Privacy Policy

This Privacy Policy explains how Skyelight collects, uses, shares, and protects personal data when you use the Skyelight website, web app, browser extension, review badge, build plugin, MCP server and API, and the integrations they connect to (together, the “Service”). It also describes the rights you have over your personal data, including under the EU General Data Protection Regulation (GDPR), the UK GDPR, and US state privacy laws.

Skyelight is a product of PLASTR LTD, doing business as Skyelight, 3916 Clock Pointe Trail, Suite 103, Stow, OH 44224, United States (“Skyelight”, “we”, “us”, or “our”). For any privacy question or to exercise your rights, contact us at support@skyelight.ai.

1. The roles we play

For your account, billing, product analytics, and the messages we send you about Skyelight, we act as the data controller.

Feedback, screenshots, page context, and the other content that people create inside a workspace belong to the organization that owns that workspace. That organization decides what is captured, including whether screenshots are on, and it is the controller of that content. Skyelight processes it on the organization’s behalf as a processor. If you were invited to review someone else’s site or product, questions about your feedback in their workspace should go to them first; we will help them answer. See “Your responsibilities” below.

2. Information we collect

Account and identity

Sign-in is handled by our identity provider, Clerk. When you create an account we receive and store your name, email address, avatar (if you have one), and an account identifier. If you sign in with a third-party provider, we receive the basic profile that provider shares. We never receive or store your password.

Organizations, workspaces, and members

We store the organizations, workspaces, and projects you create, their names, logos, and settings, and each member’s role. When someone is invited, we store the invitee’s email address and the invite details so we can deliver it. Invite links expire after seven days. We keep an activity log of changes within a workspace, such as members joining, roles changing, and settings being changed.

Guests

On paid plans, a project can let people without an account leave feedback as a guest, with a code the team shares or on one of the project’s review links. Guest feedback is off until the team turns it on. For a guest we store the name they type, an email address if they choose to give one, the project, how they joined, and when they joined and were last seen. A guest’s email is shown only to the project team’s owners, admins, and collaborators, so they can follow up; Skyelight never sends anything to it. Guests get no notifications, are not tracked in our product analytics, and can see only their own threads.

Feedback: pins, threads, and replies

The core of the Service is feedback left on a web page, called a pin. For each thread and reply we store the text written, @-mentions, reactions, the thread’s type, status, and assignee, any images attached, who wrote it, and when. If a link is pasted into a comment, our servers fetch that page to show a preview (its title, description, and image).

Where a pin was left

So that a pin can be found again later, we store:

• the page URL (including its query string), route, and title;
• the site’s favicon and hostname;
• an anchor for the element that was pinned: a CSS selector, where on the element the click landed, the viewport size, the element’s visible text, and any text that was highlighted;
• where the site uses our build plugin, the source file, line, component, commit, and branch stamped onto that element.

Page context

When a new thread is started, we capture the structure, visible text, and styles around the pinned element, so a developer can see what the page said without reopening it. Page context is on by default, and a workspace’s owners and admins can turn it off. Redaction happens in the browser, before anything is sent to us:

• no value typed or chosen in any input, text area, or select is ever included;
• password and payment fields are dropped entirely, labels too;
• any part of a page marked data-skyelight-redact is left out, along with everything inside it.

Browser details and page problems

As part of page context, and under the same setting, a new thread also records two things that help a developer reproduce what was seen:

• Browser details: the browser and its version, the operating system, the window size and pixel density, light or dark mode, the reduced-motion setting, and the browser’s language. We do not record your time zone or location.
• Page problems: from the ten minutes before the pin, up to ten each of errors the page’s own code threw, messages it wrote with console.error or console.warn, and requests it made that failed (an error status such as 404 or 500). For an error or message we keep its text and where in the code it came from. For a failed request we keep its address without the query string, its status, its type, and how long it took.

Before anything leaves the browser, query strings are removed from every address, and anything that looks like an email address or an access token is replaced. We never record console.log output, or the content, headers, or cookies of any request or response. Until somebody makes a pin, these are kept only in the page’s memory and nothing is sent. The review badge starts keeping them only once it has started for a signed-in reviewer or guest. The browser extension runs a small script inside each page you visit, from the moment it loads, so that a problem that happened before you pinned is still known; it sends nothing unless you make a pin on that page.

Screenshots

Screenshots are off by default. A workspace’s owners and admins can turn them on. When they are on, starting a new thread (never a reply) captures an image of the area around the pinned element:

• only the visible part of the page, never the full scrolling page, other tabs, or other windows;
• form fields and regions marked data-skyelight-redact are covered with solid blocks before the image is cropped or stored, and if that masking fails, no screenshot is kept;
• the browser extension asks the browser for the picture, while the review badge redraws the page from its own content and never asks anyone to share their screen.

Masking cannot reach everything. Text shown on a page outside a form field, such as an email address in a table, will appear in a screenshot unless the site marks it data-skyelight-redact.

Billing

Paid plans are billed through our payment processor, Stripe. We store your organization’s plan, seat count, billing status, and the Stripe identifiers for its customer and subscription. Card and bank details are entered directly into Stripe’s form and never reach our servers. We may display the card brand and last four digits that Stripe returns. Stripe’s billing emails go to the billing owner’s address.

Integrations you connect

Integrations are optional and only work once someone connects them.

• Slack: for personal notifications, your Slack user ID, team, display name, email, and avatar. For a workspace’s channels, the chosen channel and the references needed to keep replies in sync both ways. We store the Slack app’s access token encrypted.
• Linear: your Linear organization and teams, an encrypted access token, and a link between each thread and the issue it became.
• GitHub: the installation and the repository each project is linked to. Our GitHub app has read-only access to repository metadata. It cannot read your code, and we store no GitHub token.

Coding agents and the API

If you connect a coding agent over MCP or create a personal API token, we store the token’s prefix and a one-way hash (never the token itself), its expiry, when it was last used, and the organization it belongs to. For agents connected by OAuth, sign-in runs through Clerk. Replies an agent posts are recorded as yours, marked with the tool they came from, which we read from the tool’s user agent.

Notifications and preferences

We store your notification preferences, your in-app notifications, and a log of each email and Slack message we tried to send you and whether it was delivered.

Product analytics

We use PostHog to understand how the Service is used. There are three parts:

• Usage events are recorded by our servers when you do something, such as creating a project, starting a thread, or changing plan. They carry identifiers and counts (your account ID, organization, plan, role, and flags such as “had a screenshot”), never content. They are not recorded for you if you choose “No thanks” on the analytics prompt.
• Page views and session replay in the web app run only after you choose “Allow”. Session replay masks all text and every input, and hides uploaded images and screenshots.
• Visit counts on this website and the docs work without cookies until you choose “Allow”. PostHog records the page, the site that sent you, campaign tags in the link, and your approximate location from your IP address. Its servers tell visits apart with a one-way hash of your IP address and browser details, mixed with a value that changes every day, so a visitor can’t be recognized across days and nothing identifying is stored in your browser. With “Allow”, page views use PostHog’s cookie instead, so a visit and a later sign-up can be connected. If your browser sends Global Privacy Control or Do Not Track, we don’t count your visit unless you choose “Allow”.

You can change your answer at any time in Account settings, under Profile. We also send errors from our backend to PostHog so we can fix them.

Advertising measurement

We advertise in ChatGPT. If you choose “Allow” on our website’s cookie prompt, OpenAI’s ads pixel records the pages you view on our website and docs, and that you created an account, so we can see which ads bring people to Skyelight. It uses cookies and identifiers from the ad you clicked, and OpenAI may receive your IP address and browser details. The pixel can also pick up an email address, phone number or name typed into a form on a page it runs on, which it scrambles (hashes) before sending; we keep it off our sign-up form for that reason, and we don’t give it anything you write in Skyelight. Choose “No thanks”, or change your answer under “Cookie settings” at the bottom of our website, and the pixel stops and its cookies are deleted.

Technical data

Our hosting and infrastructure providers process technical data needed to run and secure the Service, such as IP address, browser and device details, and request logs. While you are signed in and have a workspace selected, the browser extension asks our servers for existing pins on the site you are viewing, which tells us that site’s hostname so its pins can be shown. We do not use these lookups to build a record of your browsing. The extension’s in-page script described under “Browser details and page problems” sends nothing on its own.

We keep the approximate city and country of your most recent sign-in, which Clerk works out from your IP address, to help with support and security and to understand where our customers are. We do not keep the IP address itself or a history of places; each update replaces the last, and it is deleted with your account. Only Skyelight staff can see it.

Email delivery

When we email you, our email provider, Resend, tells us whether the email was delivered, bounced, or marked as spam. Our emails also carry a small image that tells us when an email is opened, and links in them pass through email.skyelight.ai so we can tell when one is clicked, before taking you to the page. We use this to make sure our emails arrive and to see which are useful. Some email apps open every email automatically, so we treat it as a rough signal. You can block images in your email app to stop the open signal, and you can unsubscribe from any email that isn’t about your own account or threads.

When you contact us

If you email us or send an enquiry through the Enterprise contact form, we keep what you send and our reply.

Product emails

When you create an account, we add your email address to our mailing list so we can tell you about Skyelight updates. Every such email includes a way to unsubscribe. Service messages, such as invites, notifications you have turned on, and security or billing notices, are separate and are not marketing.

3. What we do not collect

• Your password.
• Anything typed into form fields on the pages you pin, and password or payment fields at all.
• Full card or bank account numbers.
• console.log output, request or response content, headers, or cookies from the pages you pin, and your time zone or location.
• Your source code. The build plugin adds attributes to your build and makes no network calls, and the GitHub app can only see repository names and metadata.
• Screenshots, unless a workspace’s admins have turned them on, and never of the full page, other tabs, or other windows.
• Any data about visitors to a site that carries the review badge but who are not reviewing. For them the badge makes no request, adds nothing to the page, and sets nothing in storage.
• Analytics on your customers’ pages. Nothing from PostHog runs in the badge, the extension’s page scripts, or the embedded thread drawer.

4. How we use your information, and our lawful bases

Under the GDPR and UK GDPR we rely on the following legal bases:

• To provide the Service (performance of a contract): running your account, organizations, and workspaces; storing and showing feedback and its evidence; anchoring pins to pages; delivering the notifications you have turned on; and running the integrations and agent connections you set up.
• To bill for paid plans (contract and legal obligation): charging for plans and seats, keeping invoices, and meeting tax and accounting duties.
• To classify and summarize feedback (contract): using AI to suggest a thread’s type and write a one-line summary. See “AI processing”.
• For page views and session replay (consent): only after you choose “Allow”, and you can withdraw that at any time.
• To secure, maintain, and improve the Service (legitimate interests): preventing abuse, rate limiting, fixing errors, and understanding usage through content-free usage events and cookieless visit counts on this website.
• To send product emails (legitimate interests or consent): telling you about Skyelight updates, which you can unsubscribe from at any time.
• To comply with the law and to establish, exercise, or defend legal claims.

Where we rely on legitimate interests, we have weighed those interests against your rights. You can object to this processing as described in “Your rights”.

5. AI processing

Skyelight uses two AI providers:

• TypeSafe (Jev) suggests a thread’s type while it is being written, from the text so far, the page title and path, and the workspace’s list of types.
• Anthropic (Claude) writes each thread’s one-line summary, and picks its type when TypeSafe cannot, from the thread’s text and related page details.

Screenshots and page context, including browser details and page problems, are never sent to either provider. We do not use your content to train AI models, and neither provider trains on what we send it under the terms we use. An organization’s admins can turn automatic classification off in Account settings, under Automation; while it is off, no thread is sent to Anthropic.

These features help sort feedback. They make no decisions with legal or similarly significant effects on anyone, and a suggested type can always be changed.

If you connect your own coding agent (such as Claude Code, Cursor, or ChatGPT), the threads it reads, including screenshots, are sent to that tool at your request. What happens to them there is governed by your agreement with its provider, not by us.

6. Cookies and local storage

We use cookies and browser storage to keep you signed in, to remember interface choices, to keep a reviewer signed in to the review badge on a site, and, only with your consent, for analytics and for measuring our ads. Without consent, visits to this website are counted without cookies. Our Cookie Policy lists each one.

7. How we share information

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We share it only as described here.

Service providers (sub-processors)

These providers help us run the Service. Each processes personal data only as needed to provide its service to us:

Inside your workspace

Everyone in a workspace can reach its threads and their evidence, whatever their role, though the app shows the captured page details only to owners, admins, and collaborators. A reviewer using the review badge on a site can reach only the one project that site belongs to. A guest can reach only their own threads in the one project they joined.

Tools you connect

When you connect Slack, Linear, GitHub, or a coding agent, we send it the data needed to do what you asked. Your use of those tools is governed by their own terms and privacy policies.

Legal, safety, and business transfers

We may disclose personal data if the law requires it, or to protect the rights, safety, and security of Skyelight, our users, or the public. If PLASTR LTD or Skyelight is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy.

8. International data transfers

We are based in the United States, and our providers process data in the United States and other countries outside the European Economic Area and the United Kingdom. Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (with the UK Addendum), the EU-US Data Privacy Framework where a provider is certified, or an adequacy decision. Contact us for more information about these safeguards.

9. How long we keep your data

When evidence expires, the screenshot file is deleted from storage, not just unlinked, and the page context goes with it. The thread itself remains and says its evidence expired.

Deleting your account removes your profile and all your workspace memberships. Feedback you wrote stays in the workspaces it was left in, because it belongs to those organizations and removing it would break their conversations. If you want that content removed too, ask the workspace’s owner or contact us at support@skyelight.ai, and we will handle your request as described below. If you cannot find a way to delete your account in the app, contact us and we will do it for you.

10. How we protect your data

We use technical and organizational measures designed to protect personal data, including:

• encryption of data in transit;
• encryption at rest of the access tokens we hold for Slack and Linear;
• storing API tokens and review badge sessions only as one-way hashes;
• short-lived access tokens for the review badge;
• role-based access checked on our servers for every request, with workspaces as the boundary;
• redaction of form fields in the browser, before upload;
• payment details handled by Stripe, never by our servers.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify you and any relevant authority where the law requires.

11. Your rights

Depending on where you live, you have rights over your personal data. If you are in the EEA or the UK, these include the rights to:

• access a copy of your personal data;
• correct inaccurate or incomplete data;
• erase your data (the “right to be forgotten”);
• restrict or object to certain processing, including processing based on legitimate interests;
• data portability;
• withdraw consent at any time where we rely on it, such as analytics (Account settings, under Profile) and product emails (the unsubscribe link); and
• lodge a complaint with your local data protection supervisory authority.

You can update your profile and notification preferences in your account settings. To exercise any other right, email support@skyelight.ai. We will respond within the time the law requires (generally one month). Where the request concerns content in an organization’s workspace, we may refer it to that organization, as the controller, and help it respond. We will not discriminate against you for exercising your rights.

United States privacy rights

Depending on your state (for example, California), you may have the right to know what personal data we collect and how we use it, to access, correct, and delete it, and to opt out of its sale or sharing. We do not sell personal data or share it for cross-context behavioral advertising. You can exercise these rights using the contact details above, and an authorized agent may make a request on your behalf.

12. Your responsibilities when capturing feedback

Organizations that use Skyelight decide what is captured on their pages. If you use the extension, add the review badge to a site, or turn on screenshots, you are responsible for:

• having the right and a lawful basis to capture the pages you pin, including any screenshots and page context;
• only adding the review badge to sites you control, and only allowing the addresses you mean to;
• marking any area that shows personal or sensitive information with data-skyelight-redact, and deciding whether screenshots should be on at all;
• telling the people who use your sites or products, where the law requires, that feedback including page content may be collected;
• only sharing a project’s guest code with people you mean to invite; and
• making sure your own privacy notices and lawful bases cover this processing.

13. Children

The Service is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you by email or in the app before the change takes effect.

15. Contact us

For any question about this Policy or your personal data, contact us at support@skyelight.ai. Our postal address is PLASTR LTD, doing business as Skyelight, 3916 Clock Pointe Trail, Suite 103, Stow, OH 44224, United States.