Privacy Policy

1. Who we are

Exylia Skins (the "Service") is the website at skins.exylia.net and the API at skins-api.exylia.net. It is operated by Cristobal Aranda, a natural person domiciled in Chile ("we", "us"). Contact: [email protected].

2. What we keep

• Discord sign-in: your Discord user ID, display name and avatar address. We request only the "identify" scope: never your email, password, servers or messages. The Discord access token is used once and discarded.
• Sessions: a random session token, stored on our side only as a hash, with its creation and expiry dates.
• Lent Minecraft accounts: the account's UUID and name, its upload statistics, and the session tokens Microsoft issues after you sign in with a device code, encrypted with AES-256-GCM. We never see or store the Microsoft password.
• API requests: images sent to the API until they are uploaded (then dropped), the resulting public Mojang textures, and an HMAC of the requester's IP address used for fair queueing and rate limits. The IP address itself is never stored.
• Usage analytics, only if you accept them in the cookie banner: Google Analytics and Microsoft Clarity receive the pages you visit (URL path and title, which on player, account and texture pages include Minecraft names or texture ids), the referring page, your device, browser and operating system, your screen size, an approximate location they derive from your IP address, and your clicks and scrolling. Clarity also makes session recordings and heatmaps of how pages are used, with all text inside the site's panels masked; the landing page is not masked.

3. What is public

Lent accounts are listed publicly with their Minecraft name, head, statistics and the Discord display name of the person who lent them. Textures, their Mojang ids, signed properties and which pool account uploaded them are public, as they are on Mojang's servers.

4. Why

To run the Service: signing you in, uploading textures with the accounts you lend, keeping the queue fair and the Service safe from abuse. The legal basis is the performance of the Service you asked for and our legitimate interest in keeping it working and free.

To understand how the Service is used and improve it, through usage analytics and session recordings, only if you accept them. The legal basis is your consent (GDPR art. 6.1.a; in Chile, your consent under Law 19.628 and Law 21.719), which you can withdraw at any time with the "Cookies" link in the footer.

5. How long

• Sessions expire after 30 days without use, or at sign-out.
• Removing a lent account wipes its Microsoft tokens at once; its public history (name, statistics) stays.
• Textures are kept indefinitely: they are the shared cache the Service exists for.
• Usage analytics: Google Analytics keeps it for 14 months and Clarity keeps session recordings for 30 days, after which those providers delete it. Withdrawing consent stops any further collection.

To have your Discord data and the public link between you and your lent accounts deleted, write to [email protected].

6. Cookies

The site sets, without asking, only the cookies it needs to work and those that remember choices you made. Analytics cookies are set only if you accept them in the cookie banner: until you choose, none is set and no analytics script is loaded. There are no advertising cookies.

• __Host-exs_session: keeps you signed in. 30 days. Strictly necessary.
• __Host-exs_oauth: protects the Discord sign-in against forgery. 10 minutes. Strictly necessary.
• exylia_consent: remembers whether you accepted or rejected analytics, for every Exylia site (*.exylia.net). 180 days. Strictly necessary.
• NEXT_LOCALE: the language you chose, shared by the Exylia sites. 1 year. Preference.
• exs_rail and exs_adv: remember the state of the sidebar. 1 year. Preference.
• Only with your consent, Google Analytics: _ga and _ga_<id>, which tell visits from the same browser apart. 2 years.
• Only with your consent, Microsoft Clarity: _clck (1 year) and _clsk (1 day), which tie the pages of a visit together, and CLID and MUID (1 year), which Microsoft uses to recognise the browser.
• The theme (light or dark) is kept in your browser's local storage and never leaves your device.

You can change your choice at any time with the "Cookies" link in the footer. If you withdraw your consent, the analytics cookies are deleted and the page reloads without the analytics scripts. The choice applies to every Exylia site and is asked again after 180 days.

7. Who else handles it

Discord (sign-in), Microsoft and Mojang (account sign-in and texture uploads) and our hosting providers.

Only if you accept analytics: Google LLC (Google Analytics, with advertising features and Google Signals off) and Microsoft Corporation (Microsoft Clarity), both in the United States and certified under the EU-U.S. Data Privacy Framework, which covers the transfer of data from the European Economic Area. We share nothing else with anyone and never use the data for advertising.

8. Your rights

You can ask to access, correct or delete your data, or object to its use, by writing to [email protected]. You can withdraw your consent to analytics at any time with the "Cookies" link in the footer, without affecting earlier processing. You may also complain to your data protection authority.