Privacy Policy

1. Information We Collect

We collect the following types of information:

• Account data: display name, email address, and password (hashed)
• Profile data: avatar image, bio
• Usage data: queue activity, queue positions, timestamps
• Social data: public profile info and follower/subscriber counts from connected social accounts
• Payment data: processed by Stripe — we do not store full card numbers
• Device data: push notification tokens, device type (mobile/web)

2. How We Use Your Information

• To provide and operate the Skulli platform
• To verify social media eligibility for queue entry requirements
• To send push notifications about your queue status
• To process payments between members and creators
• To detect and prevent fraud or abuse
• To improve the Service

3. Social Platform Data

When you connect a social account, we access only the data needed for verification (profile info, follower/subscriber count). We store an encrypted OAuth access token to refresh this data. You can disconnect any social account at any time from Settings. We do not post to your social accounts.

Data obtained through TikTok, YouTube, Instagram, or Twitch APIs is used solely to verify queue entry requirements and is not shared with third parties.

4. Data Sharing

We do not sell your personal data. We share data only with:

• Stripe — for payment processing
• Cloudflare R2 — for media storage (avatars)
• Sentry — for error monitoring (no PII in error reports)
• Railway / Vercel — for infrastructure hosting

5. Data Retention

We retain your data for as long as your account is active. When you delete your account, your personal data is deleted within 30 days. Some data may be retained in backups for up to 90 days.

6. Security

We use industry-standard practices to protect your data: bcrypt password hashing, AES-256-GCM for OAuth token encryption, HTTPS for all traffic, and httpOnly cookies for session management.

7. Your Rights

You may request access to, correction of, or deletion of your personal data at any time. You can delete your account directly from the Settings page. For other requests, contact us at support@skulli.app.

8. Cookies

We use a single httpOnly cookie for session management (refresh token). We do not use advertising or tracking cookies.

9. Children's Privacy

Skulli is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy. We will notify registered users of material changes via email or in-app notification.

11. Contact

For privacy questions or data requests: support@skulli.app