Privacy

This page explains what skuttr collects, why, and your choices.

Last updated: November 1, 2026

Who is responsible

skuttr is operated by Deborah Choi, who is responsible for the personal information described here. For questions or requests, email hello@skuttr.com.

The waitlist

If you join the waitlist, we collect your email address, your consent to receive beta and launch emails, the consent text version, and the times you signed up and confirmed. We use Resend to send the confirmation email and, after you confirm, waitlist updates. You join the list only after confirming your email.

Unconfirmed sign-ups are deleted 30 days after signup. Confirmation links expire after 7 days. Every waitlist email includes an unsubscribe link; unsubscribing changes the status of your waitlist record, which we keep until you ask us to delete it. You can also ask us to unsubscribe or delete your waitlist information by emailing hello@skuttr.com. To limit spam, we keep keyed, one-way hashes of the email address and network address used for rate limiting; we do not store the raw network address for that purpose.

The iPhone app

The app creates a pseudonymous Supabase account when it first opens. It does not ask for your name, email address, or password. Supabase stores app account and service data in Frankfurt, Germany. Your original photo and video library remains on your iPhone. Finding candidate moments and rendering the finished Reel happen on-device. When skuttr plans a Reel with AI, small previews of selected candidate photos or videos are sent to OpenAI as described below. Finished Reels are saved to your Photos. If an original is in iCloud, iOS may download it to your iPhone when the app needs it.

When your prompt names a place, your iPhone uses Apple's map service to find where it is. That lookup sends the place name, not your photos. skuttr analyzes candidate photos and video frames on your iPhone to create scene labels, and those labels stay there. skuttr v1 does not read text in photos. Reels saved by skuttr carry a small tag in the video file saying they were made with skuttr. The tag stays in the file if you share it. skuttr uses this tag, and a list of the Reels it saved, so it never uses its own Reels as footage for new ones.

AI planning is necessary to make the Reel you request, and its legal basis is our contract with you. Before previews are sent, the app asks your permission to use AI planning. If you allow it, skuttr sends OpenAI your AI-planning prompt, small previews of candidate photos or videos, and limited details needed to identify and edit those candidates (asset references, media type, date, and video duration). The previews and prompt are sent for that request; skuttr's server does not save them or the returned plan in its database. The server records generation requests and Reel reservations with account and generation identifiers, a pseudonymous device key, date, model, request status, token counts, response time, and a broad failure category, but not your prompt or photo previews. Account-linked usage records are removed when that account is deleted. You can turn AI planning off in Settings.

OpenAI says API data is not used to train or improve its models unless the customer opts in. With the standard API data controls used by skuttr, API content may be retained for abuse monitoring for up to 30 days. skuttr sends API requests with response storage turned off; this does not disable separate abuse monitoring. See OpenAI's API data controls.

Device integrity, usage, and Support ID

Apple App Attest helps the server check that requests come from the genuine app. Apple DeviceCheck keeps a small per-device flag showing that the free allowance is exhausted, so reinstalling the app does not reset it. The app's service records generation requests and Reel reservations, including whether a Reel succeeded, to enforce the five-Reel free allowance and the 20-Reel daily fair-use limit for Pro. Each install also has a short Support ID. You can share it with us when you contact support; it helps us find the install's support record.

Purchases

Apple handles subscription payments. To provide skuttr Pro, skuttr receives and checks Apple-signed purchase and subscription information, including transaction identifiers, product, purchase and expiry dates, store environment, and subscription status. Apple also sends subscription status updates to skuttr. We do not receive your card number or payment details. Deleting app data does not cancel a subscription; manage or cancel it in your Apple Account.

Deleting your data

Use “Delete my account” in the app or email hello@skuttr.com to request deletion. In the app, deletion removes the pseudonymous account and its account-linked usage records, Reel reservations, and skuttr's subscription entitlement record; the app then creates a new pseudonymous account if you continue using skuttr. Your photos and saved Reels remain in Photos. Install-level device records—including the free-allowance record, App Attest key, Support ID, and staff state—remain after account deletion to help prevent abuse and stop the free allowance being reset. The Apple DeviceCheck flag, Apple's purchase records, and our StoreKit notification records used to process subscription updates are also not removed by this action. It does not cancel an Apple subscription.

How long we keep information

Pending waitlist entries: deleted 30 days after signup by a scheduled cleanup. Confirmation tokens expire after 7 days.
Confirmed and unsubscribed waitlist entries: the current system retains the waitlist record until you request deletion. Unsubscribing changes its status but does not remove the other fields.
Waitlist rate-limit hashes: deleted by the same cleanup when they are more than 30 days old.
Pseudonymous account and account-linked generation records, Reel reservations, and subscription entitlement: kept while the account exists and removed when you delete that account. A pending Reel reservation expires after 24 hours; its row is marked expired when the reservation check next runs, and remains until account deletion.
Device records and Apple DeviceCheck flag: install-level quota, free-allowance, App Attest, Support ID, and staff records remain after account deletion to help prevent abuse and free-allowance resets.
App Attest challenges: each challenge expires after 5 minutes.
App Store purchase, entitlement, and notification records: the account-linked entitlement is removed when you delete your app account. StoreKit notification records are not removed by that action and are kept as needed to administer subscriptions and meet accounting, tax, and legal record-keeping obligations. Apple separately keeps its purchase records under its own policies.
OpenAI request data: under the standard API controls, OpenAI may retain content for abuse monitoring for up to 30 days. The request's response-storage setting is off, but it does not disable this monitoring.
Waitlist email data held by Resend: its DPA says it processes customer data while the service agreement is active and deletes it within 90 days after account termination.

We do not set separate retention periods in skuttr's code for service-provider operational logs. Provider terms and retention settings may apply to those records.

International transfers

Some providers may process information outside the European Economic Area (EEA). Supabase's database for skuttr is in Frankfurt, but its published DPA provides for EU Standard Contractual Clauses (SCCs) where required. OpenAI's DPA identifies SCCs or an applicable adequacy decision for onward transfers outside the EEA. Apple's privacy policy describes safeguards for international transfers, including SCCs where applicable. Resend's DPA describes the EU-U.S. Data Privacy Framework and SCCs for transfers outside the EEA. Vercel's DPA applies to this project on its Pro plan and provides for SCCs for covered transfers. Cloudflare may process information outside the EEA; its DPA provides EU SCCs for restricted transfers and an applicable adequacy framework where available. Cloudflare Email Routing forwards mail sent to hello@skuttr.com, and its DPA is part of the Self-Serve Subscription Agreement, including the Free plan. See the providers' linked privacy and data-protection terms: OpenAI, Apple, Vercel, Resend, Cloudflare, and Supabase.

Service providers

We use Vercel for website and server hosting; Supabase for authentication and database services in Frankfurt, Germany; OpenAI for AI planning; Apple for app distribution, purchases, App Attest, and DeviceCheck; Resend to send waitlist emails; and Cloudflare Email Routing to forward email sent to hello@skuttr.com. Processing agreements are in place with each of these providers, including Vercel under the project's Pro plan. Cloudflare's DPA forms part of its Self-Serve Subscription Agreement, including the Free plan. These providers process information as needed to provide their services.

We do not use analytics or advertising trackers on the website.

Your choices and rights

For the waitlist, you can withdraw consent using the unsubscribe link in any email. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You can ask us to access, correct, or delete personal information, or raise any privacy question, by emailing hello@skuttr.com. Where the GDPR applies, you may also have rights to access, rectify, erase, restrict or object to processing, and to receive portable information. You may object to processing based on our legitimate interests. You can complain to the data protection supervisory authority where you live or work. We use consent for waitlist email; our contract with you to provide the app, Pro, and AI planning you request; legitimate interests to prevent fraud and abuse and protect the service; and legal obligation for records we must retain by law.

Children

skuttr is for people at least 13 years old, or older where the law in your country requires it.