osc skins
Login

Privacy

Last updated 2026-06-02

skins.sulej.net is a hobby project I run on my own hardware for the osu! Swiss Community. This page lists what the server stores about you and why.

What I collect

  • osu! identity. When you log in with osu!, I receive your osu! id, username, country, current rank, and avatar URL via the official osu! OAuth flow. Stored in Postgres. I do not see your osu! password.
  • Session cookies. osc_session (random opaque token, mapped server-side to your osu! id; HttpOnly) and osc_csrf (anti-forgery token, readable by the page's JavaScript by design). Both are Secure, SameSite=Lax, expire 7 days after login, and are scoped to the host you logged in on (skins.sulej.net or beta.skins.sulej.net).
  • Skins you upload. The .osk contents plus metadata (skin name, your description, your tag assignments). They live in a private per-user git repo at git.sulej.net/osc/<your_osu_id>_skins (only the site backend can read it), with binary assets in Garage S3. The skins themselves are displayed publicly on this site by design.
  • "Pick" assignments. Which skin you chose for each mod combination, used by oscbot when rendering replays.
  • CI build logs. Output from generating your skin previews, stored in Postgres and Garage for the life of each tagged release.
  • Edge protection logs. CrowdSec and Anubis see standard request metadata (IP, user-agent, path) for abuse detection. Short retention.

Third parties

  • osu! OAuth (osu.ppy.sh), only during login. They see that you authorized osc-skins, I see the profile fields above.
  • jsdelivr CDN, only when you open /api/docs. That page loads the Scalar API reference bundle from jsdelivr.net. The rest of the site has no external CDN dependency.

Retention and deletion

Your skin repo, picks, and uploaded content stay until you (or an admin) delete them. Sessions expire 7 days after login. Want everything wiped? DM me on Discord.

Sharing

I don't sell, trade, or send anything to ad networks. Public skin pages and the community list are obviously public by design.

Contact

Privacy questions, data export, or account deletion: DM me on the osu! Swiss community Discord.