Privacy Policy

1. Who is responsible for your information

The controller of your personal information is POJECTO, LLC, a company established in the United States.

Company legal name

POJECTO, LLC

Registered address

8 The Green, Suite 11767, Dover, DE 19901, United States

Contact email

hello@skinocean.gg

SkinOcean is not affiliated with Valve Corporation or Steam. What Steam does with your information is governed by Valve’s own privacy policy.

2. What we collect

• Steam account information. When you sign in with Steam we receive your SteamID and, from Steam’s public profile data, your display name, avatar and profile link. Where your profile makes them available we also read when your Steam account was created, your Counter-Strike 2 playtime, and whether Steam shows a trade ban or trade hold on the account. We never receive your Steam password or Steam Guard codes.
• Contact and account details. Your email address and when you confirmed it, your Steam trade URL, your account settings, and a record of which version of our Terms and of this Policy you accepted, and when.
• Inventory and item information. The Counter-Strike 2 items in your Steam inventory and their details (float, pattern, stickers and similar), so you can list them and so we can check that a listed item is still there.
• Marketplace and trade records. Your listings, purchases and sales, their prices and fees, trade reference codes, Steam trade-offer identifiers and statuses, delivery and cancellation records, and your seller standing.
• Balance and payment records. Deposits, purchases, refunds, sale proceeds and rewards on your balance. Card payments are handled by Stripe: we receive the amount, the status and a payment reference, never your card number.
• Extension readings. If you use the browser extension, it reads your Steam inventory, the trade offers it prepares for your sales, and the state of your Steam trade offers and trade history that relate to SkinOcean trades. See section 5.
• Support messages. What you write to us, the email address you give for a reply, and our answers.
• Email delivery information. Whether an email to your address was delivered, bounced or was reported as spam, as reported by our email provider.
• Technical information. Request logs including IP address, browser and device details, and security signals, kept to run, protect and troubleshoot the Services.

We don’t ask for identity documents at present. If withdrawals are introduced, identity verification will be required for them and this Policy will be updated first.

3. What we use it for, and on what basis

• To provide the marketplace — creating your account, showing your inventory, running listings and purchases, holding and releasing payments, verifying deliveries, and telling you by email when a trade needs something from you or has been cancelled or refunded. Basis: performing our contract with you.
• To keep trades safe — detecting reversed trades, items that are no longer held, accounts that can’t trade, payment fraud, abuse of rewards and attempts to get around restrictions; and resolving disputes. Basis: our legitimate interest in a marketplace people can trust, and performing our contract.
• To set seller standing — see section 8. Basis: performing our contract and our legitimate interest in pricing risk fairly.
• To answer you when you contact support. Basis: performing our contract and our legitimate interest in helping users.
• To keep our email working — we stop writing to addresses that bounce or report our messages as spam, and ask the account to confirm another. Basis: our legitimate interest in reliable delivery, and legal and provider requirements.
• To meet legal obligations — accounting, tax, responding to lawful requests, and enforcing our Terms. Basis: legal obligation and legitimate interest.
• To maintain and improve the Services — fixing faults and understanding how features are used, from operational data. Basis: our legitimate interest in a working product.

We send transactional messages only. We don’t send marketing email, we don’t use your information for advertising, and we don’t sell it. If we ever offer marketing messages they will need your separate consent, which you could withdraw at any time.

4. What other people can see

• Everyone: your Steam display name and avatar, your store page, your active listings, and summary figures about your selling record.
• The other party to a trade: the items, prices, reference code and status of that trade. A seller is given the buyer’s Steam trade URL so they can send the item.
• Nobody else: your email address, your balance and your payment records are never shown to other users. Our emails about a trade don’t include the other party’s name or anything they typed.

5. Steam and the browser extension

The SkinOcean Market Helper is optional and operates only on SkinOcean and on the Steam Community pages required for its features. It uses the Steam session already signed in to your browser to make Steam requests on your behalf: reading your inventory, preparing the trade offer for a sale, and reading the offers and trade history that relate to SkinOcean trades in order to confirm deliveries and detect reversals. It also reads Steam Community Market prices for the items you list and, where one of your SkinOcean trades has been reversed, what Steam says about your account’s ability to trade. It stores your offer-tracking preference in your browser.

The extension doesn’t ask for, store or transmit your Steam password, Steam Guard recovery code or mobile authenticator secrets. It may check whether a Steam session is present so it can report a sign-in problem. Steam Guard confirmations remain controlled by you and by Steam. You can disable or remove the extension at any time.

6. Who we share information with

We share personal information only as needed to run the Services, with providers who process it on our instructions:

• Hosting and infrastructure: Vercel (the website and its server functions), Neon (our database) and a container host for the service that reads Steam inventories.
• Email: Amazon Web Services (Amazon SES, EU — Frankfurt), which delivers our email and reports bounces and complaints.
• Payments: Stripe, which processes card payments as its own controller under its privacy policy.
• Internal alerts: Telegram, through which our team is notified of new sign-ups (Steam display name, SteamID and profile link).
• Steam: requests to Valve’s services needed for the features you use, such as reading an inventory or checking that an account can receive trade offers.

We may also disclose information where the law requires it, to establish or defend legal claims, to prevent fraud or harm, or to a successor if the business is reorganised or sold — in which case this Policy continues to apply to it.

7. International transfers

We are a United States company and our providers operate in several countries, including the United States, so your information is processed in the United States and may be processed in other countries outside the one where you live. Where the law requires it for such transfers — for example from the EEA or the UK — we rely on adequacy decisions or on standard contractual clauses and equivalent safeguards agreed with those providers.

8. Automated decisions

Some decisions are made automatically, because a marketplace of strangers needs rules that apply the same way to everyone:

• Seller standing — and so the commission rate — is calculated from your recent delivery record.
• Buying and selling are paused when Steam shows a trade ban or won’t let offers be sent to an account, or when our email to the account stops being deliverable.
• A sale is undone when Steam shows that a delivered trade was reversed during the protection window.

You can ask for any of these to be reviewed by a person, and give your side, through Support.

9. How long we keep it

• Account information is kept while your account exists.
• Trade, balance and payment records are kept for as long as accounting, tax and anti-fraud law require, and for as long as a dispute about them could be raised, even after an account is closed.
• Email verification codes are stored only as a hash, expire within minutes, and their records are deleted after about 30 days.
• Support tickets are kept for as long as needed to answer them and to handle related disputes.
• Request logs are kept for a short period by our hosting providers.

When information is no longer needed we delete or anonymise it.

10. Cookies and browser storage

We use what is needed to make the site work, and nothing for advertising or tracking:

• One sign-in cookie (“session”), which keeps you signed in for up to 30 days. It can’t be read by scripts and is removed when you sign out.
• Browser storage for your cart, a short-lived cache of reference prices, and your display preferences. This stays in your browser and isn’t sent to us as a profile of you.
• Stripe sets its own cookies on its payment page when you make a deposit, to process the payment and prevent fraud.

Because these are strictly necessary, there is no cookie banner to accept. Blocking them in your browser will stop sign-in or the cart from working.

11. Security

We use reasonable technical and organisational measures to protect information, including encrypted connections, signed sign-in sessions, hashed verification codes and restricted staff access. No system is completely secure. You are responsible for protecting your Steam account and for checking a trade offer before you send or accept it.

12. Your choices and rights

You can change your email address and trade URL in your profile, and remove the extension at any time. Depending on where you live — including under the GDPR, the UK GDPR, United States state privacy laws and similar laws — you may have the right to:

• know what information we hold about you and receive a copy of it;
• have inaccurate information corrected;
• have information deleted, where we have no legal reason to keep it;
• restrict or object to how we use it, including uses based on legitimate interest;
• receive information you gave us in a portable form;
• have an automated decision reviewed by a person; and
• complain to the data protection authority where you live.

To use any of these, open a ticket in Support or write to hello@skinocean.gg. We may need to confirm that the request comes from the account holder, and we will answer within the time the law sets.

13. Children

The Services are for adults. You must be at least 18 to use them, and we don’t knowingly collect information from anyone younger. If you believe a minor has an account, tell us and we will close it.

14. Changes to this Policy

We may update this Policy when the Services or the law change. The current version is always on this page with its effective date. When a change is material we will ask you to accept the updated Policy before you buy or sell again.