1. Who controls your data
SKILLTREE LIMITED, company number 17346623, is the controller of personal data processed through SkillTree. Our registered office is Flat 2 52 Pont Street, London, England, SW1X 0AE.
Privacy questions and rights requests can be sent to privacy@getskilltree.com.
2. Data we collect
Account data includes your email address, authentication provider, display name if you provide one, confirmation that you are at least 18, account identifiers, subscription status, support messages, and records of the legal notices you accepted.
Training data includes goals, starting-point answers, skill progress, approved plan selections, completed sessions, drill history, equipment, schedule preferences, typed coaching questions and responses, and evidence you choose to record.
Injury and limitation details are optional health data. We do not store profile limitations or allow AI Coach to process a question until separate explicit health-data consent is recorded. In iOS 1.0, saved profile records do not automatically change your workouts or plan.
Technical data may include app version, device and operating-system information, IP-derived network information, security events, crash and error diagnostics, notification tokens, and product events if you opt in to analytics.
Payment card details are processed by Apple or Google. SkillTree and RevenueCat receive purchase and entitlement records but do not receive or store your full card number.
3. Purposes and lawful bases
We process account, training, subscription, and support data because it is necessary to provide the SkillTree service and perform our contract with you.
We rely on your consent for optional health data, optional product analytics, and notification categories where consent is required. You can use the core app without providing health data or enabling analytics.
We rely on legitimate interests to secure the service, prevent misuse, diagnose faults, and understand aggregate product reliability. Those interests are balanced against your rights, and we minimise the data used.
We process billing, tax, legal, and regulatory records where necessary to comply with legal obligations.
4. Optional health data
If you explicitly opt in, SkillTree stores injuries and limitations you provide so you can review and manage them in your profile. The same recorded consent is required before AI Coach can send any question to Anthropic. You can leave health details out; if you deliberately include one, SkillTree sends the question to Anthropic and stores the question and response. This processing uses your UK GDPR Article 6(1)(a) consent and Article 9(2)(a) explicit consent. Current iOS 1.0 workouts and plans do not change automatically because of saved profile records.
You can withdraw consent in Profile, Privacy & Data, then Injuries. Withdrawal deletes your profile injury and limitation records and prevents future AI Coach health-data processing until you consent again. It does not automatically delete earlier coaching questions, affect processing that was lawful before withdrawal, or rewrite training already selected. You may request deletion of earlier coaching text or delete your account.
5. AI coaching, voice, and form analysis
Typed coaching is the only AI customer feature enabled in iOS 1.0. Before it can send a question, SkillTree requires recorded explicit health-data consent because free-text questions may include health details. Anthropic processes the question and training context only when a member sends it.
AI-generated assessments and plans, form analysis, recorded voice questions, and AI daily adjustments are disabled capabilities in iOS 1.0. Google therefore does not receive form video, voice audio, or daily-adjustment prompts in this version.
If a later approved version enables form analysis, a deliberately recorded video will be uploaded to a private temporary area, read into the analysis service, deleted from SkillTree storage, and then sent to Google Gemini. SkillTree will keep the resulting scores and feedback, not the source video. If recorded voice questions are later enabled, SkillTree will not store the voice audio, but will save the recognised question and coaching response.
AI output may be incomplete or wrong. It supports your choices and does not make decisions with legal or similarly significant effects.
6. Service providers and recipients
For iOS 1.0, we use Supabase for authentication, database, storage, and server functions; Vercel for the public website; RevenueCat and Apple for subscriptions; Expo and Apple for notifications; PostHog for product analytics only after opt-in and when configured in the submitted build; and Sentry for crash and error diagnostics when configured in the submitted build.
Anthropic receives coaching context only when a member sends a typed question. Google does not receive form video, recorded voice, or daily-adjustment prompts in iOS 1.0 because those capabilities are disabled. Resend will be named as the authentication email provider only after it is configured and verified. Support email uses the configured company mail-forwarding service.
Providers process data under their contracts and instructions. We may also disclose data where required by law, to protect users or the service, or as part of a business transaction subject to appropriate safeguards. We do not sell personal data.
7. International transfers
Our primary account and training records are hosted in Supabase's West EU (Ireland) region. Some providers and their subprocessors may process data outside the UK or European Economic Area.
Where a restricted transfer is made, we use an applicable adequacy regulation or approved contractual safeguards together with any required risk assessment. Contact privacy support to request information about the safeguards relevant to your data.
8. Security
We use encrypted network connections, row-level database access rules, private storage, restricted server credentials, authentication controls, and operational monitoring. No service can guarantee complete security.
9. Retention and deletion
Account and training records are normally kept while your account is active. Coaching text, approved plan selections, progress, and session history remain available until you delete them through an available control or delete your account.
SkillTree may create a temporary anonymous account so you can begin setup before confirming your email. If that account remains anonymous, has been inactive for at least 30 days, and has no SkillTree profile or verified subscription, we automatically delete its authentication record and temporary uploads. Recent activity or an email-confirmation request restarts that 30-day period.
If a later version enables form analysis, temporary form videos will be deleted from SkillTree storage during the analysis flow. Withdrawing health-data consent deletes profile injury and limitation records and stops future AI Coach health-data processing, but does not automatically delete earlier coaching text. Turning analytics off stops future collection on that device and clears queued analytics from the app.
Account deletion removes your live SkillTree account records and temporary uploads. Limited records may remain until provider backups are overwritten, or longer where law requires billing, fraud-prevention, dispute, or regulatory records. We use the shortest period consistent with those purposes.
10. Your rights
Depending on the law that applies, you may request access, correction, deletion, restriction, or portability of your data and withdraw consent. You can export training history and delete your account in the app, and use the settings screens to change notification, analytics, and health-data choices.
You have the right to object to processing based on legitimate interests. Send any request or objection to privacy support. We may need to verify your identity before acting.
11. Age eligibility
SkillTree is intended only for adults aged 18 or older. You must confirm that you meet this minimum age before creating an account. We do not knowingly permit anyone under 18 to create or use an account.
If you believe we hold personal data about anyone under 18, contact privacy support so we can investigate, restrict or remove the account and associated data as appropriate.
12. Product analytics and diagnostics
PostHog product analytics are off by default and operate only when configured in the submitted build. If you opt in, we send a pseudonymous account identifier, app and device context, and named product events to PostHog's United States service. We do not enable session replay. You can turn analytics off in Privacy & Data at any time.
When configured in the submitted build, Sentry receives limited account identifiers, app context, and technical error details so we can investigate crashes and caught errors. We do not intentionally send health descriptions, form videos, or payment card data to analytics or diagnostics services.
13. Changes to this policy
We may update this policy when the service, providers, or law changes. We will update the date and give additional notice in the app when a change materially affects your rights or how we use data.
14. Contact and complaints
Email privacy@getskilltree.com or write to SKILLTREE LIMITED at Flat 2 52 Pont Street, London, England, SW1X 0AE.
You can complain to the UK Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. Please contact us first if you are comfortable doing so, so we can try to resolve the issue.