Skape logo
Skapestudio

Privacy Policy

Last updated: October 14, 2026

Skape is made by Whateverland AB, a small company in Sweden. We make money when organizations pay to publish projects. We don't sell data, show ads or build profiles, so we have no reason to collect more than Skape needs to work. This page lists what that is.

The short version

  • Visiting skap.es. No cookies unless you sign in. We count visits to our public pages with Umami, which doesn't use cookies. We don't count anything in the studio.
  • Listening in the Skape app. No account. The app uses your location on your phone to play the right sound in the right place. It doesn't send your location to us.
  • Making projects. We store your email address, your name and what you put in your projects. That includes the places you pin and the routes you record, because that's what the tool is for.
  • Organizations. If a project contains personal data, like an interview, your organization is in charge of that data, and we handle it on your behalf.

Questions? Write to hello@skap.es. We reply within two business days.

Who is responsible

Whateverland AB (reg. no. 559285-6099) is responsible for the personal data described on this page. In GDPR terms, we're the controller.

Whateverland AB, Sturegatan 87, 791 60 Falun, Sweden. hello@skap.es.

Location

Location is what Skape is built around, so it gets its own section.

When you listen. The app asks to use your location while you use it. It never asks for "Always". Your position goes to the playback engine on your phone, which decides what you hear. Skape doesn't send it to us or to anyone else. If you start a walk and lock your phone, the app keeps using your location so the sound keeps playing. iOS shows that location is in use, and when the walk ends, the app stops using it.

When you make projects. Notes you pin are saved in your project with their coordinates and how accurate the position was. Routes you record are saved with the coordinates and time of each point. Everyone on your team can see them.

While you have a project open in the app, your phone shares your live position with teammates who have the same project open, so you can find each other on site. Teammates see it as a dot on the studio map. It's sent with your account ID and the label "iPhone", not your phone's own name. Only members of your team can see it, and we don't store it.

Photos, video and audio. Here's what we remove before a file is stored:

  • Photos you add to a note in the app, whether you take them or pick them from your library: the app removes their location before uploading.
  • JPEG, PNG, WebP and HEIC images uploaded in the studio: location and camera data.
  • MP4 and MOV video, and M4A audio such as iPhone recordings: the location that phones record. Some drones and action cameras store their position in a separate track inside the video, and we don't remove that.
  • Everything else, like MP3 or WAV audio, and projects imported from an exported file, is stored as it is.

This applies to files uploaded on or after October 7, 2026. Older files keep their data. If you upload one again, the new copy is clean, but the old file stays stored until the project is deleted. Ask us and we'll remove it.

What we collect, and why

Everyone who visits skap.es

  • Visits to public pages, such as this one. We count them with Umami. For each visit, Umami gets:

    • the page address and title, without anything after a "?" or "#"
    • the website you came from (just the site, not the page), or which of our public pages you came from
    • your screen size and language
    • your browser, operating system, device type and rough location (country, region and city), worked out from the request

    Umami doesn't use cookies and doesn't store your IP address. To tell visits apart, it makes a code from your IP address and browser, and the code changes every month. If your browser sends "Do Not Track" or "Global Privacy Control", you aren't counted. Umami keeps the statistics for six months. We use them to see which pages people read. Legal basis: our legitimate interest in knowing whether the site is useful. Umami doesn't count anything on the sign-in pages, in the studio or in the app. The app's experience statistics are described below.

  • Technical logs. When your browser or the app talks to our servers, our hosting providers see your IP address and what was requested, as with any website. Their logs are deleted after seven days. Legal basis: our legitimate interest in keeping Skape running and secure.

Listeners

  • No account needed. You can open published experiences without signing in.
  • Experience statistics. When you open a live published experience, the app sends a random installation ID, the published project's code, a random session ID, the session's start time and its duration. We use these statistics to help project teams understand how their experiences are used. Duration includes time the experience is visible or its playback runs, including background playback, without counting the same time twice. We convert the installation ID to a separate hash for each publishing team before storing it. We don't include your name, account, device name, advertising ID, location or anything you enter in a project. Teams see totals by date and project, such as unique installations and average session duration, and cannot access installation IDs or individual session histories. The ID distinguishes app installations, not identified people, and stays the same across app restarts.
  • Downloading a project. When you open a project, the app fetches it from our servers and our storage provider. They see your IP address and the project you asked for.
  • Other websites. If a project shows images or video hosted on another website, your phone fetches them from that website. The organization behind a project decides what its screens load and link to.
  • On your phone. The app remembers the last ten projects you opened and the values a project saves (like how far you've come in a story). Projects you've downloaded are kept on your phone so they work offline. Deleting the app removes all of it from your phone.

People who make projects

Unless a point says otherwise, the legal basis for everything in this section is our contract with you: we need it to give you the tool you signed up for.

  • Your account. Your email address, your password (stored as a scrambled hash, never in plain text) and your name. If you sign in with Google, GitHub or Figma, we get your name, email address, profile picture link and your user ID there (for GitHub, also your username). Kept for as long as you have an account.
  • Your projects. Everything you put in them: audio, images, video, text, notes, map features, recorded routes, screens and logic. Projects belong to their team, so they stay when a member leaves or deletes their account. Kept until the project is deleted.
  • Files in your projects. Only your team can open a project in the studio. The files in it are stored at long, hard-to-guess web addresses. Until we move them behind sign-in, anyone who has a file's exact address can open it. A file you remove from a project stays stored until the project is deleted.
  • Edit history. Every change to a project is saved with who made it and when, so several people can work on the same project at once. Kept for as long as the project exists. If you delete your account, your changes stay in your team's projects but are no longer linked to your name.
  • Teams and invitations. Who is on which team, and their role. An invitation stores the invited person's name and who invited them. It's a link that you share yourself; we don't email anyone.
  • Complimentary publishing access. The team's capacity and optional expiry, an internal reason, and which platform admin granted or revoked access and when. Only platform admins can read the reason and audit record. We use these records to manage the team's access.
  • Test versions of the app. Until the app is in the App Store, it installs only on iPhones registered in our Apple developer account. If you get a test version from us, we register your iPhone's device ID (UDID) and its name with Apple, only so the app can be installed. Each test version contains the list of registered device IDs. We store test versions with Supabase at web addresses that follow a simple pattern, so someone who knows where to look could download one and read the device IDs in it. We're changing that. When you no longer need the test version, tell us and we'll disable your iPhone in our developer account right away. Apple lets us remove it from the list only when our developer membership renews, so we remove it then, within a year at the latest, and delete the test versions that contain its ID. Legal basis: our legitimate interest in letting the teams we work with test the app.
  • AI assistants. When you connect an AI assistant, we store a record of the connection: the assistant's name and identity, the teams and access level you approved, when you approved it and when it was last used. The MCP service also keeps the assistant's sign-in and access-grant data, encrypted. We log each request the assistant makes: which tool it used, the project and team, whether it was allowed, and a request ID. The log also records each change you make to the connection, such as approving it, changing its teams or access, or disconnecting it. You can see the log on your team's MCP / AI page, and we delete it after 90 days.
  • API keys. If your team adds an Anthropic API key, we store it encrypted, with who added it and when it was last used.
  • Maps and place search. The studio and the app load maps from the services listed below. They get your IP address, the part of the map you look at and, in the studio, what you search for.
  • Sign-in records. Our database provider logs each sign-in, with the time, your IP address and your browser, and deletes the log after seven days. Each session also keeps the IP address and browser it was last used from, until you sign out or delete your account. Legal basis: our legitimate interest in protecting your account.

People who contact us

  • The contact form sends your name, email address and message to our team's Slack. Slack deletes messages after a year.
  • Email to hello@skap.es goes to our inbox at Google.

Legal basis: our legitimate interest in answering you. We delete email when the conversation is over, and within two years at the latest. There are two exceptions: email that becomes part of an agreement or invoice is kept as long as the agreement or invoice, and email that shows how we handled a report or a privacy request is kept for three years.

Customers

  • Billing and payments. The organization's name, billing address and country, VAT number, email address and any billing reference; the selected plan, payment amounts, dates and statuses; and Mollie customer, payment, subscription and payment-method references. We show the payment method's label and, for cards, its last four digits. Mollie handles online payments and automatic renewal. We send Mollie the organization's name and email address, payment details such as the amount and plan, and references linking the payment to the team. You enter card or bank details on Mollie's checkout page; we don't store full card numbers. Legal basis: our contract with the organization. For the billing contact, it's our legitimate interest in handling the organization's order.
  • Invoices. The organization's name, address, VAT number, contact person, email address and what was bought. Legal basis: our contract with the organization. For the contact person, it's our legitimate interest in handling the organization's order. Keeping invoices is a legal obligation: the Swedish Bookkeeping Act requires us to keep accounting records until the end of the seventh calendar year after the fiscal year they belong to.

What we don't collect

  • No cookies for visitors.
  • No advertising IDs, no tracking across apps or websites, no profiles.
  • No third-party analytics or crash-reporting tools in the app. Experience statistics go to Skape's own collector, as described above. Test versions don't send us crash reports. Once the app is in the App Store, Apple will send us crash reports and usage totals that don't say who you are, if you've chosen to share analytics with app developers in your iPhone's settings.
  • Today, the app doesn't use the microphone, your contacts, Bluetooth or motion sensors. If a project ever needs one of them, iOS asks you first, and we'll update this page before that ships.
  • The app uses the camera only when you scan a QR code or take a photo for a note. Scanning happens on your phone. When you add a photo from your library, you pick it in Apple's photo picker, so the app never sees the rest of your photos.
  • No listener accounts or listener location on our servers. Experience statistics are not linked to creator accounts.
  • We don't sell or rent data to anyone, and we don't train AI models on your projects.

AI

AI comes into Skape in two optional ways, both for people who make projects. Listeners can't use AI in Skape today.

  • The AI node. If your team adds its own Anthropic API key, the prompts you run in the studio are sent to Anthropic in the US, under your team's agreement with Anthropic. Without a key, nothing is sent to Anthropic.
  • AI assistants. You can connect an AI assistant, such as Claude or ChatGPT, to your Skape account. You choose which teams it can use, and whether it can only read or also build. Through Skape, it receives your account's user ID, team and project names, project content including map coordinates, file names, and links to your files. Links made for previews stop working after five minutes, but project content also includes each file's permanent address, which anyone who has it can open, even after you disconnect the assistant (see Files in your projects). With build access, it can also change your projects for you. What it receives is handled by that assistant's provider, under your agreement with them. On your team's MCP / AI page, choose Manage on the connection to reduce its access or change its teams, or Disconnect AI to remove its access. Connect your AI explains how it works.

Services we use

These are the companies that handle data for Skape, what each one does, what it gets and where it is.

  • Supabase: database, sign-in, file storage and live collaboration, and where we keep test versions of the app. Gets everything in your account and projects, the test versions with their list of registered device IDs, and the IP addresses of listeners who download a project. Servers in Stockholm, Sweden (Amazon Web Services). Files are also cached on its content delivery network, so they load quickly where listeners are. Supabase is a company in Singapore.
  • Fly.io: runs skap.es. Gets every request to skap.es, including IP addresses. Servers in Amsterdam, the Netherlands. Fly.io is an American company.
  • Umami: counts visits to our public pages, as described above. Stores the statistics in the EU. Umami is an American company, and requests pass through Cloudflare's global network.
  • Slack: receives messages from the contact form. United States.
  • Google: our email inbox (Google Workspace), and sign-in if you choose it. United States.
  • Mollie: online payments and automatic renewal. Gets the billing name and email address, payment amounts and plan, team and payment references, and the card or bank details you enter at checkout. Mollie is a payment provider in the Netherlands and handles payment data under its privacy statement.
  • Esri (ArcGIS): the satellite map in the studio and in AI assistants. Gets your IP address and the part of the map you look at. United States.
  • MapTiler: other map styles in the studio and in AI assistants. Gets your IP address and the part of the map you look at. Switzerland.
  • OpenStreetMap: maps in the studio and in AI assistants, and place search in the studio. Gets your IP address, the part of the map you look at and what you search for. United Kingdom.
  • Apple: the map in the app when you work on a project (Apple Maps), and installing test versions of the app. For maps, Apple gets your IP address and the part of the map you look at. For test versions, it gets your iPhone's device ID and name, as described above. United States.
  • Cloudflare: live audio streams in the studio, only in projects that use one. Gets the IP addresses of the people sending and receiving the stream. Global network.
  • Anthropic: the AI node, only if your team adds a key. United States.
  • GitHub and Figma: sign-in, only if you choose to sign in with them. GitHub also builds our test versions of the app, which contain the registered device IDs. United States.

Several of these are based outside the EU. When data leaves the EU, it's covered by one of the following:

  • the EU–US Data Privacy Framework: Fly.io, Slack, Google, Esri and Cloudflare
  • the EU's standard contractual clauses, in each company's data processing agreement: Supabase and Umami
  • the EU's decision that the country protects data well enough: MapTiler (Switzerland) and OpenStreetMap (United Kingdom)

Apple, Anthropic, GitHub and Figma, and Google when you sign in with it, handle what they get under their own terms with you, your team or us. Mollie is independently responsible for payment data; its privacy statement describes its processing and transfers outside the European Economic Area. Esri and OpenStreetMap get map and search requests straight from your browser and handle them under their own privacy policies. The other services handle data on our behalf, and agreements require them to protect it at least as well as this policy describes. Ask us if you want a copy of an agreement.

We update this list before we start using a new service. If a new service will get access to project content, we email account holders at least 30 days before. If we have to switch services at short notice, for example because one shuts down, we email as soon as we know.

What's stored on your device

  • On skap.es, signing in sets the cookies that keep you signed in, plus one that's used while you sign in with Google, GitHub or Figma. The studio saves your settings, like where you left the map, in your browser, and keeps project files in the browser's cache so they load faster. There's no cookie banner because we only store what's needed for things you've asked for, like staying signed in.
  • In the app, your sign-in is kept in the iPhone's keychain. Downloaded projects are kept in the app's own storage and aren't included in iCloud backups. The random installation ID is created when you first open a live published experience and stored locally with pending session snapshots; pending uploads expire after seven days. These settings can be included in your phone backup. The list of recent projects and the values projects save are small app settings, and they're included in your iPhone's backup like other apps' settings.

How long we keep things

  • Account and projects: until you delete them. When you ask us to delete your account, we do it within 30 days.
  • Team billing and access history: kept with the team until it is deleted, including complimentary grants, internal reasons and admin audit records. Ending or revoking a grant doesn't delete its history. Accounting records follow the invoice retention below.
  • AI connections: until you delete your account. A disconnected connection stays as a record that it was revoked.
  • AI activity log: 90 days.
  • Backups: deleted data can remain in our database backups for up to seven days, until they're replaced.
  • Public-page visit statistics: six months.
  • App experience statistics: 365 days from the session start, removed by a daily cleanup. Deleting a project or team also deletes its experience statistics.
  • Technical logs and sign-in logs: seven days.
  • Test-version registrations: until our Apple developer membership renews after you tell us you no longer need the test version, within a year at the latest.
  • Messages to us: one year in Slack. Email: up to two years, with the two exceptions described above.
  • Invoices: until the end of the seventh calendar year after the fiscal year they belong to, as the law requires.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, and to get it in a format you can take elsewhere. You can export any project yourself: in the dashboard, open the project's menu and choose Export.

You can object. Where we rely on our legitimate interest (visit statistics, technical logs, sign-in records, test-version registrations, invoice contacts and answering messages), you can object at any time, and we'll stop, unless we have a compelling reason to continue. If we do, we'll tell you what it is. To stop being counted on our public pages, turn on Do Not Track or Global Privacy Control in your browser if it offers one (Safari doesn't), or block cloud.umami.is with a content blocker.

What you have to give us. An account needs an email address and a password, or a Google, GitHub or Figma account. Without them you can't make projects. Listening needs nothing.

No automated decisions. We don't make decisions about you automatically, and we don't profile you.

Write to hello@skap.es. If you have an account, write from its email address, so we know it's you. We reply within two business days and finish within a month.

If you think we handle your data wrongly, tell us. You can also complain to Integritetsskyddsmyndigheten (IMY), the Swedish data protection authority, at imy.se.

When a project contains other people's data

If a project contains personal data about other people, like an interview, a voice or a name, the organization behind the project is in charge of that data. In GDPR terms, it's the controller, and we're the processor that handles the data on its behalf. Our data processing agreement is part of our terms and applies to every team automatically. If your organization prefers its own, such as the template from SKR (Sweden's association of municipalities and regions), send it to us and we'll go through it with you.

If you're in a project and want your data removed, contact the organization behind it. If you don't know who that is, write to us with the project's code, and we'll pass your message on and help them.

Age

You need to be at least 16 to create a Skape account. Anyone can listen without an account.

Version history

We date every change and list it here. If a change means we collect something new about you, we email account holders at least 30 days before it takes effect. New services are handled as described under Services we use.

  • October 14, 2026: Experience statistics are collected on live published experience use without a separate approval in the app. Updated the collection and local-storage descriptions.
  • October 11, 2026: Described what we store when you connect an AI assistant, its activity log, how long we keep them and what an assistant receives through Skape. Removed AI access tokens, which Skape no longer uses.
  • October 11, 2026: Added optional installation-level app experience statistics, the consent choices, aggregate team reporting and retention.
  • October 9, 2026: Added Mollie billing and payment data, and complimentary publishing grants with private admin audit records and their retention.
  • October 7, 2026: Rewrote the policy. The old version said we shared no data with third parties. That was wrong: services like the ones listed above already handled some data, and our visit counter also ran in the studio. It now runs only on public pages. The new version also covers the app, location, listeners, AI, legal bases, how long we keep data and your rights.
  • February 13, 2026: First version.