Legal
what we collect, why, and what we never do
Version of 30 July 2026.
The short version
Skaz ("we", "us") operates the story editor at studio.skaz.io and the player at skaz.io (together, the "Service"). For the data described in Section 3 we are the data controller. Contact: privacy@skaz.io.
This policy is written to meet the standard set by the EU General Data Protection Regulation (GDPR) and the UK GDPR. Where your local law gives you stronger rights, those rights apply.
Skaz has two kinds of user, and the difference matters for privacy:
For author accounts, we are the controller. For anything a story itself asks its readers — a name, an email, a quiz answer typed into an input block — the author is the controller and we act as their processor: we store it and show it back to them, and we do not use it for our own purposes. See Section 6.
3.1. Author accounts. First and last name, email address, password (stored only as a hash, never in readable form), country, date of birth, chosen language, plan and subscription status. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
Date of birth is collected for one narrow purpose: to check that someone is old enough to publish or open a story marked 18+. It is not used for profiling or advertising.
3.2. Story content. The text, images, branches and variables you create. Yours; we store it so the Service works.
3.3. Play sessions. When anyone plays a published story, we record the playthrough: which blocks were visited, which choices were taken, timestamps, the values of the story's own variables, and whether the session finished or was abandoned. This is what powers the author's sessions view. For an anonymous reader this data is tied to a session identifier, not to a person.
3.4. Reader identity — only when the author asks for it. An author can mark a story as requiring sign-in. Only then is a reader asked to sign in, shown an explicit consent checkbox stating that their email will be shared with the author, and only after they tick it does the author see it. No checkbox, no email. Legal basis: consent (Art. 6(1)(a) GDPR), withdrawable at any time.
3.5. Technical data. IP address and browser user-agent are processed by our servers and hosting provider to deliver the Service and to keep it secure and available. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
3.6. Product analytics. We use PostHog to understand how the Service is used — pages viewed, stories started and finished, features used. Session replay is disabled, so no screen recording and no capture of what anyone types. Signed-out readers are not given a persistent person profile. Legal basis: legitimate interests, or consent where your jurisdiction requires it for analytics cookies.
Skaz is usable in a classroom without collecting anything about a student:
Under FERPA (20 U.S.C. § 1232g), a school that uses Skaz in the default, no-account way discloses no education records to us, because none are provided. If your institution needs a data processing agreement, a school-specific addendum, or answers for a vendor review, write to privacy@skaz.io and we will work through it with you.
Author accounts are not intended for children: you must be at least 13 to create one, and at least 18 to create or open a story marked 18+.
Where a story gathers reader data through input blocks or the sign-in requirement, the author decides why and what for, and is the controller of that data. The author must have a lawful basis, tell readers what they are collecting, and honour readers' rights. We process that data only to operate the Service and to display it to that author, and we delete it when the author's story or account is deleted.
If you are a reader and want data removed that an author collected about you, contact the author first. If you cannot reach them, write to privacy@skaz.io and we will help.
We use a small number of processors, each bound to act only on our instructions:
We also disclose data where we are legally required to, and where it is necessary to protect someone's life or safety. Some processors are located outside the EEA and the UK; such transfers rely on Standard Contractual Clauses or an adequacy decision.
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its processing, or hand it to you in a portable format. Where processing rests on consent, you can withdraw that consent at any time without affecting what happened before.
Write to privacy@skaz.io. We answer within 30 days. If you are in the EEA or the UK you also have the right to complain to your national data protection authority.
Traffic is encrypted in transit with TLS. Passwords are stored only as hashes, never in readable form. Access to production data is limited to the people who need it to run the Service. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority as the law requires.
We set a session cookie to keep you signed in — without it, accounts cannot work. PostHog sets an analytics cookie to distinguish visits. We use no advertising cookies and no third-party trackers beyond the processors listed in Section 7.
We will post any new version of this policy at https://skaz.io/privacy and change the date at the top. If a change materially affects your rights we will tell account holders before it takes effect.
Privacy questions, data requests, school reviews: privacy@skaz.io
Everything else: support@skaz.io
Content reports: abuse@skaz.io