Privacy Policy
The game works without an account in practice mode. Practice XP and personal best use your browser’s local storage. They do not follow you to another device.
When you sign in
Historical ChatGPT sign-in accounts use a site-specific account ID and identity headers. Where enabled, Google sign-in uses Google Identity Services. The server verifies the signature, audience, issuer, expiry, verified email and login nonce before creating a session. It stores the account ID, a random public alias you can change, verified answers, runs, XP, best streak, dates played, campaign participation, club membership and invitation codes. This site does not store your Google or ChatGPT password. Google sign-in stores the immutable Google account subject, your email privately, a hashed session token and expiry. Google ID tokens are not stored. Sessions use Secure, HttpOnly, SameSite=Lax cookies with a seven-day maximum. Short-lived one-use login challenges expire after ten minutes and limit repeated verification attempts. The owner email is checked server-side for administration; real names and emails are not shown on the leaderboard. Google account email is stored privately for account management and owner authorization. Different sign-in providers currently create separate game profiles; they are not silently merged.
Email verification
Where email verification is enabled, the address you provide is used to send a six-digit code through Resend for account creation, code-based sign-in or password reset. Email accounts can store a public display name and a salted password-derived hash, protected with a server-side secret; the plaintext password is not stored or emailed. Password resets revoke existing email sessions. Password sign-in has separate per-address and per-IP rate limits. Pending verification records expire after ten minutes. Only a keyed hash of the code is stored. A code can be used once, in the requesting browser, with a maximum of five verification attempts. Successful verification stores your private email and a separate email-provider game account, plus a hashed session token that expires after seven days. Sending limits use hashed email and IP keys with counters expiring within one hour. These records are cleaned up when the email service is used. Email is for authentication, not marketing. Resend processes your recipient address and message delivery data under its own service arrangements.
Giveaway data
Joining an active promotion stores acceptance time, rules version and your declared eligible country and adult confirmation. Entries and the winning account are recorded for the draw. Do not enter a campaign if you are not eligible. Contacting an organizer to claim a prize is separate from playing; use the organizer named on that campaign.
Use and retention
Account data supports the game, saved progression, fair-play checks, competitions and their audit trail. Daily counters measure page loads, practice starts and finishes, same-session repeats, challenge-link visits, completed share actions and daily-challenge starts and finishes, without advertising identifiers. These are aggregate events, not verified unique people. Challenge URLs can contain a score to beat; sharing a challenge does not earn tickets. Campaign pages can show total ticket counts and your current share of recorded tickets; these can change before closing. A sessionStorage flag identifies whether this browser tab has already started an unranked run. Account play dates allow next-day return to be measured for signup cohorts. Hosting and sign-in providers may process operational logs under their own policies. Skin imagery loads from its external catalogue/CDN; those providers receive normal network requests such as your IP address.
Inactive accounts are not automatically deleted in this version. Password hashes are removed when the email account is deleted. Use the deletion control below at any time. Deletion removes saved gameplay and unclaimed entries, and disconnects your account from completed campaign records. It cannot proceed while you have an unresolved winning prize. Deleting a game account also removes its club memberships and the clubs it owns. Aggregate counters and non-identifying campaign/audit records remain. A minimal account-ID/day/attempt-count anti-abuse record is retained until the next midnight in Denmark, then expires; deleting and recreating a profile cannot reset the daily ranked allowance.
Your controls
Change your display alias or delete your game account from your account. Your ChatGPT account is unaffected. Re-entering after deletion creates a fresh game profile. Participation is not consent to email marketing. No advertising or analytics cookies are installed by this application. Essential cookies are used for Google sessions and sign-in verification when that provider is enabled. Google and the hosted sign-in service process their own authentication traffic.
For an active campaign, the named organizer and published contact email handle eligibility, delivery and privacy queries relating to that competition. No active organizer contact is invented or published before a campaign is configured.
Your privacy rights
Subject to the conditions and exceptions in applicable data protection law, you may request access to your personal data, correction, deletion, restriction of processing and a portable copy of data you provided. You may object to processing based on legitimate interests. Contact us using the details below so we can identify the account and assess your request securely. The in-game deletion control is a convenience; a technical block on that control does not remove your legal rights.
You may complain to your local data protection authority. In Denmark, this is Datatilsynet.
Why we process account data
Account authentication, saving the progress you request, and operating your club memberships and campaign participation support providing the requested service (GDPR Article 6(1)(b)). Proportionate security checks, prevention of repeat entries and abuse, and internal service-usage measurement serve the legitimate interests of maintaining a fair, secure and usable game (Article 6(1)(f)). Campaign entry confirmation records eligibility and rules acceptance; it is not consent to marketing.
Service providers and external links
The site runs on Sites hosting and Cloudflare infrastructure. Hosted sign-in is provided through ChatGPT; Google Identity Services is used when enabled. These services process authentication and operational traffic. External skin image hosts receive ordinary network requests. Social buttons are ordinary links, with no embedded social feeds or tracking pixels added by Skin Streak. Opening a link or sending a DM takes you to a separate provider with its own terms and privacy practices.
Privacy contact
Contact Skin Streak by direct message on X: @playskinstreak. Include the page or feature involved and your public game alias where relevant. Never send your password, sign-in token or identity documents through social media.
For a specific prize campaign, use the organizer and contact information published in that campaign’s rules. Social media platforms process messages under their own privacy policies.