Privacy Policy

Last updated: 7 September 2026

Who we are

SkyScribe is operated by Anthony Cregan (“we”, “us”, “our”), the data controller for the personal data described in this policy. If you have any questions about this policy or wish to exercise your rights, contact us at privacy@skyscribe.app.

What this policy covers

This policy applies to:

• The SkyScribe app (skyscribe.app) — the wizard, Document editor, Publication management, Image Library, and Collaborator features
• Hosted SkyScribe sites (<name>.skyscribe.site) — the live blogs published from the app

It does not cover Bluesky, your Personal Data Server (PDS), or any third-party website you link to. Content you author is stored in your own Bluesky repository, not ours — see Content you publish below.

Data we collect and why

Account and authentication

You sign in with your Bluesky account using AT Protocol OAuth. We store:

• Your Decentralised Identifier (DID), handle, display name and avatar URL — to identify your account and show who you are signed in as. These are held in a signed, HTTP-only session cookie (see Cookies).
• OAuth session data, including access and refresh tokens and the associated cryptographic keys — stored in our database so you stay signed in without re-authenticating on every visit.
• Short-lived sign-in state (PKCE) during the OAuth handshake, deleted automatically after 10 minutes.

Lawful basis: performance of a contract — these are strictly necessary to provide the service you have signed in to use.

Site designs

When you save a design in the wizard, we store your design choices (layout, colours, typography, header/body/footer options, and any logo image URL or call-to-action text and link you enter), together with your DID and a name for the design. Before you save, a design exists only in your browser and is never sent to us.

Lawful basis: performance of a contract.

Subscriptions and hosted sites

If you take out a paid subscription, we store your DID, whether the subscription is active, the number of site slots on it, and — for each hosted site — which saved design and which Bluesky Publication you have connected, and the subdomain you chose at launch. Payment is currently arranged directly with us and is not processed within the app; if that changes we will update this policy and name the payment provider before any payment data is collected.

Lawful basis: performance of a contract.

Collaborators

If you invite another Bluesky account to collaborate on a Publication, or you are invited to one, we store both accounts’ DIDs, the Publication identifier, the invitation status and timestamps, and — for a document submitted for review — its identifier, title, and submission status. Sending an invitation also sends a one-off Bluesky Direct Message from your account to the person you invited, containing a link to accept.

Lawful basis: legitimate interests — to operate the collaboration feature you and the other account have chosen to use.

Image Library

Images you upload are stored as files with our object-storage provider. We also record each image’s filename, its original filename, its dimensions, its size in bytes, and the folder you put it in. Please do not upload images containing other people’s personal data unless you have a lawful basis to do so.

Lawful basis: performance of a contract.

Server logs

Our hosting and content-delivery providers automatically log technical request data — IP address, user-agent string, requested URL, HTTP status code and timestamp — for both the app and hosted sites. These logs are used solely for security monitoring and troubleshooting.

Lawful basis: legitimate interests.

Content you publish

The Documents and Publications you create are stored in your own Bluesky Personal Data Server under your account — not in our database. We read and write those records on your instruction to provide the editor and publishing features. Once published, they are public AT Protocol records and are governed by your PDS operator’s terms and by Bluesky. Deleting your account with us does not delete content from your PDS; you control that through Bluesky or your PDS operator.

Cookies and local storage

Cookies

• __Host-session (named __session in local development) — a strictly necessary, signed, HTTP-only session cookie set when you sign in. Contains your DID, handle, display name and avatar URL. Sent only over HTTPS, same-site. Cleared when you sign out.
• theme — a functional preference cookie remembering your light/dark mode choice for one year. Contains only the string "light" or "dark".

Local storage

The app keeps two things in your browser’s local storage, never transmitted to us: your unsaved wizard draft (so you can close the tab and come back to it — it is only sent to us when you click Save) and your side-menu collapsed/expanded preference.

Analytics

We do not use any analytics, advertising, or cross-site tracking on the app or on hosted sites. There are no third-party tracking cookies.

Third parties

We use the following providers to run the service. They process data on our behalf under their own data-processing terms, and some are located outside the UK (transfers are covered by those providers’ standard contractual clauses or equivalent safeguards):

• Bluesky / AT Protocol network — holds your OAuth account, your published content, and delivers the collaborator invitation Direct Message.
• Application hosting provider — runs the SkyScribe app server; generates the server logs described above.
• Managed database provider — stores the app-owned data described above (sessions, designs, subscriptions, collaborator and image metadata).
• Cloudflare — hosts and serves the skyscribe.site blogs, stores uploaded Image Library files, and provides content delivery and edge request logs.
• Google Fonts — the wizard preview and hosted sites load web fonts from fonts.googleapis.com and fonts.gstatic.com; your browser’s IP address is visible to Google when a font loads.
• Cloudinary — the demonstration video on the skyscribe.app home page is served from res.cloudinary.com; your IP address is visible to Cloudinary when the video loads.

We do not sell, rent, or share your personal data with any other third parties.

Data retention

• OAuth sign-in state — deleted automatically after 10 minutes.
• OAuth sessions — deleted automatically after 90 days without use.
• Site designs, subscription records, hosted-site connections — kept while your account and subscription are active, and deleted when you delete the design or site, or on request.
• Collaborator records — an accepted membership is kept while the collaboration exists; a rejected or withdrawn invitation is removed once it has been reconciled.
• Image Library files and metadata — kept until you delete the image or close your account.
• Server and edge logs — retained by our hosting and CDN providers for a short period (days to a few weeks) under their standard log-retention schedules, then deleted.

Your rights

Under UK GDPR and equivalent data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Erasure — request that we delete your personal data
• Rectification — request correction of inaccurate data
• Restriction — request that we limit processing in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, email privacy@skyscribe.app. We will respond within one month. Much of your data can also be removed directly: signing out clears your session, and deleting a design, hosted site, or uploaded image removes it and its metadata from our systems.

Children

SkyScribe is not directed at children and we do not knowingly collect personal data from anyone under 16.

Changes to this policy

If we make material changes to this policy, we will update the “Last updated” date at the top of this page. Continued use of the service after a change constitutes acceptance of the updated policy.

Complaints

If you are unhappy with how we have handled your personal data, you can complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to address your concerns first — please contact us at privacy@skyscribe.app.