Cookie Policy

This notice provides transparent and complete information, based on Regulation (EU) 2016/679 (GDPR), Article 5(3) of the ePrivacy Directive (2002/58/EC) and Section 155(4) of Hungarian Act C of 2003 on Electronic Communications (Eht.), about which cookies and similar technologies skillion.hu uses, for what purpose and for how long, and how you can control them.

A cookie is a small text file stored by your browser on your device that the website can read back on later visits. In line with EDPB Guidelines 2/2023, this notice also covers technologies treated the same way as cookies, in particular the browser localStorage.

(Hereinafter: Skillion Kft. or Service Provider.)

• Strictly necessary: technologies essential for providing the service you requested (login, session, language preference, storing your cookie decision). Legal basis: GDPR Art. 6(1)(b) (performance of a contract); they fall under the ePrivacy Art. 5(3) exemption, so no consent is required, which is why they cannot be switched off.
• Analytics: anonymous visitor statistics (Umami) and product analytics (PostHog). They run only with your prior, explicit consent (GDPR Art. 6(1)(a)). Off by default.
• Marketing / ad measurement: the ad-measurement technologies of Meta (Facebook, Instagram) and TikTok (Meta Pixel, TikTok Pixel and the related server-side event reporting). They run solely on the basis of your prior, explicit consent (Article 6(1)(a) GDPR); they are off by default and are not even loaded until consent is given.

We use no pre-ticked boxes, scrolling or continued browsing does not constitute consent, and non-essential technologies do not load at all until consent is given.

The following first-party (skillion.hu) cookies are required for the basic operation of the website:

In production (HTTPS) the better-auth cookies carry the __Secure- prefix (for example __Secure-better-auth.session_token) and are transmitted over encrypted connections only.

The following data is kept in your browser localStorage (these are not cookies and are not transmitted to the server). They solely serve features you requested and are not used for analytics or marketing:

For visitor statistics we use the open-source Umami software hosted on our own server. The Umami tracking script only loads if you consented to the Analytics category in the cookie banner.

• Umami is cookieless: it sets no cookies and writes nothing to browser storage (localStorage, sessionStorage).
• We do not store IP addresses: visitors are distinguished by an irreversible hash created with a daily-rotating key, from which the IP address cannot be recovered.
• We only measure aggregate data: pages viewed, referrer, browser and device type, country.
• The data stays on our own server, is not shared with any third party, and is not combined with any other processing.
• We honor your browser Do Not Track signal even when you have consented.

To understand how the service is used (which features are used, where the post-signup onboarding stalls) we also use the PostHog product analytics service (PostHog Inc.), on servers operated exclusively in the European Union (Frankfurt). The PostHog script only starts if you consented to the Analytics category in the cookie banner; it then stores the following in your browser:

• For signed-in users the events are linked to the internal user id, so web and mobile app usage belongs to one user; no name or e-mail address is sent to PostHog.
• Data measured: pages viewed, clicks and form submissions on page elements (without what was typed), the product events we define (for example onboarding steps, generations), browser and device type, country. We record no keyboard input or screen recordings, and PostHog does not store the IP address.
• When consent is withdrawn, measurement stops immediately and the cookie and localStorage entries above are deleted. We honor your browser's Do Not Track signal even when you have consented.

To measure the performance of our advertising campaigns we use the Meta Pixel (Meta Platforms Ireland Ltd.) and the TikTok Pixel (TikTok Technology Ltd.). These scripts are loaded only after you have consented to the Marketing category; until then no data reaches Meta or TikTok. Data collected with your consent (event and page data, IP address, browser data, click and browser identifiers) is processed under the joint controllership of Skillion Kft. and the given provider for the collection and transmission stage, and by the provider as an independent controller thereafter. Details: section 5 of the Privacy Notice, plus the privacy policies of Meta (https://www.facebook.com/privacy/policy) and TikTok (https://www.tiktok.com/legal/privacy-policy).

With your consent, our server also transmits conversion events (e.g. registration, purchase) to the Meta Conversions API and the TikTok Events API together with the identifiers above. Consent can be withdrawn at any time in the cookie settings; upon withdrawal the cookies above are deleted immediately and the transmission stops (Article 7(3) GDPR).

For payments you are redirected to the checkout page of Polar Software Inc. (our merchant of record) running on its own domain; Polar sets no cookies on skillion.hu. The data you provide during payment (name, email, billing details, IP address) is processed by Polar as an independent controller; see its privacy policy: https://polar.sh/legal/privacy

On your first visit a cookie banner appears in which the Accept and Reject buttons are equally prominent, and the Settings button lets you decide per category. We use no pre-ticked boxes, non-essential categories are off by default, and scrolling or continued browsing does not constitute consent.

Your decision, including a refusal, is remembered for 6 months, after which we ask again. If this notice changes materially, we ask for your consent again.

You can withdraw or change your consent at any time, just as easily as you gave it: via the Cookie Settings item in the profile menu, the Cookie Settings link in the footer, or the button at the top of this page. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To meet our accountability obligation (GDPR Art. 7(1)) we record a log entry for every decision, containing only the following: a random identifier (the UUID stored with your decision), your user ID if you are signed in, the content of the decision per category, the method of the decision, the version of this notice, the interface language and a timestamp. We log no IP address and no browser fingerprint. Log entries are retained for 5 years after the consent ends (the general limitation period under the Hungarian Civil Code).

You can also delete or block cookies in your browser settings:

• Chrome: Settings → Privacy and security → Third-party cookies
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Edge: Settings → Cookies and site permissions
• Safari: Settings → Privacy → Cookies and website data

Please note that if you block strictly necessary cookies, some features of the website will not work properly (for example you will not be able to sign in, or your language preference will not be kept).

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw your consent at any time. You can submit requests to mail@support.skillion.co; detailed information is available in our Privacy Policy (https://skillion.hu/privacy).

If you believe the processing is unlawful, you can lodge a complaint with the supervisory authority, in Hungary the National Authority for Data Protection and Freedom of Information (NAIH), or with the supervisory authority of your member state of residence, and you may also turn to the courts:

We review and update this notice from time to time, for example when introducing a new service or technology. In case of a material change the cookie banner reappears and we ask for your consent again.