Skipbox Privacy Policy

Effective: 9 November 2026. Last updated: 9 November 2026 (where your jobs' data is processed, now Finland or Germany (EU): Sections 5 and 6).

This policy explains what Skipbox (skipbox.dev) records, why, who handles it for us, how long we keep it, and how you can see, correct or delete it. The Japanese version says the same thing.

1. Who we are

Skipbox is run by Fluxenic Inc. ("we", "us"). We decide how your personal data is used: we are the controller under the EU and UK GDPR, and the business operator handling personal information under Japan's Act on the Protection of Personal Information (APPI).

• Name: Fluxenic Inc.
• Address: Shibuya Dogenzaka Tokyu Building 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo, Japan
• Representative: Tomoya Fujita, Representative Director
• Email: hello@skipbox.dev

2. What we record

• Your GitHub account. When you sign in with GitHub: your GitHub user ID, username, display name, profile picture address and the date the account was made; your primary email address if GitHub has verified it, otherwise GitHub's no-reply address for you; and the address you type on skipbox.dev when GitHub gives us none. We use the email address to write to you about your trial, your plan, your payments and your jobs, and about how to start using Skipbox. We also keep, encrypted, the access token GitHub issues to Skipbox when you sign in, and use it to find which organizations with the Skipbox CI app you belong to, which we record.
• Your organization. For each GitHub organization that installs the Skipbox CI app, and each personal GitHub account that installs the Skipbox (personal) app: its ID, name and creation date, the installation's ID, when it was installed or uninstalled, and the GitHub user who installed it. For a personal account, we read that creation date from its public GitHub profile (GET /users/{username}). The response also holds what the person shows publicly there, such as their display name, bio, company, location, website, public email address and follower counts; we don't store or use any of it, and keep only the creation date. In this policy, "your organization" also means your personal account when you use Skipbox on one, and "the Skipbox app" means whichever of the two apps you installed.
• Job records. For each job GitHub sends to Skipbox: the repository's name and ID, the job's name and labels, the run and job IDs and the run attempt, the size of its virtual machine, when it was queued, given its turn, started and finished, how it ended (GitHub's conclusion, the exit code, or why we refused or stopped it), and the runner registered for it. If the job ran on a Hetzner Cloud server, we also record that server's ID and type, when it was made and deleted, and what it cost us. GitHub's job events also say who triggered them; we don't store that.
• Trial and sign-in checks. To give one trial per organization and per person (Terms Section 5.2), we record which organizations and GitHub users have had a trial, with when each trial started and ended, the job-minutes it used, and which of its emails we have sent. To limit how many sign-ins and trials start from one network in a day, we count them under a one-way code made from the network (an IPv4 address, or the first half of an IPv6 address) and the date. The address itself isn't stored, and each count is deleted after 2 days.
• Sign-in sessions. A session token, kept in a cookie and in our database, and when it expires. We don't store your IP address or browser type with it.
• Payments. You pay on Stripe's checkout page, and we never see your full card number. Stripe keeps what you enter there, such as your name, email address and billing address, with the amount, your card's brand, its last 4 digits and its country, and we can see it in our Stripe account. Our own database keeps your plans, whether they are billed monthly or yearly, their status and dates, Stripe's IDs for you and your subscription, the language you chose at checkout, when a payment failed and which of our emails about it we sent, and any refund.
• Emails. What you write to us and our replies.
• Server records. Cloudflare keeps a record of each request to skipbox.dev, with the IP address, browser type and approximate location.
• Cookies. skipbox.dev sets the cookies that keep you signed in and, if you choose a language, a skipbox_lang cookie that remembers it for a year. It runs no advertising network and no cross-site tracker.
• Where a sign-up came from. If the skipbox.dev address you signed up from carries a ref tag, such as the one on links from convika.com's Skipbox pages, or a v tag naming the version of the home page's headline you saw, we keep those tags with your account, to count which pages and headlines bring sign-ups.

• What led to a purchase. When you open Stripe's checkout or add a plan, we keep which prompt you came from (the name of a dashboard prompt from a fixed list, a via tag such as size-card) on the checkout session and your subscription on Stripe, and in our server records, to count which prompts lead to purchases.

• Visits to the home page. For each day (UTC), we count how many times skipbox.dev's home page was opened, by the page's address, its v tag, its ref tag when that tag names one of our own channels (any other ref is counted as "other"), and the page's language (English or Japanese). We store only these counts: no IP address, cookie, browser type or anything else about you, and a ref we keep names a channel, never a person, so a count can't be traced to anyone. We read the browser type only to leave out crawlers and link previews that name themselves, and don't store it; recalculations with the cost calculator and returns from sign-in aren't counted. We use the counts to know which links and headlines bring visitors, and how many of those visitors sign up.

• Your emails' language. The language of the dashboard (English or Japanese) when you last opened it or your organization's page, so our emails to you come in that language.
• Getting-started emails. Which of our getting-started emails we have sent you and when: the one after your first sign-in that names your next step, and the note that your organization's installer has signed in. If you reply "stop" to one of these or to a trial email, or write it to hello@skipbox.dev, we record that and send you no more getting-started or trial emails. Emails about your plans, payments and refunds still go, as part of your contract.
• Why you cancelled. If you answer the question we ask before you cancel, the answer you chose and anything you typed with it, with your organization and plan. We keep it even if you then don't cancel on Stripe's page. We use it to learn what to fix.

• Your organization's past CI usage. When the Skipbox app is installed, and again when your organization's page is opened if that read failed, we read through GitHub the metadata of the GitHub Actions runs and jobs of the last 30 days in every repository the app can see. We keep: for your organization, the read's status, times and counts (including how many runs were listed and how many were read, and why listing stopped), the 95th percentile of vCPU in use at once, and any error as a status code and API route; per day, the most jobs at once, the peak vCPU and the busiest hour; per day and runner type (GitHub-hosted, larger or self-hosted, operating system, architecture and vCPU), whether the repository is private, and the jobs' number, seconds and billed minutes; and per job, named by its repository (owner/name), workflow file and job name: whether the repository is private, how many times it ran, its median and 95th-percentile duration, its total seconds and billed minutes, up to 5 sets of runner labels it asked for with their counts, its main runner type and the matching Skipbox size, how many runs waited over a minute to start, how many started in each hour of the day, and its share of the peak. While the read runs we also hold the list of runs still to read (each run's ID, repository, workflow file and creation time), deleting each run from it once its jobs are read, and the repositories' names, the job IDs, job names, labels and times, all deleted when the totals are written or the read fails. We use all this to estimate what your organization pays GitHub for Actions and to suggest Skipbox plans. We read each job's runner name only to tell GitHub-hosted runners from others, and never store it. GitHub's answers also carry each run's branch, commit, its author's name and email, and who started it; we drop these without storing or using them. We never read your code, logs, secrets or artifacts.

3. What we don't record

When a job runs, GitHub sends what the job needs to the runner in that job's own virtual machine: your code, the secrets your workflow passes to the job, and a GitHub token for that job. They stay in that virtual machine and are destroyed with it when the job ends. We don't copy or keep them, and we don't record your job logs: GitHub keeps them.

4. Why we use it, and the legal basis

We use personal data only for these purposes, which are also our purposes of use under the APPI. Under the GDPR, each has the legal basis shown.

• Running Skipbox for your organization: signing you in, taking your organization's jobs, running them, counting the trial, and showing your jobs and waits on the dashboard. Basis: our contract with you (Art. 6(1)(b)).
• Estimating what your organization pays GitHub for Actions and suggesting Skipbox plans, from the past CI usage in section 2. Basis: our legitimate interest in showing you whether Skipbox suits your organization (Art. 6(1)(f)).
• Taking payment, refunding, and emailing you about your trial, plan, payments and jobs. Basis: our contract with you (Art. 6(1)(b)).
• Emailing you how to start using Skipbox: your next step after your first sign-in, and that your organization's installer has signed in. Basis: our contract with you (Art. 6(1)(b)).
• Learning why people cancel, from the answer you give to the question before you cancel, to improve Skipbox. Basis: our legitimate interest in improving Skipbox (Art. 6(1)(f)).
• Keeping the payment, refund and cost records that tax law requires. Basis: legal obligation (Art. 6(1)(c)), and our legitimate interest in meeting Japanese tax law (Art. 6(1)(f)).
• Stopping abuse, keeping trials to one per organization and per person, and keeping accounts and servers secure. Basis: our legitimate interest in keeping a shared service working for every customer (Art. 6(1)(f)).
• Answering your emails. Basis: our legitimate interest in replying to you (Art. 6(1)(f)), or our contract when you write about your plan.
• Counting which of our pages, links and headlines bring sign-ups, from the ref and v tags in section 2, and which dashboard prompts lead to purchases, from the via tag. Basis: our legitimate interest in knowing which pages and headlines help people find Skipbox and which prompts help them choose a plan (Art. 6(1)(f)).

You don't have to give us anything, but without a GitHub sign-in and a GitHub organization or personal account Skipbox can't run your jobs, and without payment details you can't subscribe. We make no decision about you by automated means alone. If we stop one of your jobs for abuse (Terms Section 8.2), you can ask us to review it.

5. Who handles it for us

These service providers handle personal data for us, only for the work listed:

• Cloudflare (United States): runs skipbox.dev, its database and the network in front of it, keeps the server records, and forwards mail sent to skipbox.dev to our mailbox.
• Hetzner Online GmbH (Germany): rents us the servers in Finland or Germany (EU) where your jobs run: dedicated servers, and Hetzner Cloud servers that we make for one job each and delete after it. The job records are made there before they reach our database.
• GitHub (United States): signs you in, sends us your organization's jobs and installation events, and receives the runner registrations Skipbox makes for your jobs. GitHub also handles your data under your own agreement with GitHub.
• Stripe (United States): processes your payment and bills your plans each month, or each year with yearly billing. Stripe also uses payment data for its own fraud prevention and legal duties, under its privacy policy.
• Resend (United States): delivers our emails to you.
• Google (United States): our mailbox, where mail to hello@skipbox.dev arrives, runs on Google Workspace and holds the emails you send us and our replies.

We also disclose personal data when the law requires it, for example to a court or a public authority.

6. Transfers outside Japan, the EU and the UK

We are in Japan, which the European Commission and the UK recognize as protecting personal data adequately.

Hetzner Online GmbH, a German company, handles your jobs' data on its servers in Finland or Germany (EU). Japan's Personal Information Protection Commission has designated the countries of the European Economic Area, Germany and Finland among them, as having a system for protecting personal information equivalent to Japan's (Article 28(1) of the APPI).

Cloudflare, GitHub, Google, Stripe and Resend handle data in the United States, and Cloudflare also on its network around the world.

• Under the GDPR, these transfers rely on the EU–US Data Privacy Framework and its UK Extension where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses, with the UK Addendum, in the provider's data processing terms. You can ask us for a copy of these safeguards.
• Under Article 28 of the APPI: the United States has no single federal law like the APPI, and data protection there comes from laws for particular sectors and from state laws such as California's. Japan's Personal Information Protection Commission describes the US system in a report (in Japanese): https://www.ppc.go.jp/files/pdf/USA_report.pdf. Each provider has agreed in its data processing terms to measures equivalent to those the APPI requires, such as using the data only to provide its service to us, keeping it secure, and telling us of breaches. We check these terms once a year. On request, we give you information about these measures (Article 28(3)).

7. How long we keep it

• Your GitHub account, its access token, the address you typed and the organizations we recorded for you: until we delete your account at your request.
• Job records: until 14 days after your organization's plans end; if it never had a plan, until you ask us to delete them.
• Your organization's past CI usage: until the Skipbox app is uninstalled from your organization or suspended, or until you ask us to delete it.
• Which organizations have had a trial, each trial's dates, use and emails, and each organization's ID, name, creation date and installation: kept after your account is deleted, so that each organization has only one trial. For a personal account, these are its GitHub user ID, username and creation date, which are therefore kept after your account is deleted. Which GitHub user had a trial: until we delete your account.
• Which getting-started emails we sent you, your "stop" reply, and why you cancelled: until we delete your account.
• Sign-in sessions: 30 days after you last used Skipbox, or until you sign out.
• Sign-in and trial counts per network: 2 days.
• Daily visit counts of the home page: kept while Skipbox runs; they hold nothing about any visitor.
• Billing records in our database (your plans, how they are billed, their dates, refunds and Stripe's IDs): 7 years after the plan ends, with the payment records below.
• Our cost records of Hetzner Cloud servers, which name the organization whose job each server ran: 7 years, as our accounting records.
• Payment, refund and invoice records: 7 years, as Japanese tax law requires; Stripe keeps its own as Stripe's privacy policy says.
• The prompt a purchase came from: with the subscription's billing records, 7 years; in our server records, 7 days, as below.
• Emails with us: as long as we need them to answer you, and for a payment, as long as its records.
• Server records: 7 days.

• Inside each job's virtual machine: nothing outlives the job (section 3).

8. Your rights

Wherever you live, you can ask us to:

• tell you what we hold about you and give you a copy, by email or in another form you ask for;
• correct it or add to it;
• delete it;
• stop or limit using it, or stop giving it to others, including when you object to a use based on our legitimate interest;
• show you the records of what we gave to third parties;
• send your data to you or to another company in a common format.

You can also withdraw your consent at any time where we rely on it. These rights come from the GDPR (Articles 15 to 21) and the APPI (Articles 33 to 35).

To ask, email hello@skipbox.dev from the address we hold, or tell us how we can confirm it's you. There is no fee. We answer within 30 days, and if we can't do what you ask, we tell you why.

9. Children

Skipbox is a service for businesses and developers and isn't meant for anyone under 18 (Terms Section 2.1). If we learn that a child has given us personal data, we delete it.

10. Public items under Japan's APPI

Article 32 of the APPI requires us to make these items public:

• Our name, address and representative: section 1.
• Purposes of use: section 4.
• How to ask us to tell you the purposes of use, or to disclose, correct, delete or stop using your data: section 8. There is no fee.
• Where to send complaints about how we handle your data: hello@skipbox.dev.
• Our security measures, below.

Security measures

• Fluxenic's representative is responsible for how personal data is handled, and this policy sets out our rules for it.
• Only people at Fluxenic who need personal data for the purposes in section 4 can access it.
• We keep personal data in the services in section 5, not on paper, and sign in to them with a password and two-step verification.
• Connections to skipbox.dev, between our servers, and to these services are encrypted.
• Each job runs in a new virtual machine of its own, which is deleted after the job.
• We store personal data outside Japan knowing how data is protected there (section 6), and review our providers' terms once a year.

11. Questions and complaints

Write to us first at hello@skipbox.dev. You can also complain to a data protection authority:

• in the EU, the authority where you live or work, or where you think the law was broken (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en);
• in the UK, the Information Commissioner's Office (https://ico.org.uk/make-a-complaint/);
• in Japan, the Personal Information Protection Commission (https://www.ppc.go.jp/en/contactus/).

12. Changes to this policy

We post changes here with a new date. If a change affects how we use data you have already given us, we email you before it takes effect, and ask for your consent where the law requires it.