Privacy Policy

Last updated: April 12, 2026

Draft. This policy accurately reflects what data Skilly collects today and which third parties process it. A final, generator-produced version will replace this before we exit beta.

1. What we collect

We collect the minimum needed to run Skilly:

Account data — your email address and authentication identifiers via WorkOS AuthKit
Billing data — subscription status, held by Polar. We never see your full card number.
Usage metrics — anonymous per-session numbers: session length, turn count, token counts, feature usage
Website analytics — anonymous page views, click events, and session replays of website visits via PostHog. Replays show scroll and cursor paths to help us find UX problems; all input fields (email, etc.) are automatically masked. No cookies. No cross-session tracking.
Waitlist data — if you join the waitlist, we store your email and chosen platform in our Resend audience

2. What we do NOT collect

To earn and keep your trust, Skilly deliberately does not store:

Audio recordings of your voice
Screenshots of your screen
The content of your prompts or Skilly\u2019s responses
Keystrokes, cursor position, or any other device telemetry from the macOS app beyond what's needed for a single live teaching session (note: the marketing website at tryskilly.app does record anonymous cursor paths via PostHog session replay to find UX issues — see "Website analytics" above)

Audio and screen data are streamed to OpenAI for real-time processing during a teaching session and are not retained by us afterward. Only anonymous aggregate metrics about the session are kept.

3. Third-party data processors

Skilly uses the following third-party services to run the product. Each link goes to that service's own privacy policy.

OpenAI

Purpose: Real-time voice and vision inference — the model that powers Skilly’s teaching in the macOS app

Data shared: Transcribed audio, screen context, and model prompts, sent per teaching session. OpenAI processes these to generate responses and is contractually prohibited from using them for training.

Location: United States

PostHog

Purpose: Anonymous product analytics + session replay on the marketing website only (page views, button clicks, scroll/cursor paths) to find and fix UX issues

Data shared: Event names, page URLs, anonymous website session replays with all input fields automatically masked. No cookies. No persistent identifiers.

Location: United States

WorkOS

Purpose: Authentication and account management via AuthKit (handled inside the macOS app)

Data shared: Email address, hashed password or OAuth identifier, account metadata

Location: United States

Polar

Purpose: Subscription billing and payment processing

Data shared: Billing email, subscription status, payment method token (no card numbers stored by us)

Location: United States

Cloudflare

Purpose: Backend infrastructure for the macOS app (API requests, edge functions, DDoS protection)

Data shared: Server access logs, IP addresses (retained by Cloudflare’s infrastructure for short periods), TLS connection metadata

Location: Global CDN (varies)

Resend

Purpose: Transactional email delivery (waitlist confirmations, account notifications)

Data shared: Email address, message content, delivery status

Location: United States

Netlify

Purpose: Website hosting and the backend for the waitlist form on tryskilly.app

Data shared: Server access logs, IP addresses (retained by Netlify’s infrastructure for short periods)

Location: United States

4. Cookies and tracking

Skilly's website does not use cookies for analytics or tracking. PostHog is configured in anonymous/memory mode, meaning no cookies or localStorage identifiers are set. Your visit is not tied to a persistent identifier. Individual sessions are anonymous.

5. Data retention

Account data is retained while your account is active and for 30 days after deletion
Billing records are retained as required by applicable financial regulations (typically 7 years)
Anonymous usage metrics are retained indefinitely in aggregated form, but cannot be traced back to an individual
Waitlist entries are retained until launch or until you unsubscribe via the link in any email we send

6. Your rights

Depending on where you live, you may have rights under GDPR, CCPA, or similar laws, including:

The right to access the data we hold about you
The right to correct inaccurate data
The right to delete your data ("right to be forgotten")
The right to export your data in a portable format
The right to opt out of any non-essential processing

To exercise any of these rights, email hello@tryskilly.app. We'll respond within 30 days.

7. Children

Skilly is not directed at children under 13, and we do not knowingly collect data from them. If you believe we have, contact us and we'll delete it.

8. Changes to this policy

We'll update this page when we add, remove, or change data processors, or when we change what we collect. Material changes will be communicated via email to your account address.

9. Contact

Privacy questions or requests: hello@tryskilly.app.