SkyyCast — Privacy Policy

Who operates SkyyCast

SkyyCast is operated by Sangay Choda as an individually operated business (sole proprietorship), based in Bhutan. This policy applies to anyone who creates a SkyyCast account, connects a Bluesky account, or otherwise uses the product.

Information we collect

SkyyCast collects only what's needed to operate the product:

Account information. When you sign in with your Google account (SkyyCast uses Google sign-in as its authentication provider), SkyyCast asks Google to confirm your identity and to share your email address and basic profile, but keeps only your Google account identifier and your verified email address.
Bluesky connection information. When you connect a Bluesky account, we store your Bluesky handle and DID (decentralized identifier), and the authentication tokens needed to publish on your behalf — either through Bluesky's official OAuth flow or, for legacy connections, an app password you provide. These credentials are stored so SkyyCast can publish scheduled posts and read your post performance without asking you to sign in again every time.
Content you create. The text, images, videos, and alt text of posts you write and schedule through SkyyCast, along with their scheduled time, status (pending, published, or failed), and, when applicable, the error message explaining why a post failed.
Subscription and billing information. If you upgrade to Pro, our Merchant of Record, Paddle, handles your checkout and stores your payment details. SkyyCast itself never receives or stores your card number or other payment credentials — we only receive and store your Paddle customer ID, subscription ID, plan, subscription status, and billing period dates, which we use to determine whether your account has Pro access. If you cancel Pro, you may optionally choose a reason and add free-text comments; if you do, we store them so we can understand why people cancel and improve SkyyCast.
Post performance data and post history. For posts published through SkyyCast and, where you've connected your account, your other posts on your own Bluesky account, we fetch engagement counts — likes, reposts, replies, and quotes — directly from Bluesky's own public API. To power your analytics and post history, SkyyCast stores a copy of those posts' text along with their identifiers, publication times, and engagement counts, so you can review how your content performed inside SkyyCast.
Technical information. Standard request logs generated by our hosting provider, and application logs used to diagnose failed scheduling or publishing attempts. These logs are written to exclude authentication tokens, passwords, and other credentials.

Cookies and local storage

SkyyCast's own use of cookies and local storage is limited to operating the product, not advertising or cross-site tracking. Your signed-in session is maintained through a secure, http-only session cookie (named skyy_session) that SkyyCast sets after you sign in with Google. While you sign in with Google or authorize a Bluesky connection, SkyyCast also sets a secure, http-only cookie that is used only to complete and protect that step (skyy_oauth for Google sign-in and bsky_oauth_flow for Bluesky authorization); these expire within about ten minutes. SkyyCast also uses local storage for a small amount of purely functional data — such as remembering your Bluesky connection status and whether you've completed the onboarding walkthrough — so the app doesn't need to reload that information from the server every time you open it. Local storage also records your advertising choice (sc_ad_consent_v1), if you make one (see "Advertising" below).

Third-party resources on our pages

When you visit SkyyCast's pages, your browser loads some resources directly from third-party providers. All public pages load fonts from Google Fonts. The home page and the signed-in app also load the Tailwind CSS script from the Tailwind CSS CDN (cdn.tailwindcss.com) and Paddle's checkout script (Paddle.js) from Paddle's CDN (cdn.paddle.com). As with any web request, these requests let the provider receive your IP address and standard browser and request information, such as your browser type and the page that requested the resource. Each provider handles that information under its own privacy policy.

How we use this information

We use the information above only to operate SkyyCast, specifically to:

Authenticate you and keep your account secure.
Publish your scheduled posts to Bluesky at the time you chose.
Show you your queue, publishing history, and post performance.
Determine whether your account has Free or Pro access, and enforce the Free plan's limit of 15 successful publishes per calendar month.
Process your subscription through Paddle and keep your subscription status up to date.
Diagnose and fix failed scheduling or publishing attempts.

We do not sell your data, and we do not use your scheduled post content or Bluesky connection for advertising or profiling.

Third-party service providers

SkyyCast is built on a small number of third-party services, each handling a specific part of the product:

Bluesky / the AT Protocol — to publish your posts and read post performance data, using the connection you authorize.
Paddle — to process Pro subscription payments. Paddle acts as our Merchant of Record and handles payment processing, billing, and payment-related information. Your payment details are handled by Paddle, not by SkyyCast.
Google — our authentication provider; you sign in with your Google account and we receive your verified email address and Google account identifier. Google Fonts is also used to load fonts on our pages (see "Third-party resources on our pages" above).
Render — our hosting and database provider, which serves the application, processes requests, and hosts the PostgreSQL database where your account, connection, and scheduled post data is stored.
Cloudflare (R2) — our media storage provider, where images and videos you attach to scheduled posts are stored.

Each of these providers has its own privacy policy governing how they handle data on our behalf. SkyyCast's blog content is managed through a separate content system (Sanity) used only to publish articles like the ones on this site — it does not process or store any of your account, connection, or scheduled-post data.

Data sharing

We share information only with the third-party service providers listed above, and only as needed for them to perform their role — for example, sharing your Bluesky authorization with Bluesky's own API to publish your posts, or your billing details with Paddle to process a subscription. We do not sell your information, and we do not share it with third parties for their own marketing purposes.

Advertising

SkyyCast shows display advertisements from Adcash and Adsterra on its public pages — the blog and the public Books catalog and book pages — clearly labeled "Advertisement" and placed apart from navigation, headings, and buttons; a long article may show a second Adcash banner further down the page, an Adcash banner may appear in the sidebar alongside "Related reading" on desktop, and blog articles carry one Adsterra banner further down the page, kept separate from any Adcash ad. Adsterra also shows a 300x250 banner and a native banner on the public Books catalog and book pages, a native banner at the top of the blog article sidebar, and a small floating "social bar" on blog pages, all served by Adsterra's own scripts. Blog articles may also show an Adcash "in-page push" notification-style ad, rendered by Adcash's own script rather than a fixed container. SkyyCast does not run Adcash's pop-under format. Ads are never shown inside your signed-in dashboard, and never on the Books checkout, order-download, or any other page involved in delivering a purchased file. SkyyCast does not use your account, your scheduled post content, or your Bluesky connection for ad targeting.

How advertising choices work depends on where you appear to be connecting from. SkyyCast looks up your approximate country from the connection to our website (through our CDN provider, Cloudflare, from the same website address, with no additional geolocation service); the country is used only in your browser to pick the behavior below for that page view, and SkyyCast does not store it or send it to Adcash or Adsterra. This is SkyyCast's own policy. It is not a statement that consent is or is not legally required in any particular country, and it may change.

European Economic Area, United Kingdom, Switzerland, and Brazil. A "Privacy & Advertising" banner asks for your choice first. Neither Adcash's nor Adsterra's script is loaded, and no advertising cookie, pixel, or similar technology from them is set by SkyyCast's pages, unless and until you choose Accept. Reject, or simply not choosing, keeps both off; continuing to browse is never treated as consent.
Everywhere else. No initial banner is shown and ads may load, unless you have chosen Reject or your browser is sending a Global Privacy Control (GPC) signal.
Region cannot be determined. If we cannot reliably determine your country, we treat it like the first case: the banner is shown and no advertising loads until you accept.

Global Privacy Control. If your browser sends a GPC signal (navigator.globalPrivacyControl), SkyyCast treats it as an opt-out of advertising: outside the regions above, no Adcash or Adsterra advertising is loaded. In the regions above, the consent choice described there still applies, and an explicit Accept you have made is honored.

Privacy Choices. Every public page that loads this control has a "Privacy Choices" link in the footer, and the button below does the same thing: it reopens the advertising choice on any page, whether or not a banner was shown first. Choosing Reject clears the ad content on the page right away without a reload and stops further ad scripts from loading. Cookies an ad provider already set cannot be deleted by SkyyCast; you can remove them in your browser settings. Your choice is remembered in your browser's local storage under the name sc_ad_consent_v1 so it does not have to be repeated on every page.

Your current choice: No choice saved.

Adcash and Adsterra are independent third parties. When ads are loaded they, and their advertising partners, may independently collect and process information (such as your IP address, device and browser details, and cookie or similar identifiers) under their own policies, which we do not control.

When Adsterra ads load, Adsterra and its advertising partners may use cookies, pixels, web beacons, or similar technologies on the pages where its ads appear, to serve ads and measure ad performance. Adsterra describes its use of cookies at adsterra.com/cookies.

When Adcash ads load, Adcash and its advertising partners may use cookies, pixels, web beacons, or similar technologies on these pages to serve ads and measure ad performance. Adcash describes its use of cookies and similar technologies at adcash.com/legal.

SkyyCast is also preparing to show advertising from Google AdSense on these same public pages; that has not been enabled yet. Once it is, Google and its advertising partners will likewise use cookies and similar technologies to serve ads and measure their performance, and may show personalized ads based on your prior visits to this and other websites, subject to the same advertising consent choice described above. You can review and control the ad personalization Google applies to you at myadcenter.google.com. Google describes how it uses cookies in advertising at policies.google.com/technologies/ads, and how it uses information from sites that use its services at policies.google.com/technologies/partner-sites. You can also opt out of personalized advertising from many other vendors at aboutads.info/choices.

Data retention and deletion

We retain your account, connection, and subscription data for as long as your account is active, so the product keeps working the way you'd expect.

Posts you schedule stay in your queue until they publish, fail, or you remove them. After a post has published and its performance record has been saved to your analytics history, its queue record may be removed automatically once the calendar month in which it published has ended (your most recent published posts stay in your queue history longer). The post text, identifiers, publication times, and engagement counts kept in your analytics history are retained for as long as your account is active, unless you ask us to delete them.

If you disconnect your Bluesky account, we clear the Bluesky credentials we stored (and, where possible, revoke the tokens with Bluesky) and stop using that connection to publish or fetch data on your behalf. Disconnecting does not delete your existing post history or analytics data; those remain under the retention rules above.

Images and videos you attach to a post are deleted from storage roughly an hour after the post publishes successfully. Media for a post that has not published stays available so you can schedule or retry it; a video for a post that failed is kept only for a limited period, and video uploads that were never attached to a post are removed automatically.

To request deletion of your account and associated data, contact us at connect@skyycast.com. We don't yet offer a fully self-service account-deletion option inside the product.

How we protect your data

Access to your account data is restricted to your own signed-in session — other SkyyCast users cannot see your scheduled posts, Bluesky connection, or subscription details. Bluesky authentication tokens and Paddle webhook communications are never exposed to the browser or logged in readable form. The background worker that publishes scheduled posts, collects post performance data, and cleans up expired media runs as a separate component with its own database role, distinct from the role used for requests made during your signed-in session (which are restricted to your own account's data), and its credentials are never sent to the browser. No system can guarantee absolute security, but we design SkyyCast to limit what data is exposed and to whom.

Your rights

Depending on where you live, you may have rights to access, correct, or delete the personal information we hold about you. To exercise any of these rights, contact us at connect@skyycast.com and we'll respond as required by applicable law.

Children's privacy

SkyyCast is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at connect@skyycast.com so we can address it.

International data

SkyyCast is operated from Bhutan. The third-party providers we rely on — including Google, Render, Cloudflare, Paddle, and Bluesky — may store or process data in other countries as part of providing their services to us. By using SkyyCast, you understand that your information may be processed outside of your own country.

Changes to this policy

If we make a material change to how we collect or use your data, we'll update this page and change the "Last updated" date above.

Contact

Questions about this policy or your data can be sent to connect@skyycast.com.

How SkyyCast handles your data