Privacy
Last updated August 24, 2026
This product asks you to paste real work into it — status updates, interview notes, board reports. That means the honest version of this page matters more here than it does on most sites, so it is written to be read rather than to be survived. If something below is unclear, that is a bug; tell us.
What we collect
Three kinds of thing, and nothing else:
Your account. Your email address, a hashed password, and the name you give us. Optionally your role and what you have to produce each week, if you answer those.
Your work. The prompts you write, the material you paste, what the model produced from it, and the marks and scores that came back. On a practice run the material is ours. On a live run it is whatever you pasted.
How you use the product. Which steps of the loop you reached and when, plus a daily count of AI requests so we can cap them. These records hold numbers and short labels — a score, a cadence, a kind of output. They never hold anything you typed.
We do not use advertising trackers, we do not buy or sell data about you, and there is no third-party analytics script on this site.
What we do with it
Run your prompts, mark your work, keep your procedures and the documents they produce, and tell you when a ritual is due. That is the whole list.
We read aggregate usage — how many people finish a cold run, how many keep a ritual — to decide what to build. That analysis never involves reading your material.
We do not train models on your work, and neither does anyone we send it to. Your prompts and pasted material are sent to the model to produce your document and for no other purpose.
Who else sees it
Five companies, each doing one job. We do not share your content with anybody else, for any reason, unless the law requires it.
| Company | What it does for us | What it can see |
|---|---|---|
| Supabase | Runs our database and sign-in | Your account and everything you produce here |
| Vercel | Hosts and serves the site | Requests to the site, including your IP address |
| OpenRouter | Routes our requests to the AI model | The prompts and material you send to be run or checked |
| Anthropic | Provides the models that run and mark your work | The prompts and material you send to be run or checked |
| Resend | Delivers the one email we send | Your email address and the name of the ritual that is due |
Your work crosses international borders — these providers run in the United States and the European Union. If that is a problem for your employer, it is worth knowing before you paste anything.
What you should not paste
We say this on the screen where you paste, and we mean it: leave out anything you would not put into a chat window. Customer names, contract values, personal data about other people, anything under an NDA that does not permit AI processing.
The product teaches this as a skill — the owner slot of every ritual asks what never goes in. Treat your own answer as binding.
How long we keep it
Until you delete it. A procedure and its whole run history go when you delete the ritual. Everything goes when you delete your account, immediately and for good — there is no grace period, no archive, and no backup we go back into to recover it.
What you can do
See it. Everything we hold about your work is already on screen: your rituals, their runs, and every document under Documents.
Delete part of it. Deleting a ritual takes its runs and documents with it.
Delete all of it. There is a button on your profile. It removes your account and everything attached to it, and it does not route through us.
Stop the email. One switch on your profile, or the unsubscribe link in any message. It is the only email we send.
If you are in the UK, the EU, or another place with statutory data rights — access, correction, portability, objection — those apply, and the buttons above are how most of them are exercised. For anything they do not cover, write to us and we will do it by hand.
Security
Every table is protected by row-level security, which means the database itself refuses to return one person’s rows to another — not merely that our code does not ask for them. Traffic is encrypted in transit. Passwords are hashed by our sign-in provider and never reach us.
We are a small early-access product. We have not been audited, and we are not going to claim a certification we do not hold.
Children
This is a product for working professionals. It is not for anyone under 16.
Changes, and how to reach us
If this page changes in a way that affects what happens to your work, we will say so in the product rather than quietly editing the date at the top.
Questions, requests, or something here that reads as untrue: email privacy@skillcraft.ai.