Privacy & Trust

Your account

• You sign in with your email through Microsoft Entra. Codes and passwords go only to Microsoft's sign-in page.
• We store your email address, an account ID and the date you joined.
• Sign-in tokens stay in your device's secure storage. On the web, your browser keeps a short-lived session and our server keeps the longer-lived token encrypted.
• A short press-and-hold check before sign-in keeps bots out.
• On a browser that isn't a trusted device, skyel signs you out after 9 minutes without activity, with a 30-second warning first.

Your keys and passcode

• Your device creates your personal encryption key. Each group has its own key, shared only with its members.
• We store a salted Argon2id hash of your app passcode, never the passcode itself. It lets you unlock skyel on your other devices. After 10 minutes without activity, skyel locks, even while a podcast plays.
• So you can get back in on a new device, our server keeps a copy of your personal key locked with your passcode. Our server sees your key and passcode when you set this up and whenever you recover, so this copy isn't end-to-end encrypted. A passcode that mixes letters, numbers and symbols protects it best, and too many wrong tries lock recovery for up to 7 days.
• Your recovery phrase never leaves your device. Keep it offline: it can restore your key if you forget your passcode.
• Face ID, Touch ID and fingerprint unlock stay on your device. No biometric data reaches skyel.

Messages, groups and reminders

Encrypted on your device

• Messages, captions, photos, videos and files
• Reminder titles and notes
• Activities, comments, and Fitness check-ins and goals

What our servers can see

• Group names and who belongs to each group
• Who sent each message and when
• Reminder due dates and repeat schedules, so alerts arrive on time
• Emoji reactions, read times, and online and typing status
• The original names of photo and video files sent in chats

Photos and videos

Your library stays in your own Azure storage, on a network drive or in folders on your device. Our servers don't store it.

Encrypted on your device

• Every file skyel uploads to your Azure storage, including camera backups
• Comments on shared media
• The index skyel keeps of your library
• Thumbnails of encrypted photos saved on your device, cleared when you sign out

What stays visible

• File and folder names, sizes and dates in your Azure storage
• Files added outside skyel or before July 2026, which stay unencrypted

When you connect Azure, skyel stores that access encrypted and uses it only for what you do with your media in skyel.

When you share a source with a group, members open files through links that expire after 5 minutes. Stopping sharing blocks new access but can't recall copies already saved.

To cut off skyel, go to Settings > Danger Zone > Revoke skyel's Microsoft access, or remove its access in Azure. Your files stay where they are.

Camera backup stays off until you turn it on.

Network drives and device folders are read in place. A network drive's password stays in your device's secure storage.

Azure gallery widget

The widget shows up to 25 Azure photos you recently viewed in skyel, or only those from a folder you pick.

Encrypted on your device

• Your viewing history, synced across your devices
• The widget's previews, which never leave your device

What stays visible

• The photo on screen, to anyone who can see your unlocked device
• The size of your history and when it changes, to our servers

Photos stay hidden whenever your device is locked.

The widget only gets resized previews. Your keys and original files stay in skyel.

Photos you delete or move to Trash leave the widget the next time skyel updates it.

Only your 50 most recent views per folder are kept. Older ones drop off automatically.

Signing out clears the widget and its history on that device. Deleting your account also erases the synced copy.

AI features

skyel's AI is Phi-3.5-mini, an open model we run ourselves on Microsoft Azure in the United States. No outside AI company receives your requests.

It runs only when you ask

• AI rewrite my About sends your About text, any job post you paste and a short summary of your page.
• Auto-translate sends the text of your page.
• AI receipt double-check is off by default. It sends the text read from a receipt, never the photo.

Requests are handled in memory. We don't store them, log their content or use them for training.

Daily limits are counted per account under a hashed ID.

AI requests aren't end-to-end encrypted, since the server has to read them to answer. skyel tells you before anything is sent.

Ask Pulse is not AI. It answers on your device, and its history is encrypted with your personal key.

Pulse

Encrypted on your device

• Transactions, budgets, goals and subscriptions
• Stock holdings, with their quantities, costs and notes

What leaves your device

• Subscription due dates and repeat rules, kept on our servers so reminders arrive on time
• Stock symbols, sent through skyel to Yahoo Finance for prices
• Currency codes, sent straight to Frankfurter or open.er-api.com for exchange rates

Receipt scans are read on your device: Google ML Kit on Android and iOS, Apple Vision on Mac, and our own copy of Tesseract on the web. ML Kit sends Google basic diagnostics, never your images.

Bank linking isn't available. We'll update this policy before it is.

Prices are approximate and may be delayed. Links to Yahoo Finance follow Yahoo's privacy policy.

Vault

• Vault items are encrypted on your device with AES-256, using a key made from your master password with Argon2id. They never reach our servers.
• Optional sync keeps the encrypted vault in your own Dropbox or OneDrive app folder.
• No one can recover your master password, including us. The vault locks after 5 minutes without activity.

Public pages

• What you publish is visible to anyone with the link, and search engines may list it.
• Drafts stay encrypted until you publish them.
• PDF downloads are counted per page, never per visitor.

Podcasts

• Your subscriptions, listening progress and shared playlists are encrypted on your device.
• Searches and feeds go through our server. To flag new episodes, it keeps only a hashed address for each show you follow.
• Episodes stream straight from the podcast's host, which sees your IP address.

Notifications and email

• Push notifications travel through Google Firebase, and through Apple on Apple devices. Their content stays encrypted until your device decrypts it, and it shows only once your device is unlocked. Browser notifications stay generic.
• In-app alerts about media a member added or asked to delete include the member's name and the source's name, which our servers can read.
• Each device's push token is stored to deliver alerts and is removed when you delete your account.
• Sign-in codes come from Microsoft. Other emails come from dev@skyel.net through Zoho Mail. They tell you something is waiting for you, never what it contains.

On your device

• skyel asks for a permission only when a feature needs it: camera, photos and videos, microphone, notifications and biometrics. On Mac, it can also ask for folders, removable drives and the local network.
• skyel never asks for your location or contacts.
• The app contains no analytics or advertising tools.

Cookies and browser storage

• skyel sets no cookies of its own and uses no advertising or analytics cookies. Microsoft's sign-in pages set their own.
• Your browser keeps your settings, your session and your cookie choice. If you use the vault on the web, its encrypted copy is kept there too. Clearing site data removes all of this, so sync or save your vault first.

Who helps us run skyel

• Microsoft Azure: Our servers and encrypted storage in Canada, the AI model in the United States, and Entra sign-in
• Amazon Web Services: The skyel.net website and the routing of app traffic
• Google: Firebase push notifications, ML Kit text recognition, and fonts and app files that skyel.net loads
• Apple: Notifications on Apple devices, text recognition on Mac and podcast search
• Zoho Mail: Emails from skyel
• Dropbox or OneDrive: Your encrypted vault, only if you turn on sync
• Yahoo Finance, Frankfurter, open.er-api.com: Stock prices by symbol and exchange rates
• Podcast hosts: The episodes you play

We never sell your data or share it for advertising.

How long we keep data

• Your content stays until you delete it.
• Deleted reminders, media and Pulse items stay in Trash for 7 days. Vault Trash keeps items for 7 to 90 days, as you choose.
• Server logs are kept for 90 days. They can include your email address, account ID and group names, never your content.
• To block abuse, our servers count requests per IP address, and those counters store the address.

Delete your account

Go to Settings > Danger Zone > Delete account.

What gets erased

• Your passcode, keys, public page, notifications and device tokens
• Your personal Pulse data and Ask Pulse history
• Every group you own, with its messages, reminders and activities
• Your membership in other people's groups

What stays

• Messages you sent in other people's groups, still encrypted, and copies others already saved
• Encrypted photos, videos and files from your groups' chats, which stay in our storage
• Files in your own Azure storage. Revoke skyel's Microsoft access before deleting so its access ends too.
• Server logs, until they expire after 90 days
• Your Microsoft sign-in record, until you ask us to remove it

Can't open the app? Email dev@skyel.net from your account's address and we'll delete it for you.

Your rights

• Wherever you live, you can ask for a copy of your data, ask us to correct or delete it, or object to how we use it.
• We can only provide end-to-end encrypted content in its encrypted form.
• You can also complain to your local data protection authority.

About this policy

• skyel is for adults 18 and over. We don't knowingly collect data from children.
• When this policy changes, we update the date at the top and announce important changes on skyel.net.

Contact us

Questions or privacy requests? Email dev@skyel.net.

skyel is built with privacy at its core.