Privacy Policy

Last updated: October 5, 2026

This Privacy Policy explains what personal data we collect when you use MineSkin PRO, why we collect it, who we share it with, how long we keep it and what rights you have. It covers the mineskin.pro website, the MineSkin PRO apps for iOS and Android, and any related service ("the Service").

Our Cookie Policy explains the cookies and similar storage we use. Our Terms of Use explain the rules for using the Service.

Who Is Responsible for Your Data

MineSkin PRO is run by Hamza Khuswan, a sole trader in Sweden ("we", "us", "our"). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR).

Address: Holgersgatan 5N, 311 35 Falkenberg, Sweden
Email: hi@mineskin.pro

In Short

You can edit, preview and export skins without an account. Those skins stay in your browser or on your device, and we never see them.
If you create an account, we store your email address, your profile, your preferences and your session so you can sign in.
If you have PRO, we store the skins and folders you sync so they reach all your devices.
If you share a skin or a folder, the people you share it with see it, together with your name, your avatar and your email address.
Payments are handled by Stripe, Apple or Google. We never receive your card details.
We use Google Analytics only if you agree to it. We also use Vercel Analytics, which uses no cookies, and Sentry to find and fix errors.
We don't sell your personal data and don't use it for advertising.

What We Collect

Without an Account

You can use the editor without an account. The skins, folders, reference images and settings you create are stored only in your browser or on your device (in local storage and IndexedDB). They are not sent to us. They stay there until you delete them or clear your browser or app data.

If you allow it, the iOS app uses your camera to take reference photos. These photos are also stored only on your device.

When you visit the Service, your browser or app sends us technical information, such as your IP address, browser type and the page you asked for. Our hosting provider uses it to deliver the page and to protect the Service, and keeps it briefly in its server logs.

Your Account

When you create an account and sign in, we store:

Your email address. We use it to sign you in and to contact you about your account, your subscription and changes to our policies.
How you sign in. If you sign in with a one-time code, we store a scrambled (hashed) copy of the code, the number of attempts and the IP address that asked for it, for at most 10 minutes. If you sign in with Google or Apple, we receive your account ID with that provider, your email address and your name. For Sign in with Apple, we also store a token that lets us disconnect MineSkin PRO from your Apple ID when you delete your account.
Your profile. The display name and the avatar (a small Minecraft-style face) you choose. If you don't set a name, the part of your email address before the "@" is used instead.
Your preferences. The language you choose and whether you have finished or skipped the editor tutorial, so your other devices can use them.
Your sessions. A random sign-in token, stored as a scrambled copy, together with your browser or device type (user agent), the approximate location you signed in from (country and city, worked out from your IP address by our hosting provider; we don't store the IP address itself), when the session started and expires, and when it was last used.
When you joined and last signed in.

We don't ask for or store passwords.

PRO Subscriptions

When you subscribe to PRO, we store a customer or subscription ID from your payment provider, the plan, the subscription status and the date it renews or ends. The payment itself is handled by:

Stripe on the web. Stripe receives your email address, your account ID and your language, so its payment pages, receipts and invoices use your language. It collects your payment details on its own pages.
Apple's App Store in the iOS app.
Google Play in the Android app.

For App Store and Google Play purchases, we send the store a random ID linked to your account, so we can match the purchase to you. We never receive your card details. Stripe, Apple and Google process your payment under their own privacy policies.

Cloud Sync

With PRO, the skins and folders in your library sync across your devices. For this, we store on our servers:

each skin's image (its pixels), name, model type (classic or slim), resolution and when it was created and changed, and
your library: which skins it contains, your folders and their names, and the order of your skins.

The skins you sync stay on our servers until you delete them or your account. If PRO ends, sync pauses and we keep your synced skins for 90 days, so they come back if you subscribe again within that time. After that, we delete them from our servers. We email you when PRO ends and again 7 days before. Your account and the skins on your devices stay, and those skins sync again if you subscribe later. A copy of your synced skins is also kept in your browser or app so they work offline.

Reference images are not synced.

When you share a skin or a folder, we store its sharing settings: whether the link is on, what people with the link can do, and the email addresses you invited, with their role (viewer or editor).

What other people see about you:

People who open your share link see the skin or folder and a partly hidden version of your email address (for example, h•••@example.com). They don't need an account to see it.
People you invite by email receive an email from us that shows your email address, the name of the skin or folder, their role and the link. When they open it, they see your full email address.
People who join your skin or folder while signed in can see your display name and avatar. You can see theirs, and the email addresses you invited.

Only share with people you are happy to show this to. You can turn the link off or remove people at any time.

If someone invited you. We received your email address from the person who invited you, so we could send you the invitation. We store it in their sharing settings until they remove you, delete the skin or folder, or delete their account. We don't use it for anything else. If you don't want to receive invitations, email us.

Editing Together (Presence)

When you have a shared skin open, the other people who have it open at the same time see that you are there. To show this, your app sends them, about every 20 seconds and while you move the camera:

your display name and avatar,
where your camera is looking on the skin, and
your device type and platform (for example "phone" or "Mac"), worked out from your browser.

These messages are passed on in real time and deleted from our servers after 60 seconds.

Contacting Us and Reporting Problems

If you email us, send feedback or report a problem, we receive what you write, your email address if you give it, and any files you attach. If you are signed in, the report form fills in your email address for you.

Analytics and Error Monitoring

Google Analytics. If you agree to analytics cookies, Google Analytics collects information about how you use the Service, such as the pages you visit, the features you use (for example exporting a skin or recording a clip), your language, your device and browser, and your approximate location from your IP address. We have turned off advertising features. If you don't agree, Google Analytics stores no cookies and receives no identifier for you. It may still receive basic, cookieless signals (such as that a page was viewed), which Google uses only to estimate overall traffic. You can change your choice at any time, see the Cookie Policy. Google Analytics keeps the data for at most 14 months.
Vercel Analytics. Counts page views and visitors in aggregate, without cookies and without identifying you across websites.
Sentry. When something goes wrong, Sentry receives an error report with technical details: your browser, device and operating system, your IP address, the page and what the app was doing. Sentry also measures how fast the app is. If you are signed in, error reports and feedback include your account ID and email address, so we can follow up. When an error happens, Sentry also records a short replay of what happened on the page just before (clicks, navigation and changes to the page), so we can understand and fix it. Text you type and images are hidden in replays.

Why We Use Your Data (Legal Bases)

To provide the Service you asked for (performance of a contract, GDPR Art. 6(1)(b)): your account and sign-in, PRO, cloud sync, sharing, invitations, editing together and support.
To take payments and keep accounting records (contract and legal obligation, Art. 6(1)(b) and (c)).
To keep the Service secure and working (legitimate interests, Art. 6(1)(f)): limiting how often codes and invitations can be sent from an IP address or account, preventing abuse, server logs, error monitoring with Sentry and cookieless statistics with Vercel Analytics. Our interest is a reliable, secure Service, and we use the least data we need.
To send invitations on behalf of the person sharing (legitimate interests of the person sharing and of us, Art. 6(1)(f)).
To understand how the Service is used with Google Analytics (consent, Art. 6(1)(a)). You can withdraw your consent at any time.
To meet legal obligations (Art. 6(1)(c)), such as bookkeeping and answering lawful requests from authorities.
To handle reports and moderate content under the EU Digital Services Act (legal obligation and legitimate interests, Art. 6(1)(c) and (f)).

We don't use automated decision-making or profiling that has legal or similarly significant effects on you.

We share personal data only with the service providers that help us run the Service, and only what they need. They process it on our behalf and under our instructions:

Vercel (USA): hosting, file storage for synced skins, server logs and Vercel Analytics.
MongoDB Atlas (MongoDB, Inc., USA): our database, which holds accounts, sessions, sharing settings and synced skins.
Resend (USA): sending sign-in codes and invitation emails.
Sentry (Functional Software, Inc., USA): error reports, performance monitoring, session replays and feedback.
Google Analytics (Google): usage statistics, only with your consent.

These companies receive data as independent controllers, under their own privacy policies:

Stripe for web payments, Apple for App Store purchases and Sign in with Apple, and Google for Google Play purchases and Sign in with Google.
GitHub, when a page shows the star count of our open source project. Your browser fetches it directly from GitHub, which sees your IP address.

We also share data:

with the people you share skins and folders with, as described above,
when the law requires it, for example with courts or authorities, and
if the Service is transferred to a new owner, who must keep protecting your data under this policy.

We don't sell your personal data and don't share it for advertising.

Transfers Outside the EU/EEA

Some of our providers are based in the USA or store data there. When your data is transferred outside the EU/EEA, we rely on the EU–US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards.

How Long We Keep Your Data

Account, profile and preferences: until you delete your account.
Sessions: 30 days, or until you sign out.
One-time sign-in codes and the IP address that asked for them: at most 10 minutes.
Synced skins and your library: until you delete them or your account, or 90 days after PRO ends. When you delete a synced skin, its contents are deleted. A small marker with its ID, its owner's account ID and dates stays, so your other devices know it was deleted and don't upload it again.
Sharing settings and invited email addresses: until the owner changes them, deletes the skin or folder, or deletes their account.
Presence messages: 60 seconds.
Subscription and payment records: as long as accounting law requires, which is currently seven years in Sweden.
Error reports and session replays: a limited period set in our Sentry account, after which Sentry deletes them automatically.
Google Analytics data: at most 14 months.
Emails you send us: as long as we need them to help you, and then deleted.

When you delete your account, we delete your account, profile, preferences, sessions, synced skins, library, sharing settings and the folders you shared, and remove you from skins and folders others shared with you. We cancel a web subscription right away. We cancel a Google Play subscription so that it doesn't renew. If you used Sign in with Apple, we disconnect MineSkin PRO from your Apple ID. App Store subscriptions must be canceled in your Apple ID settings. Copies may stay in our providers' backups for a short time until they are overwritten. Payment records stay as long as accounting law requires. Skins saved in your browser or on your devices stay there until you delete them.

How We Protect Your Data

All data is encrypted in transit. Synced skins are kept in private storage that isn't publicly accessible. Sign-in codes and session tokens are stored only as scrambled (hashed) copies. Share links contain a long random secret, kept in the part of the link that browsers never send to other websites. Access to our systems is limited to what is needed to run the Service. No service is perfectly secure, but we work to protect your data, and we will tell you and the authorities about a breach where the law requires it.

Your Rights

Under the GDPR, and similar laws in other countries, you have the right to:

access the personal data we hold about you and get a copy of it,
correct data that is wrong. You can change your name, avatar and language yourself in the app,
delete your data. You can delete your account yourself in the app's account settings,
restrict how we use your data, or object to uses based on our legitimate interests,
data portability: get the data you gave us in a common, machine-readable format. You can also export any skin as a PNG file, and
withdraw your consent at any time, for example to Google Analytics, as explained in the Cookie Policy. This doesn't affect what we did before.

To use your rights, email hi@mineskin.pro from the email address on your account. We answer within one month. We may ask you to confirm who you are.

You also have the right to complain to a data protection authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se. You can also complain to the authority in the EU country where you live or work. We would like to hear from you first, so we can try to fix the problem.

Children's Privacy

You must be at least 13 years old to create an account. If you are under the age at which you can consent to data processing yourself in your country (13 in Sweden, and between 13 and 16 elsewhere in the EU), a parent or guardian must agree to you creating an account. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data without the consent they needed, please contact us and we will delete it.

Links to Other Websites

The Service links to other websites, such as Minecraft, GitHub and Discord. Their privacy policies apply when you visit them, and we are not responsible for how they handle your data.

Changes to This Policy

We may update this Privacy Policy when the Service or the law changes. We post the new version here and update the date at the top. If a change matters to you, we tell you before it takes effect, by email or in the app.

Contact Us

Questions about this Privacy Policy or your data? Email us at hi@mineskin.pro.