Skylet
Join Skylet

Skylet legal

Privacy Policy

What personal data Skylet collects, why we use it, who sees it, how long we keep it, and how you can access, correct or erase it.

Version of 23 October 2026

Draft details. The company and Grievance Officer details this page refers to are still being finalised and will appear here once published.

1.Who we are and what this notice covers

This notice explains what personal data Skylet collects, why, who sees it, how long we keep it and what you can do about it. Skylet decides why and how your personal data is used, which makes it the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000. It applies to the Skylet website and the Skylet Android app.

By creating an account you agree to this notice and to the Terms of Service. We record which version you accepted and when. You can withdraw your consent at any time by deleting your account (see “Your rights”); some features, such as Tap to connect and the optional private details, have their own switches.

2.What we collect

What you give us.

Account
Your name, handle, email address and password. The password is stored only as a salted one-way hash, never in readable form.
Profile
Bio, profile picture and cover picture (optional).
What you post and do
Posts, comments, likes, reshares, pictures and videos, follows, friend requests, blocks and mutes, hidden posts, and reports you file.
Messages
Direct and group messages you send, and who is in the conversation. Messages are stored as plain text and are not end-to-end encrypted (see “Messages” below).
Private details (optional)
State, city and year of birth, if you choose to enter them in Settings. They are never shown on your profile; they are used only to choose ads that may suit you.
Money matters
If you buy ads, API credit or a paid tick: billing name, address, state and GSTIN (for the tax invoice), and the amounts, invoices and payment references. For a tick application: your legal name, category, statement and any links you give as evidence.
When you write to us
Your email and what you tell us in a report, complaint or request.

What we collect automatically.

Sign-ins
Each sign-in session records the time, your IP address and your browser or device type. This is used to keep your account secure and to show you where you are signed in.
How you use Skylet
Which posts you see, how long they stay on screen, which you open, like, comment on or reshare, and who you follow. We use this to rank your “For you” feed and Flicks and to choose ads. We keep the raw events for 60 days, the feed logs for 30 days, and the learned interest scores for up to 90 days.
Security and limits
Counters that stop abuse, such as failed sign-ins in the last 15 minutes and requests per minute, tied to your account or IP address.
Tap to connect (Android, only if you switch it on)
A random short-lived code your phone broadcasts over Bluetooth, the codes it hears when you knock phones together, their signal strength, and a motion-sensor reading used only on your phone to feel the knock. We record who connected with whom, when and how, so abuse can be investigated. See “Tap to connect” below.

We do not collect your precise location, contacts, SMS, call logs or microphone. The app asks for photo access only when you choose a picture to post, and for “Nearby devices” (Bluetooth) only when you switch on Tap to connect. We do not use advertising or analytics SDKs from other companies, and we do not use the Android advertising ID.

From others. Other people may mention you, message you, report you or tag your handle. Our payment provider tells us whether a payment succeeded.

3.Why we use it

  • To run Skylet: create your account, show your profile and posts to the people you chose, deliver messages, notify you, search, and keep your feed relevant.
  • Safety and moderation: review reports, stop spam and abuse, enforce our rules and protect children and other users.
  • Ads: show promoted posts, choose them using the details above, count views and clicks, and charge and refund advertisers.
  • Payments and tax: take payments, issue GST invoices, keep records the law requires.
  • Legal duties: answer lawful orders and requests from courts and authorities and meet our obligations under the IT Rules and other laws.
  • Improving and securing Skylet: fix problems, measure how features perform and test ranking changes in aggregate.

We use your data on the basis of your consent given when you create an account and use the features, and for the purposes the DPDP Act allows without consent, such as complying with law and responding to emergencies. We do not sell your personal data, and we do not let advertisers see it. Some decisions are automatic (for example, spam limits and how posts are ranked), and none of them has a legal effect on you without a person being able to review it through a report or the Grievance Officer.

4.Messages

Messages are stored on our servers as plain text and are not end-to-end encrypted. We chose this so that abuse can be reported and lawful requests can be answered. Skylet staff cannot browse conversations. Staff can read a message only if someone has reported it, plus up to ten earlier messages as the reporter saw them (a snapshot taken when the report is made), and each such look is recorded in the audit log. We may also disclose messages when a court or authority lawfully requires it. When you delete a message its text is erased. A reported snapshot is kept for as long as it is needed for safety or legal reasons.

5.Tap to connect

Tap to connect is optional and off until you switch it on. While it is on and Skylet is open on screen, your phone asks our server for a random code (it has no name or number in it, and it is replaced every 15 minutes) and broadcasts it over Bluetooth Low Energy, and it watches the motion sensor for the jolt of two phones meeting. When it feels one it listens for about a second and a half and tells our server the strongest nearby code it heard. Our server connects two people only if each phone reports the other's code within a few seconds. Nothing about you is broadcast over the air except that random code. It stops when you leave the app or switch it off. We do not use location for this, and the motion reading never leaves your phone.

We keep a record of each connection (the two accounts, the time and what happened) for abuse investigations, and we tell both people. You can undo a connection for three minutes, and you can remove the friend or follow at any time. There is a daily limit on connections to stop abuse.

6.Who we share it with

  • Other people on Skylet, according to what you post and your audience settings: public posts and your public profile are visible to anyone, including people who are not signed in and search engines.
  • Service providers who help us run Skylet, only for that purpose: our hosting and infrastructure providers; Cloudflare, which carries our traffic, protects the site and provides the human check at sign-up; and Razorpay, which processes payments (it sees your payment details, we do not). When we add an email or SMS provider, it will receive your email address or phone number to send you messages, and we will update this notice.
  • Advertisers get totals only (views, clicks, follows), never your personal data.
  • Authorities, when a court or the Government lawfully requires it, to prevent or investigate offences, for child safety, or to protect people. We will help government agencies within the time the law sets.
  • A buyer of the business, if Skylet is ever sold or merged, who must keep to this notice.

Our providers and servers may be in India or in other countries. The DPDP Act allows transfers abroad except to countries the Government restricts, and we require our providers to protect your data.

7.Cookies and similar storage

On the website we use one essential cookie, skylet_session, which keeps you signed in (it is HttpOnly and only a hash of its value is stored on our side). Your light or dark theme choice is saved in your browser's local storage. The human check at sign-up is provided by Cloudflare and may set its own cookies. The Android app keeps your sign-in token in the phone's secure keystore. We use no advertising, analytics or tracking cookies.

8.Children

Skylet is only for people aged 18 or over. We do not knowingly collect data from children, and we do not track or target children with ads. If you believe a child is using Skylet, please tell the Grievance Officer and we will act.

9.How long we keep it

Your account and content
Until you delete your account. After you ask, your account is hidden at once and erased for good after 30 days unless you sign in again before then.
Sign-in records
While the account exists; they are deleted with it.
Usage events and feed logs
Raw events 60 days; ranking logs 30 days; learned interest scores up to 90 days; “already seen” lists 3 days.
Pictures and videos
Files nobody used are deleted within a day; files of a post you delete are removed about a week later; the rest go when you delete your account.
Messages
Until you delete them or your account. Deleted messages are erased.
Reports and evidence
Reports and snapshots of reported messages are kept as long as needed for safety, to deal with appeals and to meet legal duties; the free text you wrote in a report is removed when you delete your account.
Invoices, payments and wallet records
As long as tax and accounting law require (generally six to eight years). When your account is erased they stay but no longer point to a person who can be identified from the profile.
Backups
Copies in backups are removed as the backups expire. We do not restore erased accounts into the live service.

When your account is erased we delete your posts and the pictures and videos on them, your comments and reactions on others' posts (comments that others replied to remain as an empty placeholder), your follows, friendships, blocks, messages (the text is erased), notifications, usage records, sign-ins, API keys and private details, and your profile becomes an anonymous “Deleted account”. Your handle becomes free again.

10.How we protect it

Passwords are stored with a slow salted hash. Session tokens are stored only as hashes. Connections use HTTPS. Pictures are re-encoded and their hidden metadata (such as the location in a photo) is removed. Staff accounts require a second factor and every staff action is logged; staff see only what their role needs. No system is perfectly secure. If a breach affects your personal data we will tell you and the Data Protection Board of India as the law requires.

11.Your rights and how to use them

Under the DPDP Act you can:

  • Know what we hold and why. Download a copy in Settings → Your data → Download my data (website and Android app). It includes your profile, private details, posts, comments, likes, follows, friends, messages you sent, sign-in records, reports you filed, billing records, notifications and Tap history. It does not include other people's words.
  • Correct or update it. Edit your profile, private details and billing details in the app or on the website, or ask the Grievance Officer.
  • Have it erased. Delete your account in Settings or at skylet.in/delete-account. You cannot delete while you own a Page, have a running ad campaign or hold money in your ad wallet or API credit; the message tells you what to do first.
  • Withdraw consent. Switch off Tap to connect, remove your private details, or delete your account. This does not affect what we did before you withdrew.
  • Get your grievance heard. Write to the Grievance Officer (below). If you are not satisfied with our answer you may complain to the Data Protection Board of India.
  • Nominate someone to exercise these rights for you if you die or cannot act. Write to the Grievance Officer with the person's details.

We may need to confirm it is you before we act. We respond within the times on the Grievance Officer page.

12.Contact and changes

Questions, requests and complaints about your data: the Grievance Officer (details on the Grievance Officer page).

We may update this notice. When we make a meaningful change we will tell you in the app or on the website, and ask you to accept it again if the law requires. The version at the top shows which one you are reading.