Privacy Policy

1. Who we are

SkyDraft ("we", "our", "us") is an AI-powered weather content generation platform operated at skydraft.app. We are committed to protecting your personal information in compliance with the Personal Information Protection and Electronic Documents Act(PIPEDA), Quebec's Law 25 (Act respecting the protection of personal information in the private sector), and applicable international privacy laws including the GDPR.

2. Information we collect

We collect only what is necessary to provide the service:

• Account information: name, email address, and a hashed password when you register.
• Content you generate: weather event inputs (location, event type, details) and AI-generated outputs stored in your history.
• Usage preferences: default tone, platform, language, writing preferences, and templates you create.
• Billing information: managed entirely by Stripe. We never store your credit card number.
• Technical data: session tokens (httpOnly cookies), which expire when you log out.

We do not collect location data, use tracking pixels, or build advertising profiles.

3. How we use your information

• To provide and improve the SkyDraft service.
• To authenticate your account and maintain your session.
• To send transactional emails (account verification, password reset) via Resend.
• To process payments and manage subscriptions via Stripe.
• To personalize AI-generated content based on your saved preferences.

We never sell, rent, or share your personal information with third parties for marketing purposes.

4. Cookies and local storage

SkyDraft uses:

• Authentication cookie (skydraft_token): An httpOnly, secure JWT cookie required for you to stay logged in. This is a strictly necessary cookie — no consent required.
• Theme preference: Stored in localStorage to remember your dark/light mode choice.
• Cookie consent choice: Stored in localStorage (skydraft_cookie_consent).

We currently use no third-party analytics or advertising cookies.

5. Third-party services

• OpenAI — processes your weather event inputs to generate content. See OpenAI Privacy Policy.
• Neon (PostgreSQL) — stores your account data and generations on servers in the United States.
• Vercel — hosts the application. See Vercel Privacy Policy.
• Stripe — processes payments. See Stripe Privacy Policy.
• Resend — sends transactional emails. See Resend Privacy Policy.

6. Data retention

Your data is retained for as long as your account is active. You may delete individual generations at any time. If you delete your account, all personal data associated with it will be permanently removed within 30 days.

7. Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information via your Account settings.
• Request deletion of your account and all associated data.
• Withdraw consent at any time (note: withdrawing consent for essential cookies will prevent login).
• Lodge a complaint with your local privacy authority (e.g., the Commission d'accès à l'information du Québec).

To exercise these rights, contact us at support@skydraft.app.

8. Security

Passwords are hashed with bcrypt and never stored in plain text. All communications are encrypted via HTTPS/TLS. Session tokens are stored in httpOnly cookies, inaccessible to JavaScript. We review our security practices regularly.

9. Changes to this policy

We may update this policy from time to time. We will notify registered users by email of any material changes. Continued use of SkyDraft after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions: support@skydraft.app