Privacy Policy

1. What this Privacy Policy covers

This policy covers personal data we gather when you use the Service. Personal data means information that identifies or relates to a particular person, including information described as personal data under the GDPR and under KVKK.

This policy does not cover companies we do not control. Checkout is one of those cases. Paddle.com is the Merchant of Record for paid plans. Paddle collects the email address, the billing country, a postal code where that country requires it, and the payment method, inside a checkout frame that Paddle hosts. That payment data is governed by the Paddle Privacy Policy. The Paddle entity named on the receipt is the seller of record for that purchase.

2. Personal data we collect

The categories below are the personal data the Service collects. The account database is stored by Cloudflare. Payment card details are not in it.

3. How we use personal data

• To create the account and keep the same person on that account.
• To analyze a transcript you ask us to analyze, and to show that analysis history on the account.
• To start, renew, or end a paid plan from the billing identifiers Paddle sends.
• To keep sessions secure and to limit abuse.
• To answer a message you send us.
• To understand how the website is used, through Google Analytics 4, Microsoft Clarity, and Cloudflare Web Analytics.
• To keep a record needed for a refund, a chargeback, or a legal claim.

We do not sell personal data, and we do not use it for advertising. We do not use the transcript to train a model of our own. We will not collect a new category of personal data, or use personal data for a materially different purpose, without posting a notice in this policy.

4. How we share personal data

We share personal data with the service providers and other parties listed here, for the purpose stated. Cloudflare also stores the account database and serves every request, so the rows in that database are processed on Cloudflare.

• Cloudflare, which hosts the website, the database, and the request logs.
• Amazon SES, which delivers the sign-in code.
• OpenAI, which reads the transcript cues and returns the skip result.
• Google, GitHub, or Discord, when that sign-in is used.
• Better Auth, for the sign-in security check. That event carries a visitor id, IP address, approximate location, browser, and user id.
• Google Analytics 4 and Microsoft Clarity, through Cloudflare Zaraz, and Cloudflare Web Analytics.
• Google, when the extension is installed from the Chrome Web Store. That listing is governed by Google.

Paddle is the Merchant of Record and the controller of checkout. We transmit the email address on the account and the price of the selected plan so checkout can open. Paddle returns the customer id, subscription id, transaction id, plan, status, and the outcome of an approved refund or chargeback. A question about a charge or a refund goes to Paddle. The card number is neither received nor stored by the Service.

Personal data may also be disclosed where a court or a public authority requires it. If the Service is transferred to another operator, the personal data needed to run the account goes with that transfer, and this page will be updated.

Cloudflare, Amazon, OpenAI, Google, Microsoft, Discord, and Better Auth can process personal data in the United States. Paddle can process checkout data in the United States, Canada, or the United Kingdom, depending on the Paddle entity named on the receipt. A continuous transfer from Türkiye needs an appropriate safeguard under KVKK article 9. This notice does not name that safeguard, because it is not in place.

5. Cookies

This section is the Cookie Policy. The website uses cookies and similar tools so a session can stay signed in, and so we can see how the site is used.

• Essential cookies. A session cookie keeps you signed in. A short-lived cookie is used while Google, GitHub, or Discord sends you back to the site. Blocking the session cookie signs you out. These cookies stay even if analytics cookies are blocked.
• Analytics cookies. Google Analytics 4 and Microsoft Clarity, loaded through Cloudflare Zaraz, set cookies to measure pages and interactions. Clarity also records a session of how a page was used. Payment details are typed inside Paddle's checkout frame. That frame is not part of a Clarity recording. Name or email rendered in our own pages can appear in that recording.
• Cloudflare Web Analytics measures traffic without setting a cookie.

These analytics cookies are separate from the session cookie. Google's opt-out add-on is at tools.google.com/dlpage/gaoptout.

Analytics events are processed by Google, Microsoft, and Cloudflare. They are not written into the account database.

6. Security and retention

OAuth tokens are encrypted at rest. Access to an account depends on the signed-in session. No method of sending or storing data is perfectly secure.

• The account, the analysis history, and the billing identifiers stay while the account is open.
• A session lasts up to 7 days.
• A sign-in code lasts 5 minutes.
• An extension installation stays until you revoke it or it expires.
• Cloudflare Web Analytics keeps raw measurements for about 7 days, then a sampled aggregate for about 6 months. The beacon discards the IP address at the nearest Cloudflare data center.
• Microsoft Clarity keeps a session recording for 30 days. Click and heatmap aggregates are kept for 9 months.
• Google Analytics 4 is kept for the retention period set on that property. Google states that it does not store the IP address in Analytics reports.
• Amazon SES delivers the sign-in code. It does not keep a mailbox of that email. Sending and bounce logs stay with Amazon.
• Paddle keeps checkout and invoice records under the Paddle Privacy Policy.

After you ask us to delete the account, that data is deleted. A record still needed for a refund, a chargeback, or a legal claim is kept, and the rest is deleted.

7. Children

The Service is not directed at anyone under 18. We do not knowingly open an account for a person under 18. If we learn that we have, we delete it. Email support@skiptothepoint.app if you believe that has happened.

8. Your rights

You can ask what we hold, ask for a correction, ask for a copy, ask us to restrict or stop a use, or ask for the account and the analysis history tied to it to be deleted. Email the address in section 11. A privacy request is answered within 30 days. We may ask you to confirm that the request comes from the account holder.

For personal data held by the Service, the lawful bases are the contract (the account, the sign-in code, the analysis, and the paid plan), legitimate interest (security, abuse limits, and cookieless measurement of the site), and a legal obligation or the establishment of a right where a record must be kept for a refund, a chargeback, or a claim.

The skip result does not decide a legal right. If you are in the EEA, the United Kingdom, or Switzerland, you can also complain to your supervisory authority. A question about payment data that only Paddle holds should go to Paddle, under the Paddle Privacy Policy.

We do not sell personal data.

9. Türkiye and KVKK

If you are in Türkiye, Seckin Yasar is the veri sorumlusu for personal data held by the Service. The notice required by KVKK article 10 is the KVKK Aydınlatma Metni. It states the purposes, the legal bases, the parties who receive the data, transfers outside Türkiye, and the rights in KVKK article 11.

Those rights include learning whether we process your personal data, asking for a correction or deletion, learning who received it, objecting to a result that is produced solely by automated analysis and is against you, and claiming compensation where processing was unlawful. You can use them by emailing support@skiptothepoint.app. You can also complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu).

10. Changes

We post changes on this page with a new effective date. The version on this page is the one in effect. If you keep using the Service after that date, the updated policy applies.

11. Contact

Seckin Yasar
support@skiptothepoint.app

A question about the Service, or a privacy request, goes to that address. A privacy request is answered within 30 days. A question about a charge, or a refund, goes to Paddle.