Draft for review: not yet in force.
Privacy policy
In short
- We keep only what Skillr needs to work: your account, your profile, the jobs and offers you post, the ratings, and where things are.
- Other people see your location only approximately, unless you choose to show the exact place.
- We don't sell your data, show ads, or use analytics or trackers in the app.
- You can delete your account in the app at any time (Settings → Account). Your jobs and ratings stay, but no longer point to you.
- Skillr is for adults only (18 and over).
1. Who we are
Skillr is an app that helps people in Romania find someone nearby to do a job, and helps people with skills find work near them.
The controller of your personal data (the one who decides how it is used) is [CONTROLLER: full name or company name, legal form, registration number, address].
For anything about your data, write to [email protected].
2. What we keep, and why
Each kind of data below says why we need it and the legal basis for using it under the GDPR (the EU General Data Protection Regulation). "Contract" means we need it to give you the service you signed up for. "Legitimate interest" means we need it to keep Skillr safe and working, in a way you would reasonably expect.
Your account
Your email address, your name, the language you use the app in, and your password. We never store the password itself, only a one-way scrambled form of it (a hash) that can check it but can't be turned back into it.
If you sign in with Google, we receive from Google your Google account's id, your name and your email address, and we keep them instead of a password. Google learns that you signed in to Skillr.
When you create your account, we record which version of these terms and this policy you accepted, and when.
To confirm that your email address is yours, and if you ask to reset your password, we email you a 6-digit code. We keep only a scrambled form of the code, and only until it is used or stops working (30 minutes for confirming your email, 15 for a password reset), and we record when your address was confirmed. Accounts made with Google count as confirmed. Until it is confirmed, you can't post a job or send an offer.
Why: to give you an account and let you sign in, and so everyone on Skillr can be reached. Basis: contract.
Your profile
What you choose to add: a photo, the skills you offer or look for, whether you offer your skills at all, your service area (a place and a distance), whether you are available or away until a date, and links to your Instagram, Facebook or LinkedIn profiles. Your level and badges are worked out from the jobs you closed and the ratings you received.
The qualifications you choose to declare (degrees, courses, authorisations): what they are, their names, who issued them, the year and the skills they support. Skillr doesn't check them: others see them as declared by you, only while you offer your skills, and they don't count towards your level or badges. You can import them from a LinkedIn file: it is read on your phone, and only your schools, degrees and certifications are kept; your notes, activities and licence numbers are never kept or sent, and nothing is sent until you choose what to add.
Why: so others can find you and decide whether to work with you. Basis: contract.
Jobs and offers
When you post a job: what it is (skills, description, photos), where it is, when it is needed, and what happens to it (offers, the one you accepted, the completion code, whether the payment was marked as received, whether it was cancelled or expired). When you send an offer: your price and your message.
Why: this is what Skillr does. Basis: contract.
Messages
You can write to another person about a job, and, when a provider allows it, about no particular job. Messages are stored on our server, encrypted while they travel and where they are stored, but not end-to-end: we could read them, and we do so only when a message is reported to us. They never appear in notifications, emails or our logs. If you edit or delete a message, we keep the earlier versions so reports can be checked, until the message is deleted. Each of you has your own copy of a chat. Messages about a job, with every version, are deleted 90 days after the conversation about that job closes. Other messages: a chat with no new message for 30 days, and no job in it that still takes messages, is marked old; each of you can keep your copy for another 30 days, as often as you like, or remove it. A copy that isn't kept is removed 30 days after the chat became old, at the earliest 60 days after the last message. A message is deleted from our servers once neither of you still has it. Deleting your account deletes every message in your conversations, both sides', except reported messages still under review, kept at most 30 days. If you type an address in a message, it is kept like any other message.
Why: so you can agree the details of a job, or ask a provider about their work before you have one. Basis: contract.
Ratings
After a job, both sides rate each other with stars and an optional comment. We show the ratings you received, with their averages, on your profile.
Why: ratings are part of the service and help people trust each other. Basis: contract.
Reports
If you report someone's comment, message or qualification, we keep the reason you chose and the note you added, so we can review it.
Why: to keep Skillr safe. Basis: legitimate interest.
Feedback and messages to us
When you send feedback from the app, we keep your message with the app's version, the screen you sent it from and your language. The Skillr team reads every message and may answer you by email, at your account's email address. Emails you send to [email protected] reach the same team.
Why: to answer you and improve the app. Basis: legitimate interest.
Notifications
The app keeps a list of updates about your jobs (for example, a new offer). If you allow push notifications, we keep an id of the app's installation on your phone (from Google's Firebase), linked to your sign-in on that phone, and which kinds of notifications you turned off. A push only says what kind of update it is and which job it is about; names and texts are not in it.
Why: to tell you when something happens on your jobs. Basis: contract. You can turn push notifications off in Settings → Notifications or in Android's settings.
Security and sign-in
A record of each phone you are signed in on (at most 3), the day you last used the app, and failed sign-in attempts, which we count by a one-way scrambled form of the email address or Google account, not the address itself.
Why: to keep you signed in, end sessions you no longer use, and stop password guessing. Basis: legitimate interest.
Skill names we don't know yet
When you add skills from a list you paste or a LinkedIn file, names that match nothing in our list are counted without any link to you, so we can improve the list.
What we don't collect
We don't ask for your date of birth, phone number, ID documents or bank details, we don't read your contacts, and we don't track your location in the background.
3. Your location
- If you allow it, the app uses your phone's location while you use it: to show what is near you and to suggest where a job is. Android asks you first, and you can say no; you can then pick places on the map yourself.
- We store your profile's place and each job's place exactly. Other people see them only rounded to an area whose size you choose, from 100 m to 2 km (500 m unless you change it), or exactly if you choose "Exact".
- When you accept an offer, you can choose to show the job's exact place to that provider only.
- Locations are never put in web addresses or in our logs.
- The map's images come from Geoapify (see section 5), which sees your phone's internet address and which area of the map you look at.
4. Who sees your data
Other Skillr users
They see your name, photo, ratings with their comments, levels and badges, the skills you choose to show, your links and whether you are away. As a provider, they see your area approximately; for your jobs, the description, photos, when it is needed and the approximate place. A seeker sees the price and message of the offer you sent them. Your email address is never shown to other users.
The Skillr team
Only as needed to run Skillr: to fix problems, review reports and answer your messages.
Service providers
The companies in section 5, which handle data for us and only on our instructions.
Authorities
Only when the law requires it.
We don't sell your data, and we don't share it for advertising.
5. Service providers
| Who | What they do for us | Where |
|---|---|---|
| Cloudflare, Inc. | Runs our domain and the secure connection between the app and our server (so the traffic, including sign-in, passes through it encrypted), forwards emails sent to [email protected], and hosts this website. | Worldwide network, including the USA |
| Google (Google Ireland Limited and Google LLC) | Sign in with Google, if you use it; push notifications through Firebase Cloud Messaging (your phone's installation id, and when a push is sent); the mailbox where our support emails arrive. | EU and the USA |
| Geoapify | The map's images. It keeps the details of map requests for at most 24 hours. | EU (Cyprus) |
| Amazon Web Services EMEA SARL (Amazon SES) | Sends the emails Skillr sends: the codes for confirming your email address and resetting your password, and your feedback to our team (with your email address, so we can answer you). | EU (Frankfurt, Germany) |
Our own server and its database run in the European Union (Romania), and only we operate them.
6. Data outside the EU
Cloudflare and Google may handle some data in the USA. They are covered by the EU-US Data Privacy Framework (an EU adequacy decision) and by the European Commission's standard contractual clauses, which require them to protect it as the GDPR does.
7. How long we keep it
| Data | How long |
|---|---|
| Your account and profile | While you have your account. |
| After "Delete account" | Anonymised at once (see below). |
| After "Deactivate account" | Hidden at once and kept, so everything comes back if you sign in again; anonymised after 12 months if you don't. |
| Your sign-in on a phone | Ends 90 days after you last used the app on it, or when you sign out. |
| Push notification data | Removed when the sign-in on that phone ends. |
| Updates in the app (notifications) | Deleted 30 days after you read them. |
| Failed sign-in attempts | About 15 minutes, then deleted within the hour. |
| Codes we email you | Until used, or 30 minutes (15 for a password reset); then deleted within hours. |
| Photos you uploaded but never used | Deleted after one day. |
| Feedback you send from the app | While you have your account. |
| Emails with the Skillr team | [12 months after the last message] |
| Reports | As long as needed to review them; the note is cleared when the account of the person who reported, or of the person reported, is deleted. |
| Messages about a job | Deleted, with every version, 90 days after the conversation about that job ends, or when either of you deletes their account; a reported message still under review is kept at most 30 days longer. |
| Messages about no particular job | Your copy is removed when you remove it, or 30 days after the chat became old (no new message for 30 days), unless you keep it for 30 more days; a message is deleted once neither of you still has it, or when either of you deletes their account; a reported message still under review is kept at most 30 days longer. |
| Backups of the database | Up to 5 weeks, then overwritten. |
What "anonymised" means
When you delete your account, or a deactivated account reaches 12 months, we remove everything that identifies you: your name, email, password, photo, links, saved place, skills, qualifications, sign-ins, notifications and feedback. The texts you wrote (job descriptions, offer messages, rating comments) are cleared, and so are the texts others wrote to or about you there. Your job photos are deleted within the hour.
What stays, for statistics and so other people's history still adds up: the jobs (their kind, an area of about 2 km instead of the exact place, prices, dates and what happened), the prices of offers, and the star scores of ratings, all shown as "Deleted user". The ratings you received keep counting in the averages they are part of. None of this points to you any more.
Two things to know. While an account is only deactivated, its photo is no longer shown anywhere, but someone who already has the photo's address can still open it until the account is anonymised. And a deleted user keeps a random id, so someone could tell that two old jobs had the same, now anonymous, person on the other side.
A job in progress, or a rating you still owe, stops you from leaving until it is finished or cancelled; the app lists which ones. If you are stuck, write to [email protected] and we'll help.
Deleted data stays in our database backups until they are overwritten, at most 5 weeks. If we ever have to restore a backup, we delete again the accounts deleted since it was made.
Skillr is in a test phase. Accounts and data from the test phase will be deleted before Skillr opens to the public.
8. Your rights
Under the GDPR you can:
- see the data we hold about you and get a copy of it;
- correct it: most of it you can change yourself, in Profile and Settings;
- delete it: Settings → Account → Delete account, or write to us;
- restrict or object to how we use it, where we rely on legitimate interest;
- take it with you, in a common format;
- withdraw a permission you gave on your phone (location, notifications) at any time, in Android's settings;
- complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro). We'd like the chance to fix it first, so please write to us too.
To use any of these rights, write to [email protected] from your account's email address. We answer within one month. We may ask you to confirm it is you before we act.
9. How we protect it
The app talks to our server only over encrypted connections. Passwords are stored as hashes. Your sign-in is kept encrypted on your phone, and the access it gives lasts only minutes before it is renewed. Backups are encrypted. Only the people who run Skillr can reach the server.
10. Adults only
Skillr is for people aged 18 and over, because jobs are agreements between people, often paid in cash. We don't knowingly keep data about anyone younger. If we learn that someone under 18 has an account, we close it and anonymise it.
11. Automatic decisions
Your level and your badges are worked out automatically from your closed jobs and ratings, and providers are listed by distance, with those who are away last. None of this has legal effects on you, and we don't build profiles of you for advertising.
12. Changes to this policy
If we change this policy in a way that matters to you, we publish the new version here, raise its version number, and the app asks you to read and accept it before you continue. The version and date are at the top of this page.
13. Contact
Questions, requests or complaints about your data: [email protected].
[CONTROLLER: full name or company name, legal form, registration number, address]