Privacy Policy

This Privacy Policy describes how MySkii Ltd. (“MySkii”, “we”) handles personal data when you use the MySkii marketplace. It applies to the website, mobile browsers, and any API you access as a registered member.

We aim to collect the minimum personal data required to run the service and to tell you plainly what happens with it.

MySkii Ltd. operates the MySkii marketplace. Registered address: Kitchener ON, N2P 0J8, Canada. Privacy questions go to privacy@myskii.com.

You give us your email on signup, and optionally a handle, display name, avatar, bio, skill categories, portfolio links, and timezone. You also give us the tasks you post or claim, messages you send through the platform, reviews you write, and files you upload as deliverables.

We generate skii credit balances and transaction records, reputation scores, badges, notifications, and audit-log entries of administrative actions.

Automatically from your device: basic request metadata (IP address, browser user-agent, timestamps, pages visited). We use IP address briefly for security (rate-limit identification, abuse detection) and do not retain it as a long-term profile attribute.

We process data for the following purposes and legal bases:

• Service delivery (contract performance, GDPR Art. 6(1)(b)): running the marketplace, matching buyers and sellers, processing escrow, holding messages, generating receipts.
• Security and fraud prevention (legitimate interest, Art. 6(1)(f)): rate limits, abuse reports, dispute review, account integrity.
• Legal compliance (Art. 6(1)(c)): keeping transaction records for accounting and dispute retention periods.
• Service improvement & analytics (consent, Art. 6(1)(a)): aggregated usage patterns via PostHog. This is opt-in; if you decline the cookie banner, we don't set these cookies or run autocapture / session replay.
• Error monitoring (legitimate interest, Art. 6(1)(f)): Sentry captures server and unhandled browser errors. We mask all text and inputs in session replays so message content and form data don't leave your browser.

We share data with the following processors, each under a data processing agreement:

• Vercel — application hosting (USA).
• Supabase — database and authentication backend (EU/US region as configured).
• Cloudflare R2 — object storage for avatars and deliverables.
• Resend — transactional email (notifications, magic links).
• Inngest — background job scheduling (escrow auto-release, badge evaluation).
• Upstash — Redis for rate limiting.
• Sentry — error monitoring.
• PostHog — product analytics (opt-in).
• Stripe (when enabled) — payment processing for subscription and skii credit top-up features.

We don't sell your personal data. We may disclose information if required by law, in response to a valid legal process, or to protect the rights, safety, or property of MySkii, our users, or the public.

Profile data is kept while your account is active. Deleting your account anonymizes the profile in place — email, handle, display name, bio, avatar, and portfolio are scrubbed; the row remains so transaction and dispute records stay intact.

Messages are kept for 12 months after the associated task closes, then decayed.

Transaction records and dispute decisions are kept for at least 7 years for accounting and legal retention.

Analytics events (when consented) are kept per PostHog's retention policy — 7 years by default; we may shorten this.

Error events in Sentry are kept for 90 days.

Under GDPR (EU/UK) and comparable laws you can:

• Access a copy of your data. Download it as JSON while signed in.
• Rectify inaccurate data via Settings.
• Erase your account via Settings → Delete Account, which anonymizes personal identifiers while preserving transaction records as described above.
• Restrict or object to processing of analytics (click “Essential only” on the cookie banner or revisit your choice in Settings).
• Port your data to another service (the JSON export is the vehicle).
• Complain to a supervisory authority — the Office of the Privacy Commissioner of Canada (priv.gc.ca) for Canadian residents, the Information and Privacy Commissioner of Ontario (ipc.on.ca) for Ontario residents, your local data-protection regulator for EU/UK residents, or the California Privacy Protection Agency for California residents.

To exercise rights not exposed via self-serve, email privacy@myskii.com. We respond within 30 days.

Essential cookies (always on): authentication session, CSRF protection, consent preference.

Analytics cookies (opt-in): PostHog for product analytics and masked session replay. These load only if you accept on the cookie banner; we don't use tracking pixels from ad networks.

Our processors operate globally. When personal data leaves the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses or equivalent safeguards in the data-processing agreements with each processor listed above.

MySkii is not directed to people under 16. We don't knowingly collect data from children under 16. If you believe we have, email privacy@myskii.com and we'll delete it.

We protect data with TLS in transit, at-rest encryption on our database and object storage, strict CSP, regular dependency updates, and principle-of-least-privilege access controls on administrative tools. No system is perfect; if you see something, email security@myskii.com.

Material changes bump the Version and Effective Date. Active users get an email on material changes.

For anything privacy-related, email privacy@myskii.com.