Privacy Policy

Effective Date: 12 July 2026

1. Introduction

Welcome to Skales. This Privacy Policy applies to:

• The Skales Desktop Application (Windows, macOS, Linux)
• The Skales Mobile Application (Android via Google Play Store, iOS via Apple App Store)
• Our backend at skales.app/api/
• Our marketing website at getskales.app

Skales is a private, non-commercial project operated from Austria.

2. Data Controller

The responsible Data Controller according to the General Data Protection Regulation (GDPR) is:
Mario Simic
Vienna, Austria
Email: dev@mariosimic.at
(Private project, no commercial entity)

3. Data Collected by the Skales Apps (Opt-In Only)

The Skales apps (Desktop and Mobile) do not collect any data by default. If you explicitly opt-in to help us improve the apps or participate in the community features, we collect the following limited, anonymized data:

• Anonymous ID: A locally generated, crypto-random string that cannot be traced back to your real identity or device.
• Basic Telemetry: App version and operating system (e.g., "Android 15", "iOS 18", "macOS 14").
• Feature Usage: Anonymous counts of which tools are used (e.g., "generated 5 images", "organized 10 files"). We do not collect the content of these tasks.
• Discover Feed: If you join the community feed, we store your chosen Tag (a public username not linked to your real identity), the template-based achievements you broadcast, and upvote counts.
• Bug Reports (Voluntary): If you submit a bug report, we collect your description and your email address only if you voluntarily provide it so we can reply to you.
• Newsletter (Voluntary): Your email address if you explicitly subscribe to updates.
• Skales IQ (free included starter, Opt-In): Skales IQ is an optional, free, included AI backend for people who do not have their own API key yet. It is not a trial of a paid plan and there is nothing to purchase. If you activate it, we store the email address you enter together with salted, non-reversible hashes of your device id and anonymous app id, on our own server (Hetzner, EU). We use these for exactly one purpose: enforcing one free allocation per person and preventing and tracing abuse of the included usage. The email is not used for marketing. The legal basis is our legitimate interest in preventing abuse and operating the service (Art. 6(1)(f)). You can delete this data at any time (see Section 11). Your chats are routed through our relay to an AI model provider (see Section 12); we do not store your prompts or responses. The anonymous app id is used as the allocation gate signal. Anonymous usage statistics are collected only if you enable the optional toggle (consent, Art. 6(1)(a)); you can change this during onboarding or anytime in Settings, and it does not affect your included usage.

4. What We Strictly DO NOT Collect

To ensure your absolute privacy, the Skales apps are architected to never collect, log, or transmit:

• No IP Addresses: We do not log IP addresses in our app backend. The Skales IQ relay reads your IP address only transiently to rate-limit trial sign-ups and does not store it.
• No Conversations: Your chat histories, AI prompts, and responses stay 100% on your local device.
• No File Contents: File names, paths, or file contents are never accessed by our servers.
• No Browsing History: We do not track the websites you visit or summarize.
• No API Keys: Your LLM API keys (OpenAI, Anthropic, OpenRouter, etc.) never leave your device.
• No Geolocation or Fingerprinting: We do not track your physical location or browser fingerprint.
• No Server-Side Personal Data: We never upload or store your contacts, calendar, photos, or files on Skales servers. Both the Desktop and Mobile apps work with them locally on your device to carry out what you ask; they are never sent to Skales.
• No Advertising Identifiers: We do not read or transmit Android Advertising ID, iOS IDFA, or any advertising tracking identifiers.
• No Third-Party Analytics SDKs: The Skales apps contain no Facebook SDK, Google Analytics SDK, Firebase Analytics, AppsFlyer, Adjust, or similar tracking libraries.

5. Mobile App-Specific Data Handling

5.1 On-Device Storage

The Skales Mobile App stores all your data locally on your device using platform-appropriate secure storage:

• Chat histories, tasks, notes, memories, preferences: Stored in encrypted MMKV storage (a secure key-value store) on your device.
• API keys: Stored in iOS Keychain or Android EncryptedSharedPreferences (hardware-backed where available). Never transmitted to our servers.
• User profile, settings: Stored locally; never uploaded.

5.2 Mobile App Permissions

Skales Mobile requests the following permissions only when needed, and only for local functionality:

• Internet Access: Required for communicating with LLM providers (OpenAI, Anthropic, etc.) using YOUR API key, and optionally for the Discover Feed if you opt in.
• Storage Access (Android) / Photo Library (iOS): Optional, only requested if you want to share files with Skales or save generated images/videos. We never upload your files.
• Camera: Optional, only if you use the "take a photo" feature. Images are processed locally and sent to your chosen AI provider using your API key.
• Microphone: Optional, only if you use voice input. Audio is processed locally or sent to your chosen voice service; we never store it.
• Contacts (optional): Read on your device only when you ask Skales to find, call, message, or email someone. Read-only; the detail you asked for is used to complete that request (and, like anything in a chat, travels to your chosen AI provider), never uploaded to Skales.
• Calendar (optional): Read or add an event only when you ask Skales to check your schedule or book something. Never uploaded to Skales.
• Location, when in use (optional): Read on your device only when you ask for weather, nearby places, or directions. Foreground only; never used for tracking and not stored beyond the current session.
• Notifications: Optional. Local task and agent reminders — and, if you enable them, Buddy check-ins and morning briefings — are generated and delivered entirely on-device (when composing a check-in requires an AI call, it uses the provider you configured, exactly like a chat message). Separately, if you pair the app with a Skales Desktop, the app registers a push token so our EU-hosted relay can notify you that a reply arrived while the app was closed. That push is content-free ("your reply is ready") and your messages stay end-to-end encrypted; the relay stores only the pairing device id and the token, deletes tokens of devices not seen for 90 days, and drops the token the moment you unpair or uninstall.
• Background refresh (optional): If you enable it in Settings, the app periodically prepares your briefing, memory tidy-up and scheduled check-ins in the background, on-device. Any AI call this requires goes to the provider you configured, like a normal request; nothing new is sent to Skales.
• Link previews: When a chat reply contains a link, the app fetches that page once, directly from your device, to show a small preview card (title, description, image). Skales servers are not involved, and the result is cached on your device.
• Network State & Local Network: Used to display connectivity status and to enable the local Web Interface and desktop pairing on the same WiFi network.

5.3 Local Web Interface (Mobile only)

The Skales Mobile App includes a local Web Interface feature that lets you control the app from a browser on the same WiFi network. This server runs entirely on your device, is protected by a PIN you set, and transmits data only within your local network. No data is sent to Skales servers through this feature.

5.4 Third-Party AI Providers (BYOK Architecture)

When you use Skales with third-party AI providers (OpenAI, Anthropic, OpenRouter, Google, Groq, etc.), your prompts and responses go directly from your device to that provider using YOUR OWN API key. Skales is not an intermediary. Their privacy policies apply to that communication. We do not see, log, or store this data.

5.5 Local AI Models (Gemma)

Skales Mobile supports fully offline AI via local Gemma models. When using local models, no data leaves your device at all, not even to third-party AI providers.

6. Data Collected by the Websites

We operate two websites: skales.app (download, updates, and app backend) and getskales.app (marketing and documentation). Neither has login systems or mandatory registration.

• Both websites use Google Analytics & Google Tag Manager to analyze website traffic. IP anonymization is actively enabled. Cookies are only placed if you accept the cookie consent banner. Without consent, Google Consent Mode v2 still collects anonymized, modelled data without placing cookies on your device.

7. Cookie Policy

• In the Skales Apps (Desktop & Mobile): We do not use tracking cookies. The apps solely rely on local storage on your own device to save your settings and preferences.
• On the Websites (skales.app & getskales.app): We use a Cookie Consent Banner. Google Analytics cookies are only loaded if you explicitly click "Accept". If you decline or ignore the banner, no tracking cookies will be placed on your device. With Google Consent Mode v2, basic anonymized analytics still function without cookies.

8. Legal Basis for Processing

For most processing the legal basis is your Consent (Art. 6 Abs. 1 lit. a DSGVO): opting into app telemetry, joining the Discover Feed, submitting an email for a bug report, or accepting website cookies all happen only through your explicit, opt-in action. For the Skales IQ trial we additionally rely on our legitimate interest (Art. 6 Abs. 1 lit. f DSGVO) in preventing abuse and running the trial, as described in Section 3.

9. Data Storage and Security

All server-side data (telemetry, bug reports, feed entries) is stored on secure shared hosting provided by Hetzner Online GmbH, located entirely within Germany (European Union). Data is stored in flat JSONL files with strict access controls.

On your device, the Skales Mobile App uses hardware-backed encryption where available (iOS Keychain, Android EncryptedSharedPreferences) for sensitive data like API keys. All other local data is stored in MMKV, a secure encrypted key-value store.

10. Data Retention

• Discover Feed Entries: Automatically pruned and permanently deleted after 7 days.
• Telemetry & Tag: Kept indefinitely unless you withdraw your consent or delete your profile.
• Bug Reports: Kept until the bug is resolved, then deleted.
• On-Device Data: Your chats, tasks, notes, and settings stay on your device until you delete them or uninstall the app.
• Skales IQ records (email plus salted hashes): kept while the included usage is active and deleted automatically after 12 months of inactivity, or immediately when you delete them.

11. Your Rights under the GDPR

As a user within the European Union (and extended globally by us out of principle), you have the following rights:

• Right to Access: Since all data is anonymous, we can only look up your data if you provide your local Anonymous ID (found in your Skales settings on Desktop, or Settings → Privacy on Mobile). Email us with this ID and we will provide all associated records.
• Right to Erasure (Right to be Forgotten): You can delete your data at any time. Use "Leave Discover" in Settings or "Delete My Data" in Settings > Security & Privacy to instantly remove your Tag, feed entries, upvotes, telemetry, and bug reports from our servers. On Mobile, uninstalling the app removes all local data. To delete your Skales IQ trial data, use Delete my Skales IQ data in Settings under Skales IQ, or email us your anonymous id and we will erase it (this disables your trial key and removes your record).
• Right to Withdraw Consent: You can turn off telemetry in the app settings at any time to immediately stop data transmission.
• Right to Data Portability: On Desktop, your complete profile is accessible in the settings.json file. On Mobile, use Settings → Export Data to download your complete data as JSON.
• Right to Rectification: You can correct any inaccurate data we hold about you.

If you wish to exercise these rights, simply email dev@mariosimic.at. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde).

12. Third-Party Services

• Hetzner Online GmbH: Server hosting (Germany) for the Skales backend and websites.
• Google Analytics / Tag Manager: Website traffic analysis on both skales.app and getskales.app (Ireland/USA). Only active with your consent via cookie banner. Uses Consent Mode v2 for GDPR compliance. These are NOT used in the mobile app.
• Google Play Store / Apple App Store: When you download the Skales Mobile App, Google and Apple may collect download statistics and crash reports governed by their own privacy policies. We do not receive any personal data from these platforms beyond anonymous aggregate stats.
• User-Selected AI Providers: When you use Skales with third-party AI (OpenAI, Anthropic, OpenRouter, Google, Groq, etc.), you bring your own API key. Your prompts go directly from your device to that provider. Their privacy policies apply. See each provider's policy for details.
• Push Delivery (Expo, Apple APNs, Google FCM): Only if you pair the app with a Skales Desktop and enable closed-app notifications, the content-free push travels from our EU relay through Expo's push service to Apple's APNs (iOS) or Google's Firebase Cloud Messaging (Android). These carry only the "your reply is ready" envelope, never your messages. This is Firebase Cloud Messaging used purely as a delivery transport, which is not the same as Firebase Analytics (we use no analytics SDK, see Section 4).
• Skales IQ & OpenRouter: When you use the optional Skales IQ free trial, your request is sent to our relay (relay.skales.app, hosted at Hetzner) which forwards it to OpenRouter, Inc. (USA), the AI model provider, using a per-user key that we issue and that is capped per trial. OpenRouter's privacy policy applies to that processing. We do not route your own provider API keys through this path, and we do not store your prompts or responses. OpenRouter processes the request under a Zero Data Retention setting that we send on every request, so prompts and responses are not retained, and we do not store them either. The transfer to the United States relies on OpenRouter's Standard Contractual Clauses.

Note: No third-party services process your Skales app data through us. All app backend communication goes directly to our own Hetzner server.

13. Children's Privacy

Skales is not directed at children under the age of 13 (16 in the EU/EEA). We do not knowingly collect personal information from children. The Skales Mobile App is rated for general audiences but does not include parental controls for online content. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at dev@mariosimic.at and we will promptly delete it.

14. California Residents (CCPA)

California residents have specific rights under the California Consumer Privacy Act (CCPA). Since Skales does not sell personal data, most CCPA provisions do not apply. However, California residents retain the right to access, delete, and opt out of data collection using the mechanisms described in Section 11.

15. Changes to this Policy

We may update this Privacy Policy occasionally to reflect new features or legal requirements. We encourage you to review this page periodically. Continued use of Skales after changes signifies your acceptance of the updated policy. Material changes will be announced in the app or via email if you are subscribed to updates.

16. Contact

If you have any questions about this Privacy Policy or how your data is handled, please contact:
Email: dev@mariosimic.at