Last updated: September 28, 2026
1. Who is responsible
The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:
David Kerscher
[Business address — pending]
Germany
Email: admin@skincasereviewer.com
SkinCaseReviewer.com is operated from Germany. Besides the GDPR, the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG) apply.
2. Short version
- No tracking or advertising cookies. We don't use Google Analytics, Facebook/Meta pixels, ad networks or similar tracking tools.
- Everything is hosted by us. Fonts and scripts are served from our own server — your browser doesn't contact Google Fonts or other CDNs when you visit us.
- What we do measure: clicks on our affiliate links (with a shortened IP address) and whether blog posts are really read (with a one-way hashed IP address). Both help us bill partners correctly and pay writers only for real readers.
- If you join our Earn program, we store the data we need to review your blog and pay you.
3. Hosting and server log files
Our website is hosted by Hostinger International Ltd. (Cyprus) within the EU. When you visit a page, the server automatically processes technical data that your browser sends: IP address, date and time, requested page, referrer URL, browser type and operating system. This is necessary to deliver the website and keep it secure (Art. 6(1)(f) GDPR — legitimate interest in a stable and secure website). The hosting provider processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Server logs are kept by the host for a limited period for security purposes and then deleted.
4. Affiliate links and click counting
Links to partner sites go through our own redirect (/go/…). When you click one, we store: date and time, which link was clicked, the page you came from, your browser/user-agent and your IP address in shortened form (the last part is removed immediately, e.g. 84.131.150.0), so it can no longer be linked to you. The browser/user-agent is removed after 90 days; after that only anonymous statistics remain.
Purpose: counting clicks per partner and page, spotting bot/fraud clicks and billing our affiliate partners. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in running and financing the website). We do not set any cookie for this.
Partner websites: once you arrive on a partner site (e.g. a gambling or trading platform), that site may use its own cookies or referral codes to credit us with a commission. This is outside our control; the partner's own privacy policy applies.
5. Blog view counter and comments
View counter: each blog post shows how often it was opened. We only store a number per post — no IP address, no cookie.
Comments: if you leave a comment, we store the name you enter (it can be a nickname), your comment text and the date. Comments are public. Legal basis: Art. 6(1)(f) GDPR. You can ask us at any time to delete your comment.
6. Verified blog reads (fraud protection)
To pay blog writers only for real readers, our blog pages check whether a visit is a genuine read. The script runs only on blog posts and sends us: which post, a one-time token our server issued, how long the page was open and in view, how far you scrolled, how many interactions (mouse, touch, keyboard, scroll) happened, the referring website, and technical signs of automated browsers.
On our side we store the post, the result (counted or not, and why), the source (e.g. "Google") and your IP address only as a salted one-way hash — the IP itself is never saved. The hash lets us count each reader once per day and detect click farms. This does not store anything on your device and is not used for profiling or advertising.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing fraud and paying writers correctly). The records are deleted after 13 months.
Cloudflare Turnstile: if activated, a Cloudflare Turnstile check may run at the end of a verified read to tell humans from bots. This loads a script from Cloudflare, Inc. (USA), which processes your IP address and technical browser data for this check. Cloudflare is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR (bot and fraud protection).
7. Earn program (writing for us)
If you submit a blog through our Earn program, we process:
- your Discord username (used as your payout identity), optional email address, the author name you want shown, your payout method and wallet address (or partner-site username for coin payouts);
- your blog content and images, your topic/category choices;
- the IP address and browser of the submission (to detect duplicate or fraudulent accounts);
- which version of our Writer Terms you accepted and when (proof of our agreement);
- later: the verified reads and search clicks of your blog and the payouts we made, and — if we suspect cheating — the reason payouts were held back.
PDF uploads are read directly in your browser. The PDF file itself is never sent to us — only the extracted text and the images in it, which you then see and edit in the preview.
Purpose: reviewing and publishing your blog, calculating and paying your earnings, preventing fraud. Legal basis: Art. 6(1)(b) GDPR (our agreement with you), Art. 6(1)(c) GDPR (tax and accounting obligations) and Art. 6(1)(f) GDPR (fraud prevention). Your author name is published with your blog.
Storage: rejected submissions are deleted after 6 months. For published blogs we keep the data while the blog is online and while earnings are open; payout records are kept for up to 10 years as required by German tax law (§ 147 AO, § 257 HGB). Please note that crypto payouts are recorded publicly and permanently on the respective blockchain.
While you prepare a submission, your draft is saved only in your own browser (local storage) until you submit or discard it. The Earn page uses a technically necessary session cookie (scr_earn) for its password lock and security token.
8. Reporting a blog
Community blogs have a "Report this blog" button. If you use it, we store the blog, the reason and details you enter, the optional email or Discord name you give us so we can answer, the date, and your IP address only as a salted one-way hash (to stop the same person from reporting the same blog many times). The IP itself is not saved. Purpose: removing stolen, false or harmful content. Legal basis: Art. 6(1)(f) GDPR. Closed reports are deleted after 6 months. Your browser also remembers (local storage) which blogs you already reported.
9. Cookies and local storage
We only use storage that is strictly necessary (§ 25(2) no. 2 TDDDG), so no consent banner is required:
cookieConsent(local storage) — remembers that you closed our privacy notice.scr_earn(session cookie) — only on the Earn page and admin area; deleted when you close the browser.scr_earn_draft_v1(local storage) — only if you start an Earn submission; your unsent draft.scr_reported(local storage) — only if you report a blog; hides the report button for blogs you already reported.
We do not use cookies for tracking, analytics or advertising.
10. Search engine statistics
We use Google Search Console and Bing Webmaster Tools to see how often our pages are clicked in search results. We only receive aggregated numbers per page (e.g. "120 clicks in August") — no data about individual visitors.
11. Contact
If you contact us by email or Discord, we process your message and contact details to answer you (Art. 6(1)(b) or (f) GDPR) and delete them when they are no longer needed, unless legal retention periods apply.
12. External links
We link to external websites (partner platforms, Discord, X, TikTok, Instagram, Steam and others). These are plain links: no data is sent to these services until you click them. After that, their privacy policies apply.
13. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Where processing is based on consent, you can withdraw it at any time with effect for the future.
To use these rights, email admin@skincasereviewer.com. You also have the right to lodge a complaint with a data protection supervisory authority — for us this is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Ansbach.
14. Changes
We update this policy when our website or the law changes. The current version is always available on this page.