuest is the data controller for data processed directly by this service. Contact support@skinquestcs.com for privacy questions or rights requests.
Privacy Policy
This policy explains how SkinQuest processes personal data for accounts, surveys, rewards, support, security, and analytics.
2. Data we process
We process account email and ID, authentication records, coin balance and history, level progress, survey event identifiers, giveaway entries and winner records, reward orders, Steam ID and public trade URL, notification choices, support messages, security records, IP-derived rate-limit hashes, browser language, user agent, and page URL.
3. Purposes and legal bases
Account, coin, survey, reward, and delivery data is processed to perform our service contract. Fraud prevention, security, support, and service improvement rely on our legitimate interests. Optional analytics or marketing technologies rely on consent where required. Legal obligations may also require processing.
4. Providers and recipients
Supabase provides authentication and database hosting; CPX Research handles current survey offers and verification; Resend handles transactional email; Google Analytics 4 measures site usage when enabled. Valve/Steam provides public Community Market metadata and catalog images; Steam pricing is fetched server-side, while loading a market image may send ordinary network and browser data to Steam's image delivery service. The embedded CPX widget receives your SkinQuest account identifier and a server-generated security hash, together with ordinary browser and network data needed to show matching surveys. SkinQuest does not send your email address or username through the widget configuration. Historical BitLabs records may remain for accounting, disputes, and deletion handling, but BitLabs is no longer presented as a survey option. Administrators can access only the data needed to review support, fraud, coins, and reward delivery. Each external provider also applies its own terms and privacy policy.
5. International transfers
Some providers may process data outside Sweden or the EEA. Where required, transfers should rely on an adequacy decision, standard contractual clauses, or another lawful safeguard. Provider policies contain their specific locations and safeguards.
6. Retention
Active account and transaction records are kept while the account is in use. Support records are normally deleted within 24 months after closure; security and rate-limit records within 12 months; analytics follows the configured GA4 retention period. Reward and accounting records may be kept longer when needed for disputes, fraud prevention, or legal obligations. Deletion removes or anonymizes data unless retention is legally required.
7. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent without affecting earlier lawful processing. Use Settings to delete the account or contact support for a data copy. Account deletion also sends a deletion request for the corresponding BitLabs publisher user when that integration has been used. We may need to verify your identity.
8. Complaints and children
You may complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority. SkinQuest is not intended for anyone below the minimum digital-consent age in their country. Survey providers may impose higher age limits; users under 18 need guardian permission where required.
9. Steam safety
SkinQuest only needs your public trade URL and, when connected, public Steam identity. Never provide a Steam password, Steam Guard code, or API key. We use reasonable technical and organizational measures, but no online system can guarantee absolute security.