1. Who controls your data
SKILLTREE LIMITED, company number 17346623, is the controller of personal data processed through SkillTree. Our registered office is Flat 2 52 Pont Street, London, England, SW1X 0AE.
Privacy questions and rights requests can be sent to privacy@getskilltree.com.
2. Data we collect
Account data includes your email address, authentication provider, display name, age, account identifiers, subscription status, support messages, and records of the legal notices you accepted.
Training data includes goals, assessments, skill progress, plans, completed sessions, drill history, equipment, schedule preferences, coaching questions, form-analysis results, and evidence you choose to record.
Injury and limitation details are optional health data. We do not ask for, store, or use them for health-aware plans unless you give separate explicit consent.
Technical data may include app version, device and operating-system information, IP-derived network information, security events, crash diagnostics, notification tokens, and product events if you opt in to analytics.
Payment card details are processed by Apple or Google. SkillTree and RevenueCat receive purchase and entitlement records but do not receive or store your full card number.
3. Purposes and lawful bases
We process account, training, subscription, and support data because it is necessary to provide the SkillTree service and perform our contract with you.
We rely on your consent for optional health data, optional product analytics, and notification categories where consent is required. You can use the core app without providing health data or enabling analytics.
We rely on legitimate interests to secure the service, prevent misuse, diagnose faults, and understand aggregate product reliability. Those interests are balanced against your rights, and we minimise the data used.
We process billing, tax, legal, and regulatory records where necessary to comply with legal obligations.
4. Optional health data
If you explicitly opt in, SkillTree stores injuries and limitations you provide and may send relevant details to Anthropic when generating assessments or training plans. This processing uses your UK GDPR Article 6(1)(a) consent and Article 9(2)(a) explicit consent.
You can withdraw consent in Profile, Privacy & Data, then Injuries. Withdrawal deletes the injury and limitation records held by SkillTree and prevents their future use. It does not affect processing that was lawful before withdrawal or automatically rewrite plans already generated.
5. AI coaching, voice, and form analysis
Anthropic processes the context needed to generate assessments, training plans, and coaching responses. Google Gemini processes form video for technique feedback, daily adjustment prompts, and voice audio when you choose voice transcription.
Form videos are uploaded to a private temporary area, read into the analysis service, and deleted from SkillTree storage before being sent to Gemini. SkillTree keeps the resulting scores and feedback, not the source video. Voice audio is not stored by SkillTree, but the recognised question and coaching response are saved.
AI output may be incomplete or wrong. It supports your choices and does not make decisions with legal or similarly significant effects.
6. Service providers and recipients
We use Supabase for authentication, database, storage, and server functions; Anthropic and Google for AI features; RevenueCat, Apple, and Google for subscriptions; Expo, Apple, and Google for notifications; PostHog for product analytics only after opt-in; Sentry for crash diagnostics; and email-delivery providers for account and support messages.
Providers process data under their contracts and instructions. We may also disclose data where required by law, to protect users or the service, or as part of a business transaction subject to appropriate safeguards. We do not sell personal data.
7. International transfers
Our primary account and training records are hosted in Supabase's West EU (Ireland) region. Some providers and their subprocessors may process data outside the UK or European Economic Area.
Where a restricted transfer is made, we use an applicable adequacy regulation or approved contractual safeguards together with any required risk assessment. Contact privacy support to request information about the safeguards relevant to your data.
8. Security
We use encrypted network connections, row-level database access rules, private storage, restricted server credentials, authentication controls, and operational monitoring. No service can guarantee complete security.
9. Retention and deletion
Account and training records are normally kept while your account is active. Coaching text, analysis results, plans, progress, and session history remain available until you delete them through an available control or delete your account.
Temporary form videos are deleted from SkillTree storage during the analysis flow. Withdrawing health-data consent deletes stored injury and limitation records. Turning analytics off stops future collection on that device and clears queued analytics from the app.
Account deletion removes your live SkillTree account records and temporary uploads. Limited records may remain until provider backups are overwritten, or longer where law requires billing, fraud-prevention, dispute, or regulatory records. We use the shortest period consistent with those purposes.
10. Your rights
Depending on the law that applies, you may request access, correction, deletion, restriction, or portability of your data and withdraw consent. You can export training history and delete your account in the app, and use the settings screens to change notification, analytics, and health-data choices.
You have the right to object to processing based on legitimate interests. Send any request or objection to privacy support. We may need to verify your identity before acting.
11. Children
SkillTree accounts are only available to people aged 13 or older. New members must confirm that they meet this minimum age. We consider children's interests when designing privacy and safety controls.
If you believe we hold data for a child under 13, contact privacy support so we can investigate and remove it.
12. Product analytics and diagnostics
PostHog product analytics are off by default. If you opt in, we send a pseudonymous account identifier, app and device context, and named product events to PostHog's EU endpoint. We do not enable session replay. You can turn analytics off in Privacy & Data at any time.
Sentry receives limited account identifiers, app context, and technical error details so we can investigate crashes. We do not intentionally send health descriptions, form videos, or payment card data to analytics or diagnostics services.
13. Changes to this policy
We may update this policy when the service, providers, or law changes. We will update the date and give additional notice in the app when a change materially affects your rights or how we use data.
14. Contact and complaints
Email privacy@getskilltree.com or write to SKILLTREE LIMITED at Flat 2 52 Pont Street, London, England, SW1X 0AE.
You can complain to the UK Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. Please contact us first if you are comfortable doing so, so we can try to resolve the issue.