Privacy Policy
Last updated: September 11, 2026
Who operates Skratchpad
Skratchpad is operated by Alexander Jacobsen, who is the controller of the personal information described here. Contact alexmj044@gmail.com for privacy questions, account deletion, or requests to exercise your rights.
Information we process
When you sign in with Google, we receive your account identifier, email address, name, and profile image if provided. We store account and session records, workspace details, agent connections and permissions, and deployment records. We also process code and files you upload, build logs, deployment and claim links, and technical information such as IP addresses and request logs needed to operate and protect the service. Messages you send to support are processed to answer your request.
How we use information
We use account, workspace, connection, and deployment information to provide the service you request, including signing you in, authorizing your agent, uploading source code, deploying apps, and facilitating claims. This processing is necessary to perform our agreement with you. We process security and diagnostic information for our legitimate interests in preventing abuse, investigating failures, and keeping the service reliable. Where applicable, we also process information to meet legal obligations. Account information is needed to use authenticated features; without it we cannot provide those features.
Google data and cookies
Skratchpad requests Google’s basic identity scopes (openid, email, and profile), not access to Gmail, Drive, or your other Google content. Google identity data is used for account access and management, not advertising or training general-purpose AI models. We do not sell personal information. Essential authentication cookies and related browser storage keep you signed in and protect login flows. The application does not currently add advertising trackers or optional analytics cookies. Google and hosting providers operate their own services under their own privacy policies.
Agents, deployments, and service providers
An agent you authorize can access workspace information and, if you grant deployment permissions, upload code and deploy apps. Your agent provider processes information under its own policies. You can revoke a connection in Connections. Cloudflare hosts the application, uploaded files, and execution infrastructure; Neon stores the application database; Google provides sign-in; and Vercel receives source files and build information when you request a deployment. A deployed app may be publicly accessible. Do not upload credentials, private information intended to remain confidential, or personal data you are not authorized to share. Revoking an agent does not undo completed deployments or remove information already received by that agent.
Processing locations
The application database is provisioned in Frankfurt, Germany, and source storage uses a Western Europe location hint. Cloudflare’s network, Google, Vercel, and your agent provider may process information in other countries, including outside the EEA. A storage region does not guarantee that all processing remains in that region. Contact us for information about the providers and applicable international-transfer arrangements for your use of the service.
Retention and deletion
We retain account and workspace records while needed to provide your account. Deployment history, connection records, and operational logs are retained as needed to operate the service, investigate abuse, and meet legal obligations; these records do not currently all have an automatic deletion deadline. Source upload artifacts expire after seven days, with a storage cleanup fallback after eight days. This does not delete deployments hosted on Vercel. To close your account or request deletion of personal information, email us. We will explain any records that must be retained and why. Backups and provider-held records may persist for their applicable retention periods. Claiming a project transfers its management to your provider account; that provider then manages it under your agreement with them.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, or a portable copy of your personal information. You may object to processing based on legitimate interests. If we rely on consent for a particular activity, you may withdraw it without affecting earlier lawful processing. Contact us using the email above; we may need to verify your identity. You can complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no, or your local supervisory authority. We do not use your information to make solely automated decisions with legal or similarly significant effects on you.
Changes
We will update this page when our practices change and communicate material changes through the service or your account email as appropriate. The date below identifies the current version.
Contact: alexmj044@gmail.com