Privacy Policy
Last updated: 9 October 2026
1. Data controller
Skorio is run by Torfo, Anemonenstraat 5, 1713 JW Obdam, The Netherlands. KvK 69125414. Contact: support@skorio.app. We do not have a formal data protection officer; for privacy questions, write to the contact address above. This policy covers the Skorio web app, the Android and iOS apps and this website.
2. What data we collect
Account data: your email address, display name, language and time zone.
Sign-in data: you usually sign in with a 6-digit code that we email to you. We store only a hashed version of the code and the IP address it was requested from (to stop abuse), and delete both within 24 hours. A password is optional; if you set one, we store only a hash of it, never the password itself. If you add a passkey, we store only its public key, a technical credential ID, the name you give it and when it was created and last used. Your fingerprint, face or device PIN never leave your device.
Game data you enter: games, results, scores, player names, notes, ratings, comments, GGs and tournaments.
Friends and guests: your friend connections and the email addresses of guests you invite.
Photos (coming soon): once photo upload is available, you will be able to upload photos, for example a profile picture or a game image. We only receive the photos you choose to upload and store them with your account. Uploading is always optional, and Skorio never reads your photo library on its own.
Push notification token (mobile apps): if you allow notifications, your device gets a push token from Google Firebase Cloud Messaging (and, on iPhone, Apple Push Notification service). We store this token with your account so we can send you notifications, for example when a friend logs a game with you. It is optional and is removed when you log out.
Purchase data: on the web, Skorio Pro is paid through Stripe; we receive a transaction reference and your Pro status, never your card details. In the mobile apps, in-app purchases (coming soon) are paid through Google Play or the Apple App Store and handled by RevenueCat; we receive your Pro status and a purchase reference linked to your account ID, never your payment details.
Usage telemetry: page views, errors and performance metrics via Microsoft Azure Application Insights. We use it to keep Skorio working and to improve it, never for advertising profiles.
Messages you send us: support emails and in-app feedback.
We do not sell your data, we show no ads and we do not track you across other apps or websites.
3. Purposes and legal bases
Account, sign-in, game, friend and photo data, and purchases: to provide Skorio to you, which is contract performance (Art. 6(1)(b) GDPR). The IP address stored with a sign-in code: our legitimate interest in keeping accounts safe from abuse (Art. 6(1)(f)). Push notifications: your consent (Art. 6(1)(a)); you can withdraw it at any time by turning off notifications for Skorio in your device settings. Telemetry: our legitimate interest in keeping the service reliable and improving it (Art. 6(1)(f)). Payment records: legal obligation under Dutch tax law (Art. 6(1)(c)). Support emails and feedback: our legitimate interest in answering you and improving Skorio (Art. 6(1)(f)).
4. Third-party processors
Hetzner Online (server and database hosting in Germany) · Microsoft Azure / Application Insights (telemetry) · SendGrid by Twilio (emails, including sign-in codes) · Stripe (payments on the web) · Google Firebase Cloud Messaging and Apple Push Notification service (push notifications) · RevenueCat (in-app purchases in the mobile apps, once available) · Atlassian (our support desk for emails and feedback) · Capawesome (delivery of mobile app updates). All processors are bound by data processing agreements. In-app payments themselves are handled by Google Play and the Apple App Store under their own privacy policies.
5. International transfers
Your account and game data are stored in the EU (Germany). Some of our processors may transfer data outside the EEA. Such transfers are covered by Standard Contractual Clauses, the EU–US Data Privacy Framework or equivalent safeguards under GDPR Chapter V.
6. Retention
Account data is kept for as long as your account is active. If you delete your account in the app, it is deleted immediately; deletion requests sent by email are handled within 30 days. Sign-in codes and their IP addresses are deleted within 24 hours. Push tokens are removed when you log out or when they stop working. Telemetry data is kept for 90 days. Database backups are kept for 14 days. Payment records are kept as required by Dutch tax law (7 years).
7. Deleting your account
You can delete your account yourself in the app: go to Settings → Delete account (in the mobile app: Menu → Settings → Delete account) and enter the 6-digit code we email you. Your account and the personal data linked to it are then deleted immediately, and we confirm by email. Results you shared with other Skorio users stay in their history, with your name replaced by “Deleted player”. If you can no longer sign in, email support@skorio.app from the email address linked to your account and we delete it within 30 days. The only exception is payment records we must keep by law (see Retention). Step by step: Delete your Skorio account.
8. Your rights
Under GDPR you have the right to: access your data; rectify inaccurate data; erase your data (right to be forgotten); receive your data in a portable format; object to processing based on legitimate interest; withdraw consent where processing is based on consent. To exercise any right, email support@skorio.app. We respond within one month.
9. Children
Skorio is meant for people aged 13 and older and is not aimed at children under 13. Under Dutch law (UAVG Article 5), users aged 13 to 15 need permission from a parent or guardian to use Skorio. We do not knowingly process data of children under 13, or of 13- to 15-year-olds without that permission. If you think a child has created an account against these rules, contact us at support@skorio.app and we will delete the account promptly.
10. Cookies
This website uses one preference cookie to remember your language choice. See our Cookie Notice for details. The apps keep your sign-in session and preferences in your browser's local storage or on your device.
11. Security
We use industry-standard measures, including encrypted connections (HTTPS/TLS), hashed passwords and sign-in codes, passkeys based on public-key cryptography, and access controls. No system is perfectly secure; if you suspect a breach, let us know right away at support@skorio.app.
12. Changes
Material changes will be communicated by email or in-app notice at least 14 days in advance.
13. Complaints
You have the right to lodge a complaint with the Dutch data-protection authority: Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl.