SkipIt Privacy Policy

Last updated: 2026-08-01

SkipIt is operated by TaoApex Limited ("we", "us", "our"), a company registered in the United Kingdom. This Privacy Policy explains what data SkipIt collects, how we use it, and the rights you have under the UK GDPR / EU GDPR / California CCPA.

This policy applies only to the SkipIt mobile application and related backend services (the "Service"). For other TaoApex products such as TTprompt, TaoImagine, TaoTalk AI, or MyOpenClaw, please refer to the TaoApex Privacy Policy.

---

1. Data We Collect

### 1.1 Account data (only if you sign in)
- Email address (when you use Apple ID, Google, or email sign-in)
- Display name (only if your identity provider supplies one)
- Authentication tokens (managed by Supabase; we never see your Apple ID or Google password)

### 1.2 SkipIt usage data
- Skip records: item name, optional amount, optional note, currency, status (skipped / purchased), category
- Aggregated statistics: total saved, weekly/monthly totals, category breakdowns (computed locally and synced)
- Notification preferences: opt-in flag for weekly reminders

### 1.3 Device & technical data
- Device model, OS version, app version, locale — used for crash triage and compatibility
- Push notification token (APNs) — only if you opt in
- Approximate country (derived from IP for fraud prevention; not stored long-term)

### 1.4 We do NOT collect
- Contacts, photos, microphone, camera, location, health, or advertising ID
- Tracking across other apps (no IDFA, no cross-app fingerprinting)
- Your authentication passwords (handled by Apple / Google / Supabase)

---

2. How We Use Your Data

| Purpose | Legal basis | Retention |
| --- | --- | --- |
| Provide the core skip-tracking service | Contract (you have an account) | Until you delete your account |
| Sync across your Apple devices via iCloud App Group | Contract | Same as account |
| Send weekly summary push (if opted in) | Consent | Until you opt out |
| Detect abuse (hourly / daily record caps) | Legitimate interest | 30 days |
| Respond to support requests | Contract | 2 years |
| Aggregate, fully-anonymised trend analytics | Legitimate interest | Indefinite (no personal data) |

We never sell your data, and we do not share it with advertisers or data brokers.

---

3. Third-Party Processors

| Processor | Purpose | Data shared | Location |
| --- | --- | --- | --- |
| Supabase (auth + database) | Account authentication, record storage | email, skip records | EU/US (region pinned at signup) |
| RevenueCat | Subscription billing on iOS | anonymous app user ID, purchase receipts | US |
| Apple Push Notification service (APNs) | Weekly summary push | device token | Apple infrastructure |
| Cloudflare (D1 / Workers) | Hosting of the SkipIt API | request metadata | Global edge |
| Apple, Google (sign-in) | Identity | tokens only | Apple / Google infra |

Each processor is bound by a Data Processing Agreement. We do not transfer your data outside the EU/UK adequacy regions without Standard Contractual Clauses or equivalent safeguards.

---

4. Your Rights

Under UK GDPR / EU GDPR you have the right to:
- Access your data (Settings → Export)
- Rectify incorrect data (Settings → Edit)
- Erase your account and all records (Settings → Delete Account)
- Restrict or object to processing
- Port your data (Settings → Export as JSON)
- Withdraw consent for push or analytics at any time
- Lodge a complaint with the ICO (UK) or your local data-protection authority

California residents additionally have the right to opt out of "sale" (we do not sell), and to receive equal service regardless of privacy choices.

---

5. Security

  • TLS 1.3 in transit, AES-256 at rest
  • Row-Level Security in D1 enforces per-user isolation
  • Service-role key is restricted to backend workers only
  • All employees access production data through audited, MFA-protected sessions

No system is 100 % secure. If we discover a breach affecting your data, we will notify you within 72 hours as required by GDPR Art. 33.

---

6. Children

SkipIt is not directed to children under 16 (or the local equivalent minimum age). We do not knowingly collect data from children. If you believe a child has signed up, contact us and we will delete the account.

---

7. International Transfers

SkipIt is operated from the UK. By using SkipIt you acknowledge that your data may be processed in the UK and the EU. We rely on UK-EU adequacy decisions and SCCs for transfers to other regions.

---

8. Changes to This Policy

We will update this page when we make material changes and, where required by law, ask for your renewed consent.

---

9. Contact