Privacy policy

Who we are

SkyCISA is operated by its founder, Anton Krylov, reachable at the address below. We are the controller of the personal data described here.

Browsing the public site

The atlas, the news feeds, the lookup and grading tools and the search can be used without an account. For every request our hosting and our content network (Cloudflare) record the usual server log: the IP address, the time, the page, the browser's user-agent string and the referrer. These logs protect the service against abuse and are kept for up to 30 days.

The site sets no advertising or analytics cookies and loads no third-party trackers. Usage metrics we keep are aggregate (which routes are called, how fast, from which network region) and contain no identifier of a person.

Signing in

The inbox needs an account, created the first time you sign in. You can sign in with a one-time code sent to your e-mail address, or with a Google account.

• E-mail sign-in: we store your e-mail address and send a six-digit code to it. The code is valid for ten minutes and is stored only as a salted hash.
• Google sign-in: Google tells us your e-mail address, whether it is verified, and your display name (the openid, email and profile scopes). We request nothing else and we cannot read your Google data. We store the address, the name and a pseudonymous identifier derived from the address.
• A session cookie (__Host-ha_session) keeps you signed in for up to 30 days. It is strictly necessary and is not used for tracking. Signing out removes the session at once.
• To keep bots out, the sign-in form uses Cloudflare Turnstile, which may evaluate your browser and IP address; sign-in attempts are rate-limited per address.

What the inbox keeps for you

Everything the inbox remembers is there to do what you asked it to do:

• Your personal workspace and, if you join one, the organisations you are a member of.
• The sources you show or hide and follow, the stories you mark read, and the watches (saved queries) you create.
• Notification addresses you add, kept encrypted at rest, and your notification preferences (mode, time zone, quiet hours, weekly digest).
• An audit trail of administrative actions on your account (who did what, when), visible to the platform administrator.

E-mail we send

We send sign-in codes, confirmation codes for administrators, address verification messages, and the notifications you subscribed to (watch matches and weekly digests). Every notification message carries a link to switch it off. We send no marketing mail.

Where data is kept and who processes it

Account data and everything the inbox keeps for you live in a PostgreSQL database on a server operated for us by HOSTKEY B.V. in Amsterdam, the Netherlands. Encrypted database backups are stored in Cloudflare R2 (EU jurisdiction) and deleted after 30 days. The processors that handle data on our behalf are:

• Cloudflare, Inc. — content network, DNS, the sign-in service at the edge, short-lived caches, bot protection (Turnstile) and backup storage.
• Amazon Web Services (Amazon SES, EU-Frankfurt region) — delivery of the e-mail described above.
• Google LLC — only if you choose to sign in with Google; the sign-in is governed by Google's own privacy policy.
• HOSTKEY B.V. — the server in Amsterdam that runs the database and the application.

Legal bases

We process your data to provide the service you signed up for (performance of a contract), to keep the service secure and available (our legitimate interest), and for anything else only with your consent, which you can withdraw at any time.

Retention

Sign-in codes expire after ten minutes. Sessions end after 30 days or when you sign out. Server logs are kept for up to 30 days and backups for 30 days. Account data is kept while your account exists; when you ask us to delete it, it is removed from the live database at once and leaves the backups within 30 days.

Your rights

You can ask for a copy of the personal data we hold about you, have it corrected or deleted, restrict or object to its processing, and receive it in a portable form. Write to the address below from the e-mail address of your account and we will answer within 30 days. If you are in the European Economic Area you may also complain to your data protection authority.

Children

The service is not directed at children under 16 and we do not knowingly collect their data.

Changes

When this policy changes materially we announce it on this page and, for signed-in people, in the inbox. The date of the current version is shown above.