This is a prototype, and the paperwork is not finished
The contract with the company that rents us the server is signed, and it commits in writing to keeping your data inside Europe. The one with the company that runs the language model is not: it applies automatically because we accepted their published terms, rather than being negotiated for us. And one important thing is still unconfirmed: Mistral has not told us in writing which country processes your messages. Their website says Europe. A website is not a contract, and we would rather tell you the difference than let you assume it away.
That is why the product is invitation-only and why we ask you to keep genuinely sensitive specifics general. When those agreements are signed, this page will say so and say when.
The controller
The data controller is Negodom Kft., a company registered in Hungary.
1118 Budapest, Ménesi út 63–65. fsz. 2., Hungary
Tax number: HU23372492
Contact for anything in this notice: fbal.public@gmail.com.
Everything, listed
- Your account. Email address, a name if you give one, and a hashed password. We never see your password.
- Your conversations. Everything you write to the coach and everything it writes back, kept so the conversation can continue.
- What the coach remembers. Three short notes it keeps between conversations: how you have asked to be worked with, what you are working on, and where recent conversations got to. You can read, change or delete these at any time — see section 06.
- Documents you attach, if you attach any. These are deleted automatically about a day after the conversation goes quiet.
- Technical records. Usage counts, and your IP address as seen by the service that puts the site on the internet.
Much of this is special-category data under Article 9 — what you bring to coaching may touch health, beliefs or your private life. That is why the legal basis below is your explicit consent and nothing weaker.
Your explicit consent, and only that
We rely on Article 9(2)(a) — your explicit consent — to hold and process what you write. You give it when you ask for an invitation and again before your first session.
You can withdraw it at any time, and withdrawing it does not make anything you did before unlawful. Withdrawal means we stop and delete; see section 06.
We do not use your conversations for marketing, we do not sell them, and no advertising company receives anything. No decision with a legal effect on you is made automatically.
Three companies, named
- Mistral AI SAS (France). The language model. Your message and the coach's reply pass through their European endpoint each turn. Their data-processing agreement applies to us by reference. We have asked them to confirm in writing where processing actually happens and have not had that answer yet — so we do not claim it as a promise.
- Hetzner Online GmbH (Germany). Hosts the service, on a rented server in Helsinki, Finland. Their data-processing agreement is signed and commits in writing to keeping the data inside the EU/EEA — of the three companies here, this is the only one where that is a contractual term rather than a statement on a website. The disk is encrypted.
- Cloudflare, Inc. (United States). Answers the question "what address is skyproof.ai?" — nothing more. It is our DNS provider, so it sees that somebody looked the name up; it does not see who you are or anything you write. Their data-processing terms apply to us automatically, and transfers to the United States are covered by the European Commission's Standard Contractual Clauses. This changed on 6 August 2026. Until then the site ran through a Cloudflare tunnel, which decrypted and re-encrypted everything as it passed, so Cloudflare could in principle read what you wrote. It no longer sits in that path: the connection from your browser now terminates on the Finnish server itself. We are recording what used to be true rather than quietly improving our history.
Nobody else receives your data — no analytics, no trackers, no third-party fonts. This page and the rest of the site make no requests to anyone but us.
Retention, honestly
- Conversations and memory: kept until you delete them or ask us to.
- Attached documents: deleted automatically about a day after the conversation goes quiet.
- Backups: an encrypted copy is taken nightly and kept for 14 days. Something you delete today can persist in a backup for up to two weeks before ageing out.
Your rights, and where they actually work
You have the right to see your data, correct it, delete it, restrict or object to how it is used, take a copy elsewhere, and withdraw consent. In practice:
- See and change what the coach remembers: the memory page inside the app, at any time, without asking anyone.
- Delete a conversation: in the app.
- Everything else — a full copy, complete erasure, or withdrawing consent — email fbal.public@gmail.com. A person does it by hand and confirms when it is done.
One limitation we would rather you heard from us. If you correct something on the memory page, the correction can currently be overwritten when the coach next updates its notes. Deletion holds. This is a known fault, it is being fixed, and until it is: if a correction matters, delete the note instead.
If you are unhappy with how this is handled, you can complain to a data protection authority — either the one in the country you live in, or ours. Ours is the Hungarian NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság), because Negodom Kft. is established in Hungary. The servers being in Finland does not change that.
How you will know
When this notice changes, the date at the top changes and the change is described rather than quietly applied. If a change materially affects what happens to your words, you will be told directly, not left to notice.