Skip to main content
Log In

Privacy Policy

Last updated: 21 October 2026

Who we are

SkyScribe is operated by Perpetual Summer Ltd (“we”, “us”, “our”), a company registered in England and Wales (company number 11246803) whose registered office is Piccadilly Business Centre Unit C, Aldow Enterprise Park, Manchester, M12 6AE. Perpetual Summer Ltd is the data controller for the personal data described in this policy. If you have any questions about this policy or wish to exercise your rights, contact us at privacy@skyscribe.app.

What this policy covers

This policy applies to:

  • The SkyScribe app (skyscribe.app) — the wizard, Document editor, Publication management, Image Library, and Collaborator features
  • Hosted SkyScribe sites (<name>.skyscribe.site) — the live blogs published from the app
  • The SkyScribe SDK documentation (sdk.skyscribe.app) — a static documentation site with no accounts, cookies or analytics. It remembers your light/dark theme and side-menu preference in your browser’s local storage only.

It does not cover Bluesky, your Personal Data Server (PDS), or any third-party website you link to. Content you author is stored in your own Bluesky repository, not ours — see Content you publish below.

Data we collect and why

Account and authentication

You sign in with your Bluesky account using AT Protocol OAuth. We store:

  • Your Decentralised Identifier (DID), handle, display name and avatar URL — to identify your account and show who you are signed in as. These are held in a signed, HTTP-only session cookie (see Cookies).
  • OAuth session data, including access and refresh tokens and the associated cryptographic keys — stored in our database so you stay signed in without re-authenticating on every visit.
  • Short-lived sign-in state (PKCE) during the OAuth handshake, deleted automatically after 10 minutes.

Lawful basis: performance of a contract — these are strictly necessary to provide the service you have signed in to use.

Site designs

When you save a design in the wizard, we store your design choices (layout, colours, typography, header/body/footer options, and any logo image URL or call-to-action text and link you enter), together with your DID and a name for the design. Before you save, a design exists only in your browser and is never sent to us.

When you save a design, we also capture preview screenshots of it (its home, Category and Document pages) so you can recognise it in your list of designs. They show whichever content the preview was displaying: our demonstration content, or a Publication of yours you chose to preview. They are stored with our object-storage provider and deleted when you delete the design.

Lawful basis: performance of a contract.

Subscriptions and hosted sites

If you take out a paid subscription, we store your DID, whether the subscription is active, the number of site slots on it, and — for each hosted site — which saved design and which Bluesky Publication you have connected, the subdomain you chose at launch, and, if you connect one, your own domain and the value of the DNS record that proves it’s yours.

Payments are handled by Stripe. SkyScribe subscriptions are sold through Stripe Managed Payments, under which Stripe acts as the merchant of record for your purchase. Stripe collects your payment card details, name, email address and billing address on its own checkout page, handles sales tax/VAT, and processes this data as an independent controller under Stripe’s privacy policy. We never see or store your card details. To link a payment to your SkyScribe account, we send Stripe your DID when you check out, and we store:

  • the Stripe customer and subscription identifiers for your subscription;
  • the end date of your current billing period;
  • the date a payment first failed, if one has, so your hosted sites can stay live during a grace period before they are paused; it is cleared when a payment succeeds;
  • the identifiers of the payment notifications Stripe sends us, so each one is applied only once.

Stripe may also share with us the name and email address you gave at checkout, which we use only to handle billing and support queries about your subscription.

Lawful basis: performance of a contract.

Collaborators

If you invite another Bluesky account to collaborate on a Publication, or you are invited to one, we store both accounts’ DIDs, the Publication identifier, the invitation status and timestamps, and — for a document submitted for review — its identifier, title, and submission status. Sending an invitation also sends a one-off Bluesky Direct Message from your account to the person you invited, containing a link to accept.

Lawful basis: legitimate interests — to operate the collaboration feature you and the other account have chosen to use.

Image Library

Images you upload are stored as files with our object-storage provider. We also record each image’s filename, its original filename, its dimensions, its size in bytes, and the folder you put it in. Please do not upload images containing other people’s personal data unless you have a lawful basis to do so.

Scanning for illegal content. Uploaded images are automatically checked by Cloudflare’s CSAM Scanning Tool, which compares them against hashes of known child sexual abuse material. If an image matches, it may be blocked, the account disabled, and the match and related account information reported to the relevant authorities (such as the National Center for Missing & Exploited Children).

Lawful basis: performance of a contract for storing your images; legal obligation and legitimate interests (keeping the service free of illegal content) for the scanning and any report.

Server logs

Our hosting and content-delivery providers automatically log technical request data — IP address, user-agent string, requested URL, HTTP status code and timestamp — for both the app and hosted sites. These logs are used solely for security monitoring and troubleshooting.

Lawful basis: legitimate interests.

Staff access

A small number of authorised staff can view subscriber records — your DID and handle, subscription and payment status, and your hosted sites — in an internal dashboard, to provide support and handle billing. Every access to that dashboard is logged.

Lawful basis: legitimate interests.

Content you publish

The Documents and Publications you create are stored in your own Bluesky Personal Data Server under your account — not in our database. We read and write those records on your instruction to provide the editor and publishing features. Once published, they are public AT Protocol records and are governed by your PDS operator’s terms and by Bluesky. Deleting your account with us does not delete content from your PDS; you control that through Bluesky or your PDS operator.

Cookies and local storage

Cookies

  • __Host-session (named __session in local development) — a strictly necessary, signed, HTTP-only session cookie set when you sign in. Contains your DID, handle, display name and avatar URL. Sent only over HTTPS, same-site. Cleared when you sign out.
  • theme — a functional preference cookie remembering your light/dark mode choice for one year. Contains only the string "light" or "dark".
  • ss_owner_view — a functional cookie on a hosted site (<name>.skyscribe.site), set only when you open your own site from the app. For 30 minutes it makes that site show you its latest version instead of a copy cached for readers. Contains only the value 1; HTTP-only, sent only over HTTPS, same-site. Readers of your site never receive it.

Local storage

The app keeps two things in your browser’s local storage, never transmitted to us: your unsaved wizard draft (so you can close the tab and come back to it — it is only sent to us when you click Save) and your side-menu collapsed/expanded preference.

Analytics

The app (skyscribe.app) uses Umami, a privacy-focused analytics tool that we host ourselves at analytics.perpetualsummer.ltd, so we can see how the app is used and where to improve it. A small script on each page records page views: the page, the site you came from, your browser, operating system, device type, screen size and language, and your approximate location (country, region and city). Your location is worked out from your IP address, which Umami does not store. It sets no cookies and uses no local storage, doesn't follow you across other websites, and keeps nothing that identifies you: visits are counted with an anonymous identifier that can't be traced back to you. These statistics are not shared with anyone else.

The SDK documentation (sdk.skyscribe.app) uses no analytics.

Hosted SkyScribe sites (<name>.skyscribe.site) use Cloudflare Web Analytics so we can see how much they are visited and how quickly their pages load. A small script on each page reports page views and page-load timings, along with the page, the site the visitor came from and their country. It sets no cookies and uses no local storage, and Cloudflare states that it does not fingerprint visitors by IP address, browser details or any other data. Only aggregate figures are available, never individual visitors.

Each site's owner sees those aggregate figures for their own site in SkyScribe (page views, visits, top pages, the sites visitors came from and countries). We don't store them: SkyScribe reads them from Cloudflare when the owner looks, and keeps them in memory for at most 10 minutes. Pages an owner opens from SkyScribe aren't counted.

Websites that developers build themselves with the SkyScribe SDK can add the same script, through the SDK's analytics component. It reports to the same Cloudflare Web Analytics account in the same way, and SkyScribe shows the aggregate figures to the owner of the Publication the website shows, once the website's Publication verification file proves it belongs to that Publication. Such a website is run by its own operator, not by us: telling its visitors about the analytics, in its own privacy policy, is up to them.

Lawful basis: legitimate interests — keeping hosted sites fast and reliable, understanding how the service is used, and showing each site's owner how their site is read.

We do not use advertising or cross-site tracking anywhere, and there are no third-party tracking cookies.

Third parties

We use the following providers to run the service. Except where noted, they process data on our behalf under their own data-processing terms, and some are located outside the UK (transfers are covered by those providers’ standard contractual clauses or equivalent safeguards):

  • Bluesky / AT Protocol network — holds your OAuth account, your published content, and delivers the collaborator invitation Direct Message. Profile pictures shown in the app and on hosted sites load from Bluesky’s image servers, which see the viewer’s IP address.
  • Stripe — sells and takes payment for subscriptions as merchant of record (see Subscriptions and hosted sites above). For the payment data it collects, Stripe is an independent controller rather than processing it on our behalf.
  • Application hosting provider — runs the SkyScribe app server; generates the server logs described above.
  • Managed database provider — stores the app-owned data described above (sessions, designs, subscriptions, collaborator and image metadata).
  • Cloudflare — hosts and serves the skyscribe.site blogs, stores uploaded Image Library files and design screenshots, scans uploaded images for known child sexual abuse material, provides content delivery and edge request logs, provides the cookie-free analytics on hosted sites, issues the certificates for custom domains connected to them, and answers the DNS lookups SkyScribe makes to check those domains.
  • Google Fonts — the wizard preview and hosted sites load web fonts from fonts.googleapis.com and fonts.gstatic.com; your browser’s IP address is visible to Google when a font loads.
  • Cloudinary — the background video on the skyscribe.app home and log-in pages is served from res.cloudinary.com; your IP address is visible to Cloudinary when the video loads.

We do not sell, rent, or share your personal data with any other third parties.

Data retention

  • OAuth sign-in state — deleted automatically after 10 minutes.
  • OAuth sessions — deleted automatically after 90 days without use.
  • Site designs, subscription records, hosted-site connections — kept while your account and subscription are active, and deleted when you delete the design or site, or on request. A cancelled subscription’s record, including its Stripe identifiers, is kept so billing questions can be answered, and deleted on request.
  • Payment data held by Stripe — retained by Stripe under its own retention schedule, including records it must keep for tax and accounting.
  • Design screenshots — replaced each time you save the design, and deleted with it.
  • Staff dashboard access log — kept as a security record.
  • Collaborator records — an accepted membership is kept while the collaboration exists; a rejected or withdrawn invitation is removed once it has been reconciled.
  • Image Library files and metadata — kept until you delete the image or close your account.
  • App analytics (Umami) — the anonymous page-view statistics described in Analytics are kept indefinitely. They contain nothing that identifies you.
  • Server and edge logs — retained by our hosting and CDN providers for a short period (days to a few weeks) under their standard log-retention schedules, then deleted.

Your rights

Under UK GDPR and equivalent data protection law, you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Erasure — request that we delete your personal data
  • Rectification — request correction of inaccurate data
  • Restriction — request that we limit processing in certain circumstances
  • Portability — receive your data in a structured, machine-readable format
  • Objection — object to processing based on legitimate interests

To exercise any of these rights, email privacy@skyscribe.app. We will respond within one month. For the payment details Stripe holds as merchant of record, you can also contact Stripe directly. Much of your data can also be removed directly: signing out clears your session, and deleting a design, hosted site, or uploaded image removes it and its metadata from our systems.

Children

SkyScribe is not directed at children and we do not knowingly collect personal data from anyone under 16.

Changes to this policy

If we make material changes to this policy, we will update the “Last updated” date at the top of this page. Continued use of the service after a change constitutes acceptance of the updated policy.

Complaints

If you are unhappy with how we have handled your personal data, you can complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to address your concerns first — please contact us at privacy@skyscribe.app.