Privacy Policy

1. Identity and contact details of the data controller

The data controller responsible under the General Data Protection Regulation ("GDPR") of the European Union and other data protection regulations is the operator of Skrubly. Privacy contact: hello@skrubly.com.

2. What does this Privacy Policy cover?

This Privacy Policy outlines how we collect, use, and disclose (in other words — how we process) personal information of users of the Services. For EU users, "personal information" should be understood as "personal data" within the meaning of the GDPR.

Please also see our Terms and Conditions, which apply to your access and use of the Services. Unless expressly stated, this Privacy Policy does not apply to any third-party practices, websites, or services, whether or not referenced in our Services (including TikTok and our payment provider). Each third party has its own privacy policies, which you should review before using them.

3. Your files are processed on your device — not by us

This is the most important thing to understand about Skrubly: the Metadata Cleaner runs entirely inside your web browser. When you drop an image or video into the cleaner, the file is read, analyzed, and re-encoded locally on your device. Your files are never uploaded to, stored on, transmitted through, or visible to our servers — at any point, in any form.

Because we never receive your files, we cannot access, recover, share, or lose them. When you close the browser tab, all traces of the processing are gone. This is privacy by design and by default.

4. How and why do we collect personal information?

Account information. When you create an account we collect your email address and a password (stored as a secure hash). If you log in via a third-party provider (e.g. Google), we receive the identifiers that provider shares based on your settings with them.

TikTok downloads. When you paste a TikTok link, that link (not the video file) is sent to our server and to a third-party download provider in order to locate a downloadable version of the video. We do not permanently store the videos you download or the links you paste beyond short-term operational logs.

Transactions. When you subscribe, our payment provider collects your billing details. We do not collect or store credit card numbers — all payment information is collected and processed by Lemon Squeezy, LLC as Merchant of Record. You can review their privacy policy at lemonsqueezy.com/privacy.

Device and usage information. Like most websites, we automatically collect routine technical information — IP address, browser type, operating system, pages visited — through cookies and similar technologies, described below.

Communications. If you contact us by email or a contact form, we collect the information you include so we can respond.

You are responsible for the accuracy of the information you submit.

5. How do we use your personal information?

We use personal information for business purposes: to provide, maintain, and improve the Services; to create and manage your account; to process subscriptions and payments; to enforce free-tier limits; to respond to your communications; and for security, fraud prevention, debugging, and auditing.

Legal bases under the GDPR: performance of a contract (providing the Services you signed up for), our legitimate interests (improving and securing the Services, growing our business), compliance with legal obligations (tax and accounting), and your consent where required (e.g. marketing emails, non-essential cookies). You may withdraw consent at any time without affecting prior lawful processing.

We may use aggregated, de-identified, or anonymized data (which does not identify you) for analytics and product decisions.

We do not use automated decision-making that produces legal or similarly significant effects on you.

6. When do we disclose personal information?

Service providers and contractors. We share information with providers that help us operate the Services — hosting (Vercel), database (Neon), payment processing (Lemon Squeezy as Merchant of Record), the TikTok download provider (which receives only the video link, never your identity), and analytics. They act as our processors and may only use your information to provide services to us.

Company transactions. We may share information as part of a merger, acquisition, sale of assets, or similar change of control, and with affiliated companies that comply with this Privacy Policy.

Legal process and protection. We may disclose information to comply with legal obligations — responding to government requests, court orders, and law enforcement inquiries — or where necessary to investigate, prevent, or respond to fraud, security incidents, or violations of our Terms.

Consent. We may disclose information as requested or consented to by you.

We do NOT sell personal information, and we do not share your files (we never have them — see section 3).

7. How do we use cookies and similar technologies?

We use a small set of cookies and browser-storage technologies: essential cookies (login sessions, security), a local counter in your browser that tracks free-tier usage, and — if enabled — privacy-respecting analytics cookies to understand how the Services are used.

If we run advertising campaigns, third-party marketing cookies (e.g. TikTok Pixel) may be used to measure their effectiveness; where required by law, these are only set with your consent.

You can change cookie settings in your browser at any time. For more information and opt-out tools, see allaboutcookies.org. Blocking essential cookies may prevent parts of the Services from working.

8. Do we sell personal information?

No, we do not sell personal information.

9. How do we protect and transfer information?

We implement appropriate technical and organizational security measures: encryption in transit (TLS), password hashing, access controls, and the structural safeguard that your media files are never transmitted to us at all. However, no electronic transmission or storage technology can be guaranteed 100% secure, so we cannot promise that unauthorized third parties will never defeat our security. You should access the Services within a secure environment.

International transfers. We are established in the EU. Some of our providers (e.g. hosting, payments) may process data in the United States or other countries outside the EU/EEA. Where that happens, we rely on lawful transfer mechanisms such as the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

10. How long do we retain information?

We retain personal information only as long as necessary to fulfill the purposes in this Privacy Policy, unless a longer period is required or permitted by law (e.g. tax records for transactions).

Criteria we use: (a) whether you have an open account or active subscription, (b) legal retention obligations, and (c) litigation or investigation requirements. Files you process with the Metadata Cleaner are never retained because they never reach us.

We may delete inactive free accounts after an extended period of inactivity; we will notify you at your registered email before doing so.

11. What are your privacy rights?

Subject to applicable law, you have the right to: access the personal information we hold about you; receive a portable copy; correct inaccurate information; delete your information; restrict or object to certain processing; withdraw consent at any time; and opt out of marketing communications (via the unsubscribe link in each email or by contacting us).

To exercise any right, email hello@skrubly.com with the address associated with your account so we can verify your request. If an authorized agent acts on your behalf, they should include their own contact details. We may deny requests we cannot verify or where the law requires us to retain data; if we deny a request in whole or part, we will explain why, and you may appeal by replying to our decision.

EU/EEA residents: you also have the right to lodge a complaint with your local supervisory authority. In Spain this is the Agencia Española de Protección de Datos (aepd.es); a list of all EU regulators is available at edpb.europa.eu.

California residents: the CCPA/CPRA may grant you additional rights (to know, delete, correct, and opt out of sale/sharing). We do not sell or share personal information as defined by the CCPA. We honor recognized global opt-out signals such as the Global Privacy Control (GPC) where verifiable.

12. Do we collect information about children?

No. The Services are not directed at children, and we do not knowingly collect personal information from children under 13 (or the higher minimum age in your jurisdiction). If we learn we have collected such information, we will delete it. You must be at least 18 to create an account.

13. Sensitive information

We do not request or knowingly collect sensitive personal information (health data, government IDs, biometric data, etc.). Do not include such information in communications with us. Files you clean locally may contain anything — but as explained in section 3, we never see them.

14. Do Not Track (DNT) signals

Our Services do not currently respond to browser DNT requests, but we do honor recognized global opt-out preference signals such as the Global Privacy Control (GPC) where required by law.

15. How do we update this Privacy Policy?

We will update this Privacy Policy when our practices change or as required by law. Each time you use the Services, the current version applies. For material changes we will provide notice on the website or by email.

16. How can you contact us?

Email: hello@skrubly.com. We are happy to answer any questions about this Privacy Policy or our privacy practices.