Privacy Policy

This policy explains how Ingiber Freyr, based in Iceland ("we", "us"), handles personal data when you use Skissa. We are the data controller for the data described here. We collect as little as we can and never sell personal data.

What we collect

• Account details: your name, email address and a hashed password, or your Google profile name and email if you sign in with Google.
• Your content: the workspaces, projects, plotlines, chapters, scenes and characters you create, and who you invite to collaborate.
• Session data: a session cookie that keeps you signed in, along with the IP address and browser type used for each session, for security.
• Billing data: your plan and subscription status. Payments are processed by Paddle, who collect your payment and billing details directly. We never see or store your full card details.

We don't use advertising or third-party tracking cookies.

Why we use it

• To provide the Service: sign you in, store your work and share it with the collaborators you choose (performance of our contract with you).
• To keep the Service secure and prevent abuse (our legitimate interests).
• To manage your subscription and meet tax and accounting obligations (contract and legal obligation).
• To email you about your account and important changes to the Service. We won't send marketing emails without your consent.

Who we share it with

We use a small number of providers to run Skissa. They process data only on our instructions:

• Vercel (hosting)
• Neon (database)
• Paddle (payments and tax, as Merchant of Record; Paddle is also an independent controller for the payment data it collects)
• Google (only if you choose to sign in with Google)

Some of these providers may process data outside the EEA. Where they do, they use safeguards such as the EU Standard Contractual Clauses. We may also disclose data if the law requires it.

How long we keep it

We keep your account and content until you delete them or close your account. After that we delete them within 30 days, except for backups, which expire on a rolling basis, and billing records, which we must keep for as long as the law requires.

Your rights

You can ask to access, correct, export or delete your personal data, or object to or restrict how we use it. Email hello@skissa.app and we'll respond within 30 days. You also have the right to complain to a data protection authority. In Iceland this is Persónuvernd (personuvernd.is).

Changes

If we make significant changes to this policy, we'll let you know by email or in the app.

Questions? Email hello@skissa.app.