SkinHub
Login

Privacy

Last updated 2026-08-16

skins.sulej.net is a hobby project I run on my own hardware in Switzerland for the osu! community, under Swiss data protection law (FADP). This page lists in plain language what the service stores about you, where it goes, and how to get it removed.

What I collect

  • osu! identity. When you log in with osu!, I receive your osu! id, username, country, current rank, and avatar via the official osu! OAuth flow, and refresh them while you use the site. I never see your osu! password. Avatars are cached on my storage so the site does not hit osu! on every page view.
  • Cookies. skinhub_session (random opaque token mapped server-side to your osu! id, HttpOnly), skinhub_csrf (anti-forgery token, readable by the page's JavaScript by design), both expiring 7 days after login, and skinhub_oauth_state (10 minutes, only during the login round-trip). The anti-bot layer in front of the site sets one technical cookie of its own after its browser check. Your theme choice stays in your browser's local storage and never reaches the server. There are no advertising or analytics cookies.
  • Skins you upload. The .osk contents plus metadata (skin name, description, tags), the previews and archives rendered from them, and the version history: every published version stays browsable, so earlier versions of a skin remain downloadable after you change or delete it.
  • "Pick" assignments. Which skin you chose for each mod combination, read when your replays are rendered.
  • Support inquiries. What you send through the support form is stored, together with your osu! id and username, in a private issue tracker on the same infrastructure.
  • Logs and metrics. Server logs (application and reverse proxy) contain request metadata: IP address, user agent, path, and the account id for authenticated requests. They rotate after 14 days. Internal monitoring keeps operational counters, some per account (for example download and rate-limit counters keyed by osu! id), for 90 days. Rate limiting keeps short-lived per-account and per-IP counters in the database.

Where it lives

The service runs on hardware I own and operate in Switzerland: the database, the file storage, the issue tracker, and the monitoring. Backups rotate on a schedule, so deleted data can persist in backups for a limited time before rotation ages it out.

Third parties

  • osu! (osu.ppy.sh): the OAuth login, profile refreshes, and avatar fetches. During login osu! sees that you authorized SkinHub.
  • Render workers. Renders run on GPU workers that I approve individually; some are operated by community volunteers. A worker receives the skin files it needs for the job and the collection id they belong to, renders, and uploads the result. Workers are bound by the rules not to keep or reuse the content.
  • CrowdSec: the intrusion-prevention layer shares signals about attacking IPs (not normal visitor traffic) with CrowdSec's central service, which powers the community blocklist this server also consumes.
  • jsdelivr CDN, only if you open /api/docs: that page loads the Scalar API reference bundle from jsdelivr.net. The rest of the site has no external CDN dependency.
  • Link previews. When someone shares a link to a profile or skin, chat apps and crawlers get a preview: skin name, username, and a long-lived image link to the avatar or thumbnail. Those specific images are viewable without an account by anyone holding the link.
  • Community integrations. The community Discord bot renders replays with the skin picks you set here, and the Twitch extension shows a streamer's own skin collection on their channel if the streamer installs it. Both act on your explicit choices.

I don't sell or trade anything, and nothing goes to ad networks or analytics providers.

Retention and deletion

Sessions expire after 7 days, server logs after 14 days, per-account metrics after 90 days. Your skins, picks, and profile data stay until you delete them or ask me to. Deleting a skin removes it from your current collection; because of the version history, earlier published versions remain until I remove them on request. Full account wipes are manual right now: contact me and I'll remove your account, content, and version history.

Your rights

You can ask me for a copy of everything stored about you (your skins are also directly downloadable from your own page), ask for corrections (identity fields correct themselves from osu! on your next login), and ask for deletion of some or all of it. If you think I'm mishandling your data, you can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Contact

Use the Support button in the footer (fastest), or DM @arlind on Discord. That covers privacy questions, data export, and deletion requests.

Changes

When this page changes in a way that matters, I update it here and bump the date at the top.