Last updated: September 12, 2026
This Privacy Policy applies to the Skooly platform (skoo.ly), including the Skooly web dashboard, the Skooly Chrome extension, the Skooly One Chrome extension, and the Skooly Streaks iOS application, all operated by Software Quality Associates ("we," "us," or "our").
The Skooly web dashboard, the Skooly Chrome extension, and Skooly Streaks share the same underlying platform and data practices described in this policy. Skooly One is a separate product on separate infrastructure — it shares no database, servers, or stored data with the rest of the platform. Sections 1 through 17 and 19 through 22 describe the shared platform; Section 17a describes Skooly One in full and governs it wherever the two differ.
Skooly provides a suite of tools for online community owners and managers, including URL shortening, link analytics, community member monitoring, engagement tracking, member tagging and organization, testimonial management, member notes, automated messaging (DM auto-respond, broadcasts, sequences, welcome DMs), scheduled post publishing, AI-powered community insights, voice/video/screen recording, DM sync and export, and habit tracking. This policy describes how we collect, use, store, and protect information across all of these features.
Several Skooly features collect publicly visible information from the Skool.com platform on your behalf, to power the community management tools you have opted into. This information is collected only for communities you own or administer, and only while those features are active. Collected data may include:
This data is collected to provide you with community management insights and is scoped exclusively to communities you own or administer. We do not collect data from communities you do not control, with the exception of testimonial content you voluntarily capture from posts in communities where you are a member.
We use cookies and similar technologies to enhance your experience, analyze usage patterns, and provide personalized content. This includes:
We use the information we collect to:
Skooly offers several tools that help community owners monitor, understand, and manage their online communities. These tools collect and process data from the Skool.com platform as described below.
Hawkeye collects publicly visible member profile data and course progress information from Skool communities you own or administer. This includes member names, profile images, bios, badges, join dates, social links, contribution and follower counts, group memberships, personality types, and course completion percentages. Data is stored in our database and access is restricted to the community owner through row-level security policies. Hawkeye may take periodic snapshots of course progress to track changes over time.
Nighthawk is a server-side monitoring and automation tool available to Premium and VIP-tier subscribers. It collects community posts, comments, reactions, member activity patterns, and cancellation status from Skool communities you own. Nighthawk computes engagement metrics, at-risk scores, churn predictions, and community health snapshots to help you identify members who may need outreach. Additional capabilities include:
All Nighthawk data is stored in our database and access is restricted to the community owner. Automated actions (DMs, posts) are performed using the owner's encrypted Skool credentials and are subject to rate limits.
TalonTag allows you to organize community members into lists for quick reference. It captures member usernames from Skool community pages and organizes them into auto-generated lists (based on membership tier, level, or course enrollment) and manual lists you create. List data is stored locally in your browser's extension storage and synced to our database for persistence across devices. Lists are scoped to your account and specific communities.
Perch Guard monitors for suspected bot accounts in your Skool community by analyzing publicly visible profile patterns and activity indicators. Flagged accounts are surfaced to you for review. No automated action is taken against flagged members.
Skooly allows community owners to capture, compose, and display testimonials from their community. Testimonials may include the testimonial text, author name, author profile image, and a link to the original Skool post. You may also use AI-assisted composition to help draft testimonial copy. Testimonials are stored in our database with a moderation status you control. Published testimonials may be displayed on public-facing testimonial pages associated with your account. Anonymous reactions on testimonial pages are tracked using a hashed IP address (not the raw IP) solely for reaction deduplication.
Skooly provides a notes feature that allows you to keep free-form notes about individual community members or contacts. Notes are stored in our database and are accessible only to you. For Hawkeye-monitored members, notes are linked to the member profile. For contacts outside Hawkeye, notes are stored separately. This feature is available to Premium-tier and VIP-tier subscribers.
You may upload a CSV file exported from Skool containing member billing information, including first names, last names, email addresses, pricing tiers, lifetime value, and intake survey answers. This data is uploaded by you, stored in our database, and matched against your Hawkeye member records by name. Billing data is scoped to your account and is not shared with other users. We do not use uploaded billing data for any purpose other than displaying it to you within the Skooly dashboard.
Skooly provides automated messaging features that send direct messages and publish posts on behalf of community owners within the Skool.com platform. These features include DM auto-respond (automatically messaging users who comment on specific posts), welcome DMs (messaging new members when they join), broadcast DMs (sending messages to filtered member segments), DM sequences (multi-step message flows triggered by member events), and scheduled post publishing.
To perform automated actions on your behalf, we store your Skool.com authentication cookies on our servers. These credentials are encrypted using AES-256-GCM encryption at rest and are transmitted only over encrypted connections (TLS/HTTPS). Credentials are used exclusively to perform the automated actions you have configured and are never shared with third parties. You may delete your stored credentials at any time from your Skooly dashboard, which will immediately stop all automated actions.
Automated messages may be personalized using member data we have collected, including display names, community names, and membership tier labels. This data is substituted into your message templates at the time of sending. We do not share personalization data with message recipients beyond what appears in the message itself.
We maintain logs of automated messages sent through our Service, including the recipient, timestamp, delivery status, and any errors. These logs are accessible only to the community owner and are retained for operational and troubleshooting purposes.
If you are a member of a Skool community and have received an automated message from a community owner using Skooly, you may contact us at the email address below to inquire about the automated nature of the message. We will work with the community owner to address your concerns.
Skooly AI provides an admin copilot for community owners and a member assistant for community members. These features use third-party AI services (currently OpenAI) to process queries and generate responses based on your community's content, including posts, comments, and classroom materials.
When you or your community members use AI features, the query text and relevant community content (retrieved via vector similarity search) are sent to OpenAI's API for processing. Per OpenAI's API data usage policies, data submitted through their API is not used to train their models. We do not send personally identifiable information to AI providers beyond what is necessary to generate a relevant response.
AI conversation history (queries and responses) is stored in our database to provide multi-turn conversation continuity. Conversations are associated with the user's account and the specific community. Community owners may access aggregated AI usage data but not individual member conversation content. Conversation history is retained until the owner deletes it or closes their account.
To power AI search and retrieval, we generate vector embeddings of community content (posts, comments, classroom materials) and store them in our database. These embeddings are mathematical representations of text content used for similarity matching and do not contain the original text in a human-readable form.
HawkTalk provides voice, video, and screen recording tools within your browser. Recordings are stored in our cloud storage (Supabase Storage) and are accessible only to you and anyone you share the recording link with. VIP-tier subscribers have access to additional features including trim editing, section removal, and custom backgrounds. Recording media is retained until you delete it or close your account.
If you use Skooly's Email Broadcasting feature to send email to recipients you manage, Skooly processes those recipients' data on your behalf, not as a controller in its own right. Detailed processor terms are set out in our Data Processing Agreement. The summary below covers what Skooly collects and how long it's kept.
Recipient data is used only to deliver the email you compose, to honor unsubscribes and bounces by adding the recipient to your suppression list, and to produce deliverability reporting for you. Skooly does not use recipient data for its own marketing, for cross-account profiling, or for any purpose other than operating the Email Broadcasting feature for you.
Email is actually delivered by Resend (Resend, Inc., United States). Resend acts as a subprocessor to Skooly under terms with data-protection obligations no less protective than this Privacy Policy and the DPA. Resend's own privacy policy is at resend.com/legal/privacy-policy.
Contact records and list memberships are retained for the life of your account. Suppression list rows are retained for the life of your account (and at most 30 days after closure) — they have to outlive any specific broadcast, because the whole point is "don't re-mail people who have opted out." Per-broadcast frozen recipient lists and content are retained as the audit trail of what was sent to whom. Unsubscribe-link tokens stay valid indefinitely so a recipient can always unsubscribe via an email they received in the past.
Every email Skooly sends includes a one-click unsubscribe link. Recipients exercising other data-subject rights (access, deletion, correction) should be directed to the account owner who sent them email; if a recipient contacts Skooly directly, we will route the request to the relevant account owner.
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:
We use trusted third-party service providers to operate our platform, including:
These providers process data on our behalf under contractual obligations to protect your information.
We may disclose your information if required by law or to:
We implement appropriate security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
Our database infrastructure is hosted on Supabase with automated daily backups and point-in-time recovery capabilities. Our web application is hosted on Vercel with redundant deployments across multiple regions. While we employ industry-standard backup and recovery practices, no system is immune to data loss, and we encourage you to maintain your own records of critical information.
We maintain automated test suites and conduct regular quality assurance to ensure the reliability and security of our platform. New features and changes undergo testing before deployment to production.
You have the right to:
You can control cookie settings through your browser preferences. Note that disabling certain cookies may affect the functionality of our service.
If you are a member of a Skool community whose owner uses Skooly's community management tools, and you wish to inquire about data collected about you, you may contact us at the email address below. We will work with the community owner to address your request in accordance with applicable law.
We retain your personal information for as long as necessary to provide our services and comply with legal obligations. Specifically:
Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our service providers operate. We ensure appropriate safeguards are in place to protect your information in accordance with this privacy policy.
Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information.
We may update this privacy policy from time to time. We will notify you of any material changes by posting the new privacy policy on this page and updating the "Last updated" date. Your continued use of our service after any changes constitutes acceptance of the updated policy.
This section applies specifically to the Skooly Chrome extension. The extension provides a suite of community management tools that operate on Skool.com pages.
The extension collects your Skooly account email or user ID after sign-in and stores a local authentication token (JWT) in your browser's extension storage to maintain your session. Skooly cookies are first-party and used only for session continuity.
The extension provides the following features, each of which may collect data as described:
The extension requests permissions for storage (local data), scripting (to read Skool page content), active tab access, tabs, cookies (for authentication), alarms (for scheduled operations), and context menus. Host permissions are limited to Skool.com domains and Skooly service domains.
The extension does not collect browsing history outside of Skool.com, keystrokes, personal communications, or data from non-Skool websites. It does not execute code from remote sources. It does not access community management data from communities you do not own or administer, though you may capture testimonial content from posts in any community where you are a member.
You can log out from the extension at any time to clear local tokens. Uninstalling the extension removes all locally stored data. Data synced to our servers follows the same retention and deletion practices as the web dashboard. Contact us at contact@softwarequalityassociates.com to request server-side data deletion.
This section applies specifically to Skooly One, a separate Chrome extension that schedules posts, sends welcome messages to new members, records audio and video, and keeps notes you capture while you work. Skooly One runs on its own infrastructure and does not share a database, servers, or stored data with the Skooly web dashboard, the Skooly Chrome extension, or Skooly Streaks. Connecting a community in Skooly One does not grant the rest of the platform access to it, and the reverse is also true.
To act in your community on a schedule while your browser is closed, Skooly One reads the cookies your browser already holds for Skool.com — including auth_token, which is HttpOnly and therefore unreadable by any ordinary web page. This is authentication information, and we treat it accordingly:
Access to Skooly One is tied to membership of the Skooly community on Skool.com. When you connect, we read that community's member roster to confirm your Skool account appears on it. Membership at any tier grants access; we do not read your payment details, and no billing information is collected by the extension.
Swoop is a private scratch space for notes and snippets you capture while working, including clipboard contents when you choose to sample them. Captured items are held in your browser's local extension storage and are never transmitted unless and until you explicitly commit an item. Unreviewed captures expire on their own: clipboard samples after 24 hours, deliberate captures after 30 days. Items you commit are kept until you delete them. Uninstalling the extension erases all of it.
Audio, video, and screen recordings are captured in a window belonging to the extension, with no access to the page you were viewing. Recordings and other attachments are uploaded directly to Skool's own file and media storage so they can be attached to a post or message; we retain an identifier and a URL for each one, not the underlying media. Files uploaded to Skool are governed by Skool's own privacy practices, and files of this kind are reachable by anyone holding the URL.
GIF searches are proxied through our own server rather than sent from your browser to the GIF provider. The provider (Giphy) receives only the search term; it does not receive your IP address, your Skool identity, or anything else identifying you or your community. Results use the same content rating Skool's own composer applies.
Skooly One requests cookies (to read your Skool session, as described above), storage and unlimited storage (for local items and captures), alarms (to re-seal your session and run scheduled work), side panel and context menus (its interface), scripting, and declarative net request. The declarative net request rule serves one purpose: blocking Skool's own live-notification connection while Focus mode is on. It blocks a request; it never reads, redirects, or injects one. Host permissions are limited to Skool.com and Skooly One's own service endpoints, and its content scripts run only on Skool.com pages.
Three parties receive data from Skooly One, and no others:
Nothing is sent anywhere else. Skooly One does not use the Supabase, Vercel, Railway, Resend, or OpenAI services listed in Section 10.1 — those serve the rest of the Skooly platform.
This section applies specifically to the Skooly Streaks iOS application.
Skooly Streaks collects and stores the following information:
Habit and streak data is stored locally on your device using iOS UserDefaults. If you are logged in to your Skooly account, streak data is also synced to our servers via the skoo.ly API over HTTPS to enable cross-device access and data backup.
The app requests permission to send local push notifications for daily habit reminders. You can enable or disable notifications at any time through the app settings or your device's iOS Settings. We do not use push notifications for marketing purposes. No notification data is sent to our servers.
Skooly Streaks does not collect location data, contacts, photos, browsing history, health data, or any data from other apps on your device. The app does not include third-party analytics SDKs or advertising frameworks. The app does not track you across other apps or websites.
You can log out of the app at any time to clear your locally stored authentication token. Uninstalling the app removes all locally stored data. To request deletion of streak data stored on our servers, contact us at contact@softwarequalityassociates.com.
Skooly collects data from third-party platforms, primarily Skool.com, to power community management features. This collection is performed on behalf of and at the direction of community owners who have activated these features. We collect only publicly visible information and information that the community owner has access to through their administrative role on the platform.
We do not have a formal partnership or data-sharing agreement with Skool.com. The data we collect is publicly accessible on the platform or accessible to the community administrator. If Skool.com changes its platform in a way that affects data accessibility, we will adjust our data collection practices accordingly.
Community owners are responsible for ensuring their use of Skooly's community management tools complies with applicable laws, including data protection regulations, and the terms of service of the platforms from which data is collected.
When you create an account, you may receive marketing emails from us, including product updates, feature announcements, tips for using Skooly, and promotional offers. We will never sell your email address to third parties for their marketing purposes.
You can unsubscribe from marketing emails at any time by:
We will process your unsubscribe request within 10 business days in accordance with the CAN-SPAM Act. Note that opting out of marketing emails will not affect transactional emails related to your account (such as password resets, security alerts, and account notifications).
All marketing emails are sent by Software Quality Associates. Our emails clearly identify the sender and include our contact information and a physical mailing address in compliance with the CAN-SPAM Act.
If you have any questions about this privacy policy, our data practices, or wish to exercise your data rights, please contact us at:
Email: contact@softwarequalityassociates.com