Privacy Policy

Effective date: April 6, 2026 | Last updated: April 6, 2026

This Privacy Policy describes how Skipi, operated by Tymur Rudov ("we", "us"), collects, uses, and protects your personal data. We are committed to protecting your privacy and handling your data transparently.

1. Data Controller

Tymur Rudov
Tbilisi, Georgia
Email: info@tymur.org

2. Local-First Principle

Skipi is designed as a local-first application. This means:

By default, your documents and data are stored only on your device
No data is transmitted to our servers unless you explicitly use cloud features (sync, document packages)
You can use core features of Skipi without any internet connection
You control when and whether your data leaves your device

This architecture minimizes data collection by design.

3. What Data We Collect

3.1 Account Data (when you register)

Data	Purpose	Legal Basis (GDPR)
Email address	Authentication, notifications	Contract performance
Name	Display in application	Contract performance
Account type (seafarer/manager/vessel)	Provide appropriate features	Contract performance
Rank (seafarers)	Generate document framework	Contract performance
Company name (managers)	Multi-tenant organization	Contract performance
Password (hashed)	Authentication	Contract performance

3.2 Vessel Data (when you add a ship)

Data	Purpose	Legal Basis
Vessel name, IMO number, type, flag	Vessel identification, SOLAS framework	Contract performance
Document metadata (titles, expiry dates)	Certificate tracking	Contract performance

3.3 Uploaded Files (when you use cloud features)

Data	Purpose	Legal Basis
Document files (PDF, images, etc.)	Storage, package generation	Consent (you initiate the upload)
File metadata (name, size, upload date)	File management	Contract performance

3.4 Usage Data (automatic)

Data	Purpose	Legal Basis
IP address	Security, abuse prevention	Legitimate interest
Browser type, device info	Service compatibility	Legitimate interest
Package download counts	Feature functionality	Contract performance

3.5 Waitlist Data (landing page)

If you join our waitlist, we collect your email address via Formspree.io to notify you about the launch. You can request removal at any time.

4. What We Do NOT Collect

We do not read or analyze the contents of your uploaded documents (unless you opt in to AI analysis features)
We do not use tracking cookies for advertising
We do not sell or share your personal data with third parties for marketing
We do not build advertising profiles from your data
We do not collect data from your device beyond what you explicitly upload

5. How We Use Your Data

Provide the Service — account management, document storage, package generation, certificate tracking
Security — protect against unauthorized access, fraud, and abuse
Service improvement — anonymized, aggregated statistics (e.g., total number of packages created, not their contents)
Communication — service-related notifications (expiry reminders, account updates). No marketing without your consent.

6. Data Sharing

We share your data only in these limited circumstances:

Document packages — when you create a package, the included files are accessible to anyone with the package URL. This is initiated by you.
Service providers — we may use infrastructure providers (hosting, storage) who process data on our behalf under data processing agreements.
Legal requirements — if required by law, court order, or governmental authority.

We do not sell your data. We do not share your data with advertisers.

7. Data Storage and Security

Local data is stored on your device and protected by your device's security
Cloud data is encrypted in transit (TLS/HTTPS)
Passwords are hashed using bcrypt with salt
Session tokens are cryptographically signed with expiry
Document packages are automatically deleted upon expiry or download limit

8. Data Retention

Account data: retained while your account is active, deleted within 30 days of account deletion
Uploaded files: retained while your account is active, deleted within 30 days of account deletion or individual file deletion
Document packages: automatically deleted upon expiry or when download limit is reached
Anonymized statistics: retained indefinitely (cannot identify you)

9. Your Rights (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or a jurisdiction with similar data protection laws, you have the right to:

Access — request a copy of your personal data
Rectification — correct inaccurate personal data
Erasure — request deletion of your personal data ("right to be forgotten")
Portability — receive your data in a structured, machine-readable format
Restriction — request restriction of processing
Objection — object to processing based on legitimate interest
Withdraw consent — where processing is based on consent

To exercise these rights, contact us at info@tymur.org. We will respond within 30 days.

10. International Transfers

Your data may be processed in countries outside your country of residence. When transferring data outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR requirements.

11. Children

Skipi is not intended for use by persons under 18 years of age. We do not knowingly collect data from minors.

12. AI Features

Skipi may offer optional AI-powered document analysis features. These features:

Are opt-in only — your documents are not analyzed unless you explicitly request it
Process documents solely to provide analysis results to you
Do not use your documents to train AI models without your explicit consent

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email at least 14 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

14. Contact

For privacy-related questions or to exercise your rights:
Tymur Rudov
Email: info@tymur.org
Website: skipi.app