Privacy

What Skiss keeps, why, where it lives, and how to get it back or gone. Last updated November 7, 2026.

Who we are

Skiss is a product of CConnect, in Edmonton, Alberta, Canada. We're responsible for the personal information Skiss holds (in European terms, the "controller"). Questions or requests go to [email protected].

People use Skiss all over the world, so this policy is written to meet the privacy laws that protect you where you live, including Alberta's Personal Information Protection Act (PIPA) and Canada's PIPEDA, the EU and UK General Data Protection Regulation (GDPR), California's Consumer Privacy Act (CCPA, as amended by the CPRA) and the similar laws of other US states, and Australia's Privacy Act. Where your local law gives you more protection than this page describes, you get the protection of your local law.

Your account

Your email address and password. Skiss stores the password only as a one-way argon2id hash, never the password itself. When you choose a password, Skiss checks it against known breaches using Have I Been Pwned: only the first five characters of a hash of it are sent, never the password. Your email is used to sign you in and for messages about your account: a welcome when you sign up, password reset codes, notices when your password or two-step sign-in changes, when your Pro trial ends or Pro pauses after a failed payment, and when your account is deleted. We don't send marketing email. If you turn on two-step sign-in, Skiss also keeps the key your authenticator app uses to make codes, stored encrypted, and your backup codes, stored only as hashes. Turning it off deletes both.

For each signed-in browser and the extension, Skiss keeps the browser's name and version and when it was last used, so you can sign out everywhere.

Your library

The sites you capture: screenshots, the colour, type, spacing and structure read from their CSS, page text used to find sections, the elements you pick, palettes, collections, Design.md files, and the notes and tags you add. Captured pages can include whatever the site itself showed publicly, which may include other people's names or photos; you control what you capture and can delete it at any time.

If AI notes are on, page text and measurements are sent to Anthropic to write notes and suggest filing. Anthropic doesn't use them to train models. AI notes are part of Pro, and you can turn them off in Settings at any time; while they're off, nothing is sent to Anthropic.

The Chrome extension

When you press Archive or Pick an element, the extension reads the tab you're on (its address, the page's HTML and styles, and a screenshot of it) and sends that to your Skiss account. It asks for access to all sites so it can do this on whatever page you choose, but it doesn't read, record or send anything from pages you don't capture. If you import bookmarks, it asks for bookmarks access first and reads them once, on your computer, to list sites for you to choose from; only the sites you pick are sent. It keeps your sign-in and a few preferences in the browser's extension storage. It doesn't have access to your browsing history.

Pages captured in your browser

Some pages come out better captured in your own browser, so Skiss lists them in Notifications. The extension never opens anything on its own: nothing happens until you press Capture now, and then only the pages listed there open, one at a time in a window of their own, until they're done or you press Stop. It only ever opens pages that are already in your library. It doesn't read what you type, where you click, which other sites you visit, or what's on your screen.

Agent access (MCP)

Apps such as Claude reach your library in one of two ways: you connect them by signing in to Skiss from the app and choosing Allow, or you make an agent token for them in Agent access. Either way Skiss gives the app a token and stores only a hash of it. When an app signs in, Skiss also keeps the name and return address it registered with, for as long as a connection uses it; apps nobody connected are removed after 30 days. An assistant using the token can read your library and nothing else, and can't change anything. Skiss logs each call (the tool, the app, what it asked for and the size of the answer) for 30 days so you can see what it read. Whatever an assistant reads is then handled by that assistant's provider (for example Anthropic for Claude, or Cursor) under their own privacy terms. Revoke a token in Agent access and it stops working at once.

Feedback and problem reports

When you send feedback or report a capture, Skiss keeps your message, the page or capture it's about, and a screenshot only if you choose to attach one. The Skiss team reads these to fix things and may reply in the app.

Billing

Pro is sold through Link, Stripe's checkout, which is the seller of record for your payment. When you pay, Link collects your card or other payment details, your billing address and country (to work out tax), and sends your receipts, under Link's privacy policy and Stripe's. Skiss gets back your plan, its status and dates, the currency, and your Stripe customer and subscription IDs, never your card number. You can ask Link to delete what it holds about you.

What the Skiss team can see

Your email, when you signed up and were last active, your plan, how many sites you've saved, and feedback you send. Not which sites you've saved, your screenshots or your notes, unless you send them to us in a report or ask us to look while helping you. Every sign-in to Skiss's admin area, and every change it makes to an account, is logged.

Why we use it

We use your information only to run Skiss for you, and never to sell it or to show you ads. If you're in the EU or the UK, these are our legal bases:

• To provide Skiss to you (performing our contract with you): your account, your library, capturing the pages you choose, Pro and its billing, and the emails about your account.
• Our legitimate interests, which don't override your rights: keeping Skiss secure (rate limits, sign-in logs, blocking abuse), fixing problems you report, and knowing in total how captures go and which of Free's limits accounts run into, without seeing who saved what or who ran into which.
• Your choice: AI notes, agent access and bookmark import happen only when you turn them on, and you can turn each off at any time.
• The law: keeping billing records for tax, and answering lawful requests.

Skiss doesn't make decisions about you by automated means that have legal or similarly significant effects. AI notes describe the sites you save; they aren't about you.

Where it lives

Skiss's data is stored on DigitalOcean servers in Toronto, Canada. A backup of it is made every night and copied to Cloudflare's R2 storage, where only Skiss can reach it; we keep the last 14 nightly backups.

Some of the companies we use are based outside Canada, so your information may be processed in the United States or elsewhere, where it can be subject to those countries' laws: DigitalOcean (hosting, US company; Skiss's servers are in Toronto), Cloudflare (delivers Skiss's pages, protects it from attacks, stores the nightly backups and counts visits to the skiss.co home page, US), Stripe and Link (payments and the seller of record for Pro, US), Anthropic (AI notes when on, US), Resend (sends Skiss's email, US), Have I Been Pwned (the five-character password check) and Google Fonts (the app's heading font, which shares your IP address with Google when it loads). Ask us if you'd like more detail about them.

Moving data between countries. If you're in the EU or the UK, your information is stored in Canada, which the European Commission and the UK recognise as protecting personal information adequately. Where it goes to a company in the United States or elsewhere, we rely on that company's safeguards recognised under GDPR, such as the EU-US Data Privacy Framework (and its UK extension) or the European Commission's Standard Contractual Clauses. Ask us and we'll tell you which applies to each one.

Cookies

Skiss uses one cookie, to keep you signed in, and your browser's local storage for things like light or dark mode. There's no advertising and no tracking. The skiss.co home page counts visits with Cloudflare Web Analytics, which sets no cookies and collects nothing that identifies you: just totals of pages viewed, where visitors came from, their country and device type. The app itself has no analytics.

Keeping and deleting

Your library is kept until you delete it. When you sign up, Skiss emails a link to confirm your address. An account whose address isn't confirmed within 14 days is deleted, with everything in it, after one reminder at 7 days, since nobody can reach it or reset its password. Settings › Delete account cancels any subscription, then deletes every capture, screenshot, element, note, palette, collection, token and feedback message right away. Copies in the nightly backups disappear as those backups are replaced, within 14 days. Stripe and Link keep the payment records they're required to keep by law, and we keep billing records for as long as Canadian tax law requires (generally six years). Agent call logs are kept 30 days.

Your choices and rights

Wherever you live, you can do all of this, free:

• See it: ask what personal information we hold about you, how it's been used and who it's been shared with, and get a copy.
• Take it with you: export your whole library from Settings at any time, in a format other tools can read.
• Correct it: change anything in your library yourself, or ask us to fix anything else.
• Delete it: delete anything you've saved, or your whole account, from Settings, or ask us to.
• Object or limit: ask us to stop or limit a use of your information, or turn off AI notes, agent access or bookmark import yourself.
• Change your mind: take back a choice you made at any time; it doesn't affect what happened before.

Write to [email protected]; Support has the subject lines to use. We'll confirm we have your request within 2 business days and answer it within 30 days. If a request is complicated we may need longer, as the law allows, and we'll tell you why. We'll check the request comes from you, usually by replying to your account's address. Using these rights never changes the price you pay or the service you get.

If you're in California or another US state with a privacy law: in the last 12 months we collected identifiers (your email address and sign-in details), commercial information (your plan and its dates), internet activity (the pages you choose to capture, and your sign-in history), and the content you add (notes, tags, collections), all for the purposes on this page. We don't sell your personal information, and we don't share it for cross-context behavioural advertising; we never have. We don't use or disclose sensitive personal information beyond what's needed to run Skiss. You or someone you authorise can make the requests above; we'll ask an authorised agent for proof you gave permission. If we refuse a request, you can appeal by replying to our answer.

If you're not happy with our answer, you can complain to the privacy regulator where you live: in Alberta, the Office of the Information and Privacy Commissioner of Alberta; elsewhere in Canada, the Office of the Privacy Commissioner of Canada; in the EU, your country's data protection authority; in the UK, the Information Commissioner's Office; in Australia, the Office of the Australian Information Commissioner; or your state's Attorney General in the US. We'd rather you tell us first, so we can put it right.

Security

Passwords are hashed, agent tokens are stored only as hashes, sign-in attempts are rate-limited, two-step sign-in is available to every account and required for admins, and every account can see only its own data. No system is perfect: if a breach puts your information at real risk, we'll tell you, and the regulators the law requires, as quickly as we can.

Children

Skiss isn't meant for anyone under 16, and we don't knowingly keep their information. If you think a child has made an account, tell us and we'll delete it.

Changes

If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect.

Contact

CConnect
Edmonton, Alberta, Canada
[email protected]