legal # Privacy Policy Version 1.0 · effective 2026-10-24 · [Version history](https://skein.net/legal/history/) ## 1. General information 1.1. This Policy describes how the Skein service (the "Service", "we") processes users' personal data. The operator of the Service, which determines the purposes and means of processing, is SEBO - FZCO (DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, UAE). The Service is available at [https://skein.net](https://skein.net/), including its subdomains (among them app.skein.net). 1.2. For questions about the processing of personal data: [privacy@skein.net](mailto:privacy@skein.net). ## 2. What data we process - **Email address and username** — the account identifiers. Your username and display name are visible to the users you work with in the Service. - **Email addresses of people invited to a Space** — to send them the invitation. The invitation record with the address is kept after the invitation is answered or expires, and is deleted on request. - **Password** — stored in protected form. - **Your Content** — projects, tasks, comments and the attachments you have uploaded. - **Technical data** necessary for the Service to work, including the session identifier by which the Service recognises your account. - **Anonymised usage statistics** — aggregated data, not identifying you, about how the Service is used (see clause 3.1). ## 3. Purposes of processing and legal bases (GDPR) - **Providing and operating the Service** — the basis is "performance of a contract"; the contract is the [Terms of Use](https://skein.net/legal/terms/), which you accept by starting to use the Service (Art. 6(1)(b) GDPR). - **Security, improvement of the Service and usage statistics** — "legitimate interest" (Art. 6(1)(f) GDPR). - **Marketing emails** — "consent" (Art. 6(1)(a) GDPR); sent only with your explicit consent (opt-in) and with the option to unsubscribe at any time. 3.1. **Usage statistics.** We collect anonymised (aggregated) statistics about the use of the Service — for example, which features are used and how actively. This data does not allow you to be personally identified and is used only to understand the load and to improve the Service. We do not use it for advertising purposes and do not transfer it to third parties for their own purposes. ## 4. Cookies 4.1. We use only strictly necessary and functional cookies. See the [Cookie Policy](https://skein.net/legal/cookies/) for details. ## 5. Access to your Content for other persons 5.1. By giving access to a Space or project (to other users of the Service or by other means available in the Service), you make the data placed in it — including any personal data of third parties — available to other persons. You are responsible for giving such access. ## 6. Retention periods - While your account is active, we store the data necessary for the Service to work. - After the account is deleted, we delete your data within **30 days**, with two exceptions. Content you created in Spaces of other users remains in those Spaces, and you are shown as its author under a neutral pseudonym instead of your name. We keep hashes (SHA-256) of your former email address and username so that they cannot be registered again. - A browser session lasts up to 24 hours without activity, after which you need to sign in again. ## 7. Recipients of data 7.1. We do not transfer your personal data to third parties for their own purposes, except for the Cloudflare Turnstile check described in clause 7.2. 7.2. To operate the Service we use the following processors, which process data only on our instructions (with the exception stated for Turnstile): - **Cloudflare, Inc.** (USA) — attack protection and delivery of traffic to the website and the app; all requests to the Service pass through Cloudflare. Registration and invitations are also protected from bots by the Cloudflare Turnstile check. For this check Cloudflare receives technical signals from your browser (IP address, TLS fingerprint, User-Agent); it processes them on our instructions to perform the check and, as an independent controller, for its own purpose — to improve Turnstile's bot detection; see the [Turnstile Privacy Addendum](https://www.cloudflare.com/turnstile-privacy-policy/). - **Maileroo** (Australia) — sending service emails (address confirmation, password reset, invitations to a Space); the recipient's address and the content of the email are transferred. 7.3. Transfers of data to these processors outside the European Economic Area are based on their data processing agreements: for Cloudflare — under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses; for Maileroo — under the EU Standard Contractual Clauses (European Commission Decision 2021/914). 7.4. Data also reaches the following recipients only when you use the corresponding feature: - **The push service of your browser** — if you turn on push notifications, the notification (task ID and title, the name of the user who made the change, a link) is delivered in encrypted form through the push service of your browser's vendor. - **Google Fonts** — if a font from Google Fonts is selected in your interface theme, your browser loads it from Google's servers, and Google receives your IP address. ## 8. Where data is processed 8.1. Data is processed on servers in Europe. ## 9. Your rights 9.1. With respect to your personal data, you have the right of access, rectification, erasure, restriction of and objection to processing, data portability, as well as the right to withdraw consent and to lodge a complaint with a data protection supervisory authority. These rights are exercised on request to [privacy@skein.net](mailto:privacy@skein.net). 9.2. You can delete your account in the account settings of the Service; if you own Spaces with other members, delete those Spaces first. If you cannot sign in, send a request to [privacy@skein.net](mailto:privacy@skein.net) from the email address the account is registered to. ## 10. Security 10.1. We apply reasonable technical and organisational security measures: encryption of data in transit, protected storage of passwords, restriction of access to data. ## 11. Minors 11.1. The Service is not intended for persons under 16. ## 12. Changes to the Policy 12.1. We notify you of changes through the Service interface or by email. The current version is always published on this page. ## 13. Contacts 13.1. For privacy questions: [privacy@skein.net](mailto:privacy@skein.net).