Privacy Policy

Most of SkillPilot is free to read and always will be. That does not make it data-free, and some of it is sold. This page says what actually happens to your data.

Who is responsible

Strivo Capital OÜ, Telliskivi tn 60a/5, 10412 Tallinn, Estonia. Email: legal@skillpilot.app.

Estonian law applies and the GDPR applies to us directly. We have not appointed a Data Protection Officer, which is only mandatory for large-scale monitoring or special-category data — neither applies here.

What we collect

Reading the free material requires nothing. No account, no purchase. Cloudflare serves the site and processes your IP address and browser details to do it, and our analytics records the page view.

If you sign in with GitHub or Google, we receive your email address, name and avatar URL from that provider and store them, so your progress and anything you have bought can follow you between devices.

Your progress lives in your browser's local storage while you are signed out. Once you sign in, it is also saved to our database so it reaches your other devices.

If you buy a course, we store a record of the purchase: which pack or course, the amount, the currency, the date, and the identifier the payment provider gave it. We never see, receive or store your card details — the payment happens entirely on Stripe's own checkout page, through its Link service.

Because Stripe is the merchant of record, it is a controller in its own right for that transaction, not just a processor acting for us: it decides what it needs in order to bill you, calculate your tax and meet its own accounting obligations. Its handling of your data is governed by Stripe's and Link's own privacy policies. You can ask Stripe directly to delete the data held for your purchases — doing so also removes the corresponding records from our Stripe account.

Analytics. We use Umami, which sets no cookies and stores nothing on your device. It does receive your IP address, browser and page URL, and derives a per-day visitor hash on its own servers. We record page views plus five events: resource link clicks, roadmap phases opened, searches (the term you typed), quiz attempts, and referrals from AI assistants. Legal basis: legitimate interest. Searches that return nothing are how we decide what to write next.

We do not profile you, we make no automated decisions about you, and we sell your data to nobody.

Legal basis

What	Why	Basis
Account data	So you can sign in and sync progress	Contract
Progress data	The feature you asked for by ticking a box	Contract
Purchase records	To give you what you paid for, and to prove the sale happened	Contract, then legal obligation
Analytics	To know which pages are useful	Legitimate interest
Hosting logs	To serve and secure the site	Legitimate interest

Who receives it

Supabase (database and authentication), Cloudflare (hosting), Umami (analytics), Stripe and its Link service (payments — as merchant of record it takes the payment, handles the tax, issues your invoice and provides transaction support, so for that part it acts as a controller and not on our instructions), Resend (the newsletter confirmation email, only if you subscribe), and GitHub or Google if you use them to sign in.

Cloudflare, Umami, Stripe and Resend are US-based, so some data leaves the EEA under the standard safeguards those providers publish.

How long we keep it

Account and progress data stay until you delete them, which you can do yourself.

Purchase records outlive the account, deliberately. When you delete your account we strip everything that identifies you from them — no user, no email — and keep the anonymised remainder: amount, currency, date and the provider's reference. Tax law requires a seller to be able to prove a sale happened; an invoice that vanishes on request is not a record. What survives cannot be linked back to you.

Analytics data is retained by Umami under its own policy. We have not yet set formal retention periods for the rest — an honest gap we intend to close.

Your rights

You can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interest.

You can delete your account yourself, from your profile page. It removes your personal data and your progress, and anonymises your purchase records as described above. For anything else — access, correction, portability — email legal@skillpilot.app and we will act within one month, as the GDPR requires. If you are unhappy with how we respond, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to your own country's authority.

Cookies

Only three of ours, all strictly necessary: your sign-in session, your language, and a sign-in security token. Stripe sets its own on its checkout page, which is a different site under its own policy. Full detail in the Cookie notice.

Children

The site is not directed at anyone under 16.

Changes

We update the date at the top when this page changes. See also the Legal notice, Terms of use, Refunds and Affiliate disclosure.