Privacy Policy
This policy was written by reading what the app's code actually does. Every statement below corresponds to a specific piece of stored data, network call, or SDK in the shipped app. When the app changes, this page changes with it.
1. What Skim is
Skim is a reading app. You add things you want to read — links, PDFs, screenshots, AI-chat transcripts, forwarded emails, X bookmarks — and Skim uses AI language models to distil them into short cards you swipe through. Cards you keep go to your library; cards you dismiss go away.
Distillation is the core function of the app, and it is the reason most of the data handling below exists: the content you add is sent to third-party AI providers to be summarised. Section 4 covers that specifically.
2. Information we collect
2.1 Account information
When you sign in with Google, we receive and store your Google account identifier (a stable, opaque value), your email address, and your display name. We do not receive or store your Google password. Your Skim user ID is derived from the Google identifier, and every other record we hold is partitioned by it.
2.2 Content you provide
Whatever you add to Skim, we store:
- links and articles you save or share into the app
- PDF files you upload
- screenshots you share into the app
- AI chat transcripts — ChatGPT or Claude export files, and shared conversation links
- emails you forward to your personal Skim ingestion address
- X (Twitter) bookmarks, if you connect your X account
- notes and highlights you write — saved lines, reflections, and commonplace entries
Uploaded files are stored as blobs; everything else is stored as documents. Both are tagged with your user ID.
2.3 Content we derive from yours
- Distilled cards — the summaries the AI produces from your content
- Embeddings — numeric representations of your content, used for search and for detecting near-duplicate cards
- Audio narration — synthesised speech of card text, when you use audio
2.4 Usage information
- which cards you were shown, so the deck can rotate rather than repeat
- which cards you kept, dismissed, or read
- reading sessions and progress
- onboarding state and app preferences
We do not use this for advertising, and we do not sell it. Skim contains no advertising SDKs and collects no advertising identifier.
2.5 Device information
A push notification token (Firebase Cloud Messaging), plus your platform and timezone, so notifications arrive at a sensible local hour. Only if you grant notification permission.
2.6 Purchase information
Subscriptions are processed by RevenueCat and the platform app store. We store only your resulting entitlement state (free or premium). We never receive or store your payment card details.
2.7 Diagnostics
If the app crashes, a crash report is sent to Sentry: stack trace, device model, OS version, app version. Sentry's "send default PII" setting is not enabled, so we do not deliberately attach your email or IP address to crash reports.
2.8 What we do not collect
We do not collect your location, contacts, calendar, health data, SMS, call logs, or your photo library. The app reads a photo only when you explicitly share one into it.
3. On-device storage
Your login token is stored in the operating system's secure keystore (Android Keystore / iOS Keychain). Your theme choice and onboarding state are stored in ordinary app preferences. Uninstalling the app removes both. It does not delete your server-side account — see section 7.
4. AI processing — please read this one
To produce cards, the content you add is transmitted to third-party AI providers. The backend routes each job to one of the providers below, choosing by cost, speed and availability, and falls over to another when one is rate-limited or down. Any of them may therefore receive your content:
- Anthropic (Claude)
- OpenAI — also used for embeddings (search) and text-to-speech narration
- Google (Gemini)
- Cerebras
- Groq
- NVIDIA (NIM)
- DeepSeek
This means the text of your articles, PDFs, screenshots, chat transcripts, forwarded emails, and bookmarks leaves our systems and is processed by these providers under their own API terms. Anthropic, OpenAI and Google state in those terms that they do not use API inputs to train their models, and may retain inputs for a limited period (typically up to 30 days) for abuse monitoring. The other providers process content under their own terms, which you should read before adding sensitive material. We do not currently hold a zero-retention agreement with any provider.
Do not add content to Skim that you are not comfortable sending to a third-party AI provider — in particular confidential, legally privileged, or other people's personal information.
5. Other third parties
| Who | Why | What they get |
|---|---|---|
| Google Sign-In | Authentication | Your Google identity |
| Firebase Cloud Messaging | Push notifications | Device token |
| Sentry | Crash reporting | Diagnostics, no deliberate PII |
| RevenueCat | Subscriptions | Purchase / entitlement state |
| MongoDB Atlas | Database hosting | All stored data, at rest |
| Render, Northflank | Application hosting | Data in transit and in process |
| Upstash | Job queue | Job identifiers while work is pending |
| X (Twitter) | Optional bookmark import | Only if you connect it |
If you connect X, we store your access tokens encrypted at rest. To disconnect, revoke Skim under Settings → Security → Connected apps on X and email us to remove the stored token; deleting your account removes it too.
6. Why we are allowed to process this (GDPR / UK GDPR)
For users in the EEA and UK, our lawful bases are: contract for account data and content processing, without which the app cannot function; legitimate interests for diagnostics and security; and consent for push notifications and for connecting your X account, either of which you can withdraw at any time.
7. Your rights, and how to exercise them
You can request access to, correction of, export of, or deletion of your data by emailing engr.mu.shah@gmail.com from the Google account you signed in with. We respond within 30 days.
Account deletion is available in the app under Library → More → Delete account, and from the web on the account deletion page if you no longer have the app. Deleting your account removes your account record, your content, the cards derived from it, your uploaded files, your embeddings and narration, and your usage history. It is immediate and irreversible.
Crash reports already sent to Sentry expire under Sentry's 90-day retention, and content already sent to an AI provider may be held by that provider under its own retention terms (section 4). We do not keep separate database backups.
8. Retention
We keep your data while your account exists. We do not currently delete accounts for inactivity; if that changes we will give notice in the app and by email first.
9. Children
Skim is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will delete it.
10. International transfers
Our infrastructure and AI providers are primarily in the United States. If you use Skim from outside the US, your data is transferred there. For EEA and UK users, transfers to each provider rely on that provider's data processing agreement incorporating the Standard Contractual Clauses.
11. Security
Transport is encrypted (HTTPS). Login tokens are held in the platform keystore. Third-party OAuth tokens are encrypted at rest. No system is perfectly secure, and we cannot guarantee absolute security.
12. Changes
We will update this policy as the app changes and revise the date above. Material changes will be signalled in the app before they take effect.
13. Contact
Muhammad Shah · engr.mu.shah@gmail.com