Privacy
Policy

app.sculli.net is an invite-only personal app operated by Matt Scullino and the sculli.net team (“we”, “us” or “our”), primarily for Matt and friends. It includes private notes with AI processing and games where users can contribute items, vote and comment.

This policy explains how we collect, use, store and share personal information when you use the app.

We collect information you provide when you create an account or use the app, including:

• Your name and email address.
• A profile picture, if you choose to provide one.
• Notes you write or save, and the results generated when those notes are processed by AI.
• Items you contribute to games and group activities, together with your votes and comments.
• Information you send us when requesting help or contacting us about your account.

We also collect page analytics, usage events and error information through Vercel Analytics, Cloudflare and PostHog. User IDs are attached to analytics and error information, allowing us to associate activity with an account. We use this information to understand how the app is used and investigate problems.

We use Google sign-in to authenticate your account and receive basic account information, such as your name, email address and profile picture if available. Better Auth manages sign-in and sessions within the app.

The app’s Google sign-in integration does not request access to your Gmail, Google Drive, Calendar or other Google account content.

We use information to:

• Create and manage accounts and control access to the invite-only app.
• Save notes, process content using AI and store the resulting output.
• Run games and group activities, record contributions and enable voting and comments.
• Display information you choose to share with other users.
• Understand page usage, investigate errors and improve the app.
• Respond to support, privacy and deletion requests.

Your email address, notes and AI results are private to your account within the app unless you explicitly choose to share them with other users.

Your name, optional profile picture and items you choose to contribute to games may be visible to other users.

You may also create artifacts for group activities. Artifacts explicitly created within a group can be seen by other users in that group. Other private content is shared with other users only when you explicitly choose to share it.

Privacy from other app users is separate from access by the services that store or process information and the administrator access described below.

Matt Scullino is currently the only person with administrator access to the app’s databases, server tools and logs. This access means Matt can technically access information stored in those systems, including private user content.

Matt will not inspect your private content unless you request assistance and explicitly give permission. This is a restriction on how administrator access is used; private content is not technically inaccessible to the administrator.

AI processing happens automatically as part of the app’s functionality, including its notes features. Content used by those features is sent for AI processing, and the resulting output is stored in the app.

We use OpenAI and OpenRouter. OpenRouter acts as an intermediary and routes requests to the AI providers serving the selected models, so those providers also receive the content submitted for processing.

AI services may retain inputs, outputs and request information under their applicable policies and our account settings. Retention periods and whether information may be used for model training depend on the provider and configuration.

Further information is available in:

• OpenAI’s API data controls
• OpenRouter’s data collection documentation
• OpenRouter’s provider data policies

Sharing content with other app users is separate from the automatic AI processing involved in providing app features.

We use:

Hosting, infrastructure & data storage

Vercel, Cloudflare, Neon DB and Convex

Sign-in

Google

AI processing

OpenAI, OpenRouter and the AI providers accessed through OpenRouter

Analytics & error information

Vercel Analytics, Cloudflare and PostHog

These services receive or process information relevant to the features or infrastructure they provide.

Our infrastructure uses regions including Australia, particularly Sydney, the United States and Singapore. Where a region has not been explicitly selected, provider defaults apply. Information may also be processed or accessed in other countries depending on the provider, its infrastructure and the services used.

We may also disclose information if required by applicable law or a binding legal process.

We use cookies to maintain sign-in sessions and track session and user IDs. We also use browser local storage to cache information used by the app.

You can remove cookies and cached information through your browser settings. Removing session cookies may sign you out, and restricting browser storage may affect how the app works. Clearing browser storage does not delete information stored in the app’s databases.

User data stored in the app is kept indefinitely unless deletion is requested. Logs are retained for 90 days.

These periods describe our app’s retention practices. Providers may retain information separately under their own policies and the settings applicable to their services.

Access to the app is restricted by invitation and account sign-in. Administrator access is currently held only by Matt Scullino, subject to the access practices described above.

You can contact us at hi@sculli.dev to request access to, correction of, or deletion of your personal information.

There is currently no self-service account deletion feature. To request deletion of your account or stored data, contact us directly. We may need to verify that the request relates to your account.

When we delete your account, we delete the associated entries linked to your user account in the app’s active databases. This includes associated notes, stored AI results and game activity. Your votes and likes are removed, so they no longer contribute to vote or like counts.

We do not require any of your app database entries to be retained after account deletion.

Deletion from active databases does not necessarily immediately remove copies held in existing logs, provider systems or backups, if present. Those copies are subject to the applicable retention and deletion processes. Our logs follow the 90-day retention period described above.

If you have a privacy question or believe we have mishandled your information, contact Matt Scullino and the sculli.net team at hi@sculli.dev. Please describe your concern so we can investigate and respond.

We will publish updates to this policy on the app and revise the “Last updated” date. If a change materially affects how personal information is handled, we will notify affected users through the app or by email.