Privacy Policy

We collect: your Steam ID, public Steam profile (username, avatar), trade URL, email if provided, KYC documents (for higher withdrawal limits) via our identity partner Sumsub, and standard log data (IP, user agent, timestamps). You sign in through Steam - we never ask for or store your Steam password. In our mobile app, when you connect Steam to load your full inventory, the sign-in happens directly on Steam inside the app and only your own Steam session (held by your device) is used to read your inventory; we do not receive your Steam credentials. If you enable push notifications in the app, we store a device push token solely to send you trade and offer alerts; you can turn this off at any time.

To operate the marketplace, verify trades, prevent fraud, comply with anti-money-laundering law, provide customer support, send notifications you opted into, and improve the Services. We do not sell your personal information.

We share data with service providers (Sumsub for KYC, Stripe for payments, Cloudflare for traffic security) only as needed to operate the Services. We may disclose data when legally required or to protect against fraud or harm.

We retain personal information for as long as your account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. KYC records are retained per applicable AML/KYC regulations.

Subject to applicable law (GDPR if you are in the EU/UK), you may request access, correction, deletion, or portability of your personal information, object to processing, or withdraw consent. Contact [email protected].

The Services are not intended for users under 18. We do not knowingly collect information from minors. If we learn a minor has used the Services, we will delete the account.

We use technical and organisational measures to protect personal information: TLS encryption in transit, hashed credentials, restricted internal access, audit logging. No internet service is 100% secure; you use the Services at your own risk.

Our Services are operated from Romania (EU). If you access them from outside the EU, your data may be transferred to Romania and to service providers in other jurisdictions, with appropriate safeguards (e.g. Standard Contractual Clauses).

FloatSkins, established in Bucharest, Romania, is the controller of your personal information. As an EU-established controller, FloatSkins is directly subject to the GDPR and does not require a separate Article 27 representative. Contact: [email protected].

We may change this Privacy Policy. Material changes will be posted here with a new effective date and, where practical, communicated by in-app notice. Continued use of the Services constitutes acceptance.

Privacy questions? Email [email protected] or use the in-app Support page.