Privacy Policy
The short version: to run subscriptions we keep your email address, your subscription status and a sign-in cookie. We don't use ads, analytics or trackers, and we never sell your data.
Who we are
Sketchy Systems is run by Dennis Kaydalov, Toronto, Canada ("we"). We are the controller of the personal data described below. Contact: support@sketchysystems.dev.
What we collect and why
| Data | Why | Legal basis (EU/UK GDPR) | How long we keep it |
|---|---|---|---|
| Email address and an account ID | To create your account, sign you in, and send service emails (sign-in links, trial reminders, receipts and notices about your subscription) | Contract | While you have an account, then deleted within [30] days. Some details are kept longer, see the consent and subscription records rows |
| Sign-in links (stored only as a hash) | To sign you in securely | Contract | Expire after 15 minutes (60 minutes for the link in your welcome email); deleted within 2 days |
| Session cookie | To keep you signed in | Contract | Up to 90 days, or until you sign out |
| Subscription details we receive from Stripe: customer and subscription IDs, plan, status, trial, renewal and end dates, and card brand and last 4 digits (never the full card number) | To give you access, show your billing status, and limit free trials to one per person | Contract; legitimate interests (preventing trial abuse) | While you're subscribed, then [3] years |
| Consent records: when you agreed to the trial and auto-renewal terms, the version of the text you saw, and a truncated IP address (the last part removed), your country, your browser type, and the dates we showed you | Some laws (for example California's) require us to be able to prove your consent | Legal obligation; legitimate interests | At least 3 years after your subscription ends |
| Messages you send us, including withdrawal and refund requests from the withdrawal form | To answer you, handle refunds, and pass withdrawal requests on to Link (the seller) | Contract; legitimate interests | Up to [2] years |
| Technical logs: IP address, browser type, the requested page, time | To keep the service running and secure and to stop abuse | Legitimate interests | A short time, usually [days, not weeks] |
What we don't collect: your diagrams, settings and challenge progress. They're saved by your browser on the device you use and aren't stored on our servers, so we can't recover them; clearing your browser's site data deletes them. We have no analytics, advertising or tracking cookies, and we don't build profiles of you.
We don't sell or "share" personal information as defined by California law. We don't use it for advertising, and we don't make automated decisions about you that have legal or similarly significant effects.
Who else handles your data
- Stripe runs our checkout and processes payments, and your subscription is sold through Link, Stripe's merchant of record service. When you pay, you give your name, card and billing details directly to Stripe, and we never see your full card number. Stripe (including Link) acts as an independent controller for that data, and as our processor where it handles data on our behalf (for example the customer and subscription records in our Stripe account). It shares your order details with us so we can give you access. See the Link privacy policy and Stripe's privacy policy. Its checkout and link.com pages may set their own cookies.
- Resend sends our emails for us, as our processor.
- Cloudflare hosts the site, runs our server code and stores our database, as our processor. It handles request data such as IP addresses to deliver and protect the site.
- Authorities, if the law requires it, or to protect our rights or the safety of others.
All of these providers are based in or operate from the United States. When your data moves outside the EU or UK, we rely on the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, and on the Standard Contractual Clauses in each provider's data processing agreement.
Cookies and local storage
We use two cookies, both strictly necessary, first-party, HttpOnly and secure, and not used for anything else: the session cookie
__Host-ss_session, which keeps you signed in, and, for up to 24 hours after you start a checkout, __Host-ss_claim, which
signs you in when you come back from the checkout. Your browser's local storage holds your diagrams, progress and theme setting, and whether
this browser has signed in before, so the app works the way you expect. Both are strictly necessary for a service you asked for, so we don't need a
cookie banner. We don't use any analytics or advertising cookies.
Your rights
Depending on where you live (for example under the EU or UK GDPR, or US state laws), you can ask us to access, correct, delete or export your personal data, and to object to or restrict how we use it. Email support@sketchysystems.dev and we'll reply within one month. To delete your account, email us from the address on your account. Cancel your subscription first, or we'll cancel it for you.
We may keep some records after deletion where the law requires it, for example consent and transaction records.
If you're in the EU or UK, you can complain to your data protection authority. In the UK, that's the ICO. We'd appreciate the chance to fix things first.
Do Not Track / Global Privacy Control: we don't track you across sites, so there's nothing for these signals to switch off.
Children
Sketchy Systems isn't meant for children under 16, and we don't knowingly collect their data. If you think a child has signed up, contact us and we'll delete the account.
Security
We use HTTPS everywhere, store sign-in tokens only as hashes, use HttpOnly cookies, and keep as little data as we can. If a breach is likely to affect you, we'll tell you and the relevant authorities as the law requires.
Changes
If we change this policy in a way that matters, we'll email you before the change takes effect. The version and effective date are at the top.