Privacy Policy

Introduction

Welcome to GptSkin (gptskin.best), an image-backed theme service for the Codex desktop app. This privacy policy explains what data we collect, how we use it, and the choices you have. We built GptSkin to collect as little data as possible, and we aim to be fully transparent about everything we do collect.

GptSkin is an independent product and is not affiliated with, endorsed by, or officially connected to OpenAI.

Information We Collect

1. Account Information

   • What we collect: Your email address and any profile details you provide when registering at gptskin.best.
   • Purpose: To manage your account, deliver Credits, provide API Keys, and respond to support requests.

2. Uploaded Images

   • What we collect: Images you submit for a paid custom theme build. Uploads are limited to 4 MiB and must be JPEG, PNG, or WebP.
   • Purpose: Solely to build the image-backed theme you requested.
   • Training: Uploaded images and completed themes are never used to train models. If you ask Codex imagegen to create the source image, your natural-language request is handled by Codex and is not sent to GptSkin.

3. Usage Details

   • What we collect: Basic service usage data such as paid theme build counts and Credit balance changes.
   • Purpose: To operate the Credits system and improve the service.

4. Anonymous Website Analytics

   • What we collect: Aggregate page views, referral source, country or region, browser, operating system, device type, and interaction information through Vercel Web Analytics and Microsoft Clarity.
   • How it works: Vercel Web Analytics does not use third-party cookies and does not associate page-view data with a persistent identity or IP address. Microsoft Clarity may use cookies or similar technologies to provide aggregated session and interaction analytics. We do not intentionally send email addresses, uploaded-image names, API Keys, or other account data as analytics events.
   • Purpose: To understand which public pages are useful, measure launch campaigns, and improve navigation and documentation.

5. Device Information

   • What we collect: Basic technical data such as operating system type, used for compatibility and debugging.
   • Purpose: To support macOS and Windows users reliably.

6. Cookies

   • What we collect: Small data files on your device used for session management and remembering your preferences.
   • Purpose: To keep you signed in, make the site work correctly, measure site usage, and—where advertising is enabled—support ad delivery, reporting, fraud prevention, and personalization subject to your choices and applicable law. You can disable cookies in your browser, but some features may not function.

7. Payment and Billing Information

   • What we collect: Payments are processed entirely by Creem, our Merchant of Record. Creem collects your payment method details, billing address, and transaction information, and is responsible for applicable taxes (such as VAT/GST).
   • What we do NOT collect: GptSkin never sees or stores your full card number or payment credentials. We only receive transaction confirmations and order identifiers from Creem.

Third-Party Advertising, Cookies, and Identifiers

GptSkin uses Google AdSense and may work with Google and other third-party advertising vendors or ad networks to display and measure advertisements on public content pages.

• Third-party vendors, including Google, may place and read cookies on your browser, or use web beacons, IP addresses, and other identifiers to collect information as a result of ads being served on this website.
• Google and its partners use advertising cookies to serve, limit, personalize, and measure ads based on your visits to GptSkin and/or other websites. Depending on your location, device, consent choice, and our AdSense settings, ads may be personalized or non-personalized.
• You can manage or opt out of personalized advertising through Google Ads Settings. You can also learn how Google uses data when you use partner sites at Google's Business Data Responsibility site.
• If other third-party advertising vendors serve ads on GptSkin, their own privacy policies and opt-out controls apply. You can find additional industry opt-out choices at AboutAds.

Where required in the European Economic Area, the United Kingdom, Switzerland, or other regulated regions, an applicable consent message allows you to accept, reject, or manage advertising and related data choices. Withdrawing consent does not affect processing that occurred before withdrawal.

GptSkin does not intentionally include email addresses, phone numbers, uploaded-image names, API Keys, or other personally identifiable information in Google ad requests, page URLs, or advertising data fields. The service does not request precise geolocation from your device, and it is not directed to children under 13.

What We Do NOT Collect

The GptSkin Skill and injector run locally on your machine and are designed to stay out of your data:

• We do not read or modify your Codex conversations. The injector only applies CSS variables, backgrounds, and controlled decorative layers to the Codex interface.
• We do not transmit your Codex DOM, session data, or chat content to our servers.
• The Chrome DevTools Protocol (CDP) connection used by the Skill is bound only to the loopback address (127.0.0.1) on your own machine.

Data Storage and Security

• Your GptSkin API Key is stored locally in ~/.gptskin/config.json; the Skill applies restrictive directory and file permissions (0700 / 0600) on supported systems.
• Server-side data is stored with encryption and access controls.
• Honest disclosure: a loopback CDP port has no application-layer authentication. Another process running under the same local user account could attempt to connect while the Codex process launched with the debugging flag remains alive. The Skill binds the port to 127.0.0.1 and disconnects after injection, but closing that Codex process or restarting without the flag is what closes the port.

No method of transmission or storage is 100% secure, but we follow the practices above to protect your information.

Information Sharing and Disclosure

We do not sell or trade your personal information. We share data only in these limited cases:

• With Creem, to process your payments and handle taxes as Merchant of Record.
• With Vercel, to host the site and provide privacy-focused, aggregate Web Analytics.
• With Microsoft Clarity, to understand aggregated public-page interactions and improve usability.
• With Google and participating advertising vendors, to deliver, measure, secure, and—where permitted and consented to—personalize advertisements.
• To comply with legal obligations or lawful requests from authorities.
• To protect our rights, property, or safety, or that of our users.

Data Retention and Deletion

• You can delete any generated theme from your account at any time.
• You can request deletion of your account and associated personal data by contacting us at support@gptskin.best.
• After account deletion, we remove your personal data from active systems, except where retention is required by law (for example, transaction records that Creem must keep for tax and accounting purposes).

Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email support@gptskin.best. We respond to support requests within 3 business days.

Changes to This Policy

We may update this privacy policy from time to time. Changes are effective when posted on this page, and we will update the date above. We encourage you to review this page periodically.

Contact Us

If you have any questions about this privacy policy or our data practices:

• Website: gptskin.best
• Email: support@gptskin.best

By using GptSkin, you consent to this privacy policy. Thank you for trusting us with your information.