The short version: we collect the minimum needed to run SkillFlirt, never sell your data, and let you delete everything in two clicks.
For the full legalese, see the Privacy Policy. This doc is the operational version.
What we store
- Account info — email, name, optional profile photo. Your password is hashed by Clerk and never seen by us in plain text.
- Generations — the inputs you submit (chat text, profile details, context) and every output we generate, stored so you can revisit them in your history. Chat-screenshot images are processed in-memory at the moment of analysis and not stored server-side.
- Usage — how many generations you've used today (for rate limiting), feature breakdown by month (for the usage chart in Settings).
- Payment metadata — from Stripe, we receive a customer ID, your plan, and subscription status. We never see card numbers, CVCs, or bank details.
- Standard web logs — IP, user-agent, request path. Used for abuse prevention and rotated every 30 days.
Retention windows
- Generation history: kept while your account is active (same for Standard and Platinum), so you can revisit past outputs any time.
- Practice sessions (Chat Coach): the conversation lives in your browser during the session; we don't store the transcript server-side.
- Account deletion: all data wiped within 7 days of request.
You can clear your saved generation history from Settings → Privacy & data.
Third parties (sub-processors)
We use a small set of trusted vendors to operate the service:
- Clerk — authentication (sign-up, sign-in, password reset). Cloudflare Turnstile provides bot protection through Clerk.
- Oracle Cloud Infrastructure — hosting. The app and our self-managed PostgreSQL database (account info, generation history) run on a server we operate on Oracle's cloud.
- OpenRouter and OpenAI — text, vision, and role-play generation with provider data collection for training disabled. Limited security and abuse-prevention retention may apply.
- Google LLC (Gemini) — an alternative AI provider used only under its paid-service data terms. We do not send private chats to its unpaid API service.
- RevenueCat and your app store — mobile subscription verification and restoration.
- Stripe — payment processing only.
- Resend — transactional email (e.g. your welcome email).
Full list and links are in the Privacy Policy.
How to export your data
- Open Settings → Privacy & data → Export JSON.
- On the web, the JSON downloads directly. On iOS, choose how to save or copy it from the native share sheet.
The export includes your account profile and saved generations. If you cannot access Settings, request an export at privacy@skillflirt.net.
How to delete your data
Two options:
- Clear saved generations: choose Settings → Privacy & data → Clear history and confirm.
- Delete your entire account: Settings → Account → Delete account. If you are on the subscription screen, use Account & sign out to reach the same control without purchasing. Confirm deletion to remove your sign-in account and saved app data.
Deleting your account also cancels any active web (Stripe) subscription. If you subscribed through an app store, you must also cancel the subscription in your store account — account deletion doesn't cancel those.
Account deletion is irreversible through the app. Backups expire under the retention schedule in the Privacy Policy. If you might want to come back, just cancel your subscription instead: your history is preserved and you can re-subscribe later and pick up where you left off.
Your data is not sold
We don't sell your data to advertisers, brokers, or anyone else. Period. We've structured the business around subscriptions specifically so we never need to.
If this ever changes (it won't), we'd notify every user by email at least 30 days in advance and give you the option to delete your account before the change takes effect.