Privacy

Last updated August 24, 2026

This product asks you to paste real work into it — status updates, interview notes, board reports. That means the honest version of this page matters more here than it does on most sites, so it is written to be read rather than to be survived. If something below is unclear, that is a bug; tell us.

What we collect

Three kinds of thing, and nothing else:

Your account. Your email address, a hashed password, and the name you give us. Optionally your role and what you have to produce each week, if you answer those.

Your work. The prompts you write, the material you paste, what the model produced from it, and the marks and scores that came back. On a practice run the material is ours. On a live run it is whatever you pasted.

How you use the product. Which steps of the loop you reached and when, plus a daily count of AI requests so we can cap them. These records hold numbers and short labels — a score, a cadence, a kind of output. They never hold anything you typed.

We do not use advertising trackers, we do not buy or sell data about you, and there is no third-party analytics script on this site.

What we do with it

Run your prompts, mark your work, keep your procedures and the documents they produce, and tell you when a ritual is due. That is the whole list.

We read aggregate usage — how many people finish a cold run, how many keep a ritual — to decide what to build. That analysis never involves reading your material.

We do not train models on your work, and neither does anyone we send it to. Your prompts and pasted material are sent to the model to produce your document and for no other purpose.

Who else sees it

Five companies, each doing one job. We do not share your content with anybody else, for any reason, unless the law requires it.

CompanyWhat it does for usWhat it can see
SupabaseRuns our database and sign-inYour account and everything you produce here
VercelHosts and serves the siteRequests to the site, including your IP address
OpenRouterRoutes our requests to the AI modelThe prompts and material you send to be run or checked
AnthropicProvides the models that run and mark your workThe prompts and material you send to be run or checked
ResendDelivers the one email we sendYour email address and the name of the ritual that is due

Your work crosses international borders — these providers run in the United States and the European Union. If that is a problem for your employer, it is worth knowing before you paste anything.

What you should not paste

We say this on the screen where you paste, and we mean it: leave out anything you would not put into a chat window. Customer names, contract values, personal data about other people, anything under an NDA that does not permit AI processing.

The product teaches this as a skill — the owner slot of every ritual asks what never goes in. Treat your own answer as binding.

How long we keep it

Until you delete it. A procedure and its whole run history go when you delete the ritual. Everything goes when you delete your account, immediately and for good — there is no grace period, no archive, and no backup we go back into to recover it.

What you can do

See it. Everything we hold about your work is already on screen: your rituals, their runs, and every document under Documents.

Delete part of it. Deleting a ritual takes its runs and documents with it.

Delete all of it. There is a button on your profile. It removes your account and everything attached to it, and it does not route through us.

Stop the email. One switch on your profile, or the unsubscribe link in any message. It is the only email we send.

If you are in the UK, the EU, or another place with statutory data rights — access, correction, portability, objection — those apply, and the buttons above are how most of them are exercised. For anything they do not cover, write to us and we will do it by hand.

Security

Every table is protected by row-level security, which means the database itself refuses to return one person’s rows to another — not merely that our code does not ask for them. Traffic is encrypted in transit. Passwords are hashed by our sign-in provider and never reach us.

We are a small early-access product. We have not been audited, and we are not going to claim a certification we do not hold.

Children

This is a product for working professionals. It is not for anyone under 16.

Changes, and how to reach us

If this page changes in a way that affects what happens to your work, we will say so in the product rather than quietly editing the date at the top.

Questions, requests, or something here that reads as untrue: email privacy@skillcraft.ai.