Privacy Policy

1. Introduction

Welcome to SkillTrees & RoadMaps — a personal growth and visualization app built and maintained by Bimsara Jayalath. This Privacy Policy explains how SkillTrees & RoadMaps handles your data, what information (if any) is collected, and how your privacy is protected when you use the app or its website.

By using SkillTrees & RoadMaps, you agree to the terms of this Privacy Policy.

2. Data We Collect

When you use SkillTrees & RoadMaps, we collect limited data needed to run account, sync, and sharing features. Specifically, we may collect:

• Account identifiers (for example, email address and auth user ID) when you sign in.
• Skill tree data you create, including text, titles, and node descriptions.
• Any custom images you upload, which are stored securely in Firebase Storage.
• Operational metadata needed to enforce product limits and account entitlements (for example, cloud/public usage counters and plan state).
• Billing metadata from our payment processor (for example, subscription status, renewal/expiry dates, and provider customer or subscription IDs required for entitlement and support flows).
• Limited purchase recovery metadata (for example, normalized purchase email and subscription identifiers) used to support secure restore-purchase flows.
• Template submission/review metadata (for example, submission status, requested template fields including slug, moderation notes, and marketplace listing state) when you submit public trees for review.
• Local on-device data (for example, local trees, drafts, and viewer cache) stored in browser storage to improve performance and preserve work. Guest or local-only data is stored on the current device/browser and is not an account-backed cloud backup.

This data is used to provide save/sync, public sharing, account management, and service reliability features.

3. Where Your Data Is Stored

Your data may be stored in two places:

• In your browser/device (local storage and cache for local trees, drafts, and recently viewed public content).
• In Firebase services hosted on Google Cloud (for account-linked trees, uploaded media, and backend account operations).
• In Lemon Squeezy systems for checkout, billing, and subscription lifecycle processing.

We do not sell your personal data. We may share data only with infrastructure providers that process data on our behalf to operate the service.

Guest and local-only data may be lost if you clear browser/app storage, uninstall the app, change devices or browsers, use private browsing, run storage-cleanup tools, or if local device storage becomes unavailable. We generally cannot recover local-only data that was never synced to an account.

4. Public Trees, Embeds, and Forking

Trees are private by default. If you publish a tree, its content becomes publicly accessible to anyone with the public link until you unpublish it. You control whether a public tree allows forking. When forking is allowed, other users can create their own copy based on your public version.

The allow-forking setting controls whether new forks can be created at that time. It does not retroactively remove or delist forks that were already created, because those forks are independent copies owned by the users who forked them.

Publishing a tree is a user-controlled action. Users are responsible for the content they publish or keep private, and content responsibility and platform liability limits are described in our Terms of Use.

Public viewers may temporarily cache a version of a public tree for performance reasons, which can delay how quickly updates appear to all viewers.

Embeddable trees are read-only public views delivered via iframe. When an embed is loaded, our infrastructure providers may process standard network/request metadata required to serve content (for example, IP address, user agent, and referrer) under their own service and privacy terms.

If a template is listed with a slug URL, that slug and associated template metadata are publicly visible as part of discovery and linking features.

5. Analytics

We use Firebase Analytics to measure high-level product usage and improve onboarding and subscription flows. Analytics events are collected in aggregate and are not used for advertising.

These analytics events are designed to avoid direct personal content. For example, we may track events such as sign-up, login, public tree publish actions, pricing CTA clicks, and trial activation state changes.

We do not send your private skill tree content (such as node text or descriptions) to analytics. We also do not send full payment card details to analytics.

You can limit analytics collection through browser/device privacy controls (for example, blocking analytics scripts/cookies), though some core app functionality relies on Firebase services.

6. Cookies and Local Storage

SkillTrees & RoadMaps uses Firebase Authentication, which may rely on cookies or local storage to maintain your login session. The app also uses local storage and caching for local trees, drafts, and performance-related viewer data, including embedded public-tree rendering. These technologies are used for core product functionality, not for advertising.

Clearing cookies, local storage, IndexedDB, app data, or browser data can remove guest/local trees, drafts, cached public views, and login state from that device.

7. Third-Party Links

The app or website may contain links to other platforms, including support pages, the developer’s portfolio, and links added by users inside public tree content. These sites are not operated by us, so please review their privacy policies before using them.

If a public tree or embed appears on a third-party website, that site may apply its own cookies, analytics, and privacy practices in addition to ours.

User-added outbound links may take you away from our Service. Once you open another website, that website may process information such as your IP address, browser details, referrer information, cookies, and any information you choose to provide there under its own terms and privacy policy.

8. Data Security

Your data is securely stored using Firebase Authentication, Firestore, and Firebase Storage. These services use encryption both in transit and at rest. While we take reasonable measures to protect your information, please use a secure device and avoid sharing your account credentials, as we cannot control third-party access to your devices or accounts.

9. Children’s Privacy

SkillTrees & RoadMaps is intended for general audiences and not directed toward children under 13. We do not knowingly collect or store information from minors.

10. Your Rights and Data Control

You can:

• Access your data by logging into your account.
• Delete trees directly in-app, or request account deletion through available in-app account flows or by contacting us.
• Revoke app access at any time through your Google Account settings.

11. Changes to This Policy

We may update this Privacy Policy as the app evolves. The “Last updated” date above will always reflect the latest version. Any significant changes will be announced in-app or on our website.

12. Firebase, Payment, and Backend Services Used

We use the following services to operate the app:

• Firebase Authentication (for secure login)
• Cloud Firestore (for account-linked tree data and metadata)
• Firebase Storage (for user-uploaded media)
• Firebase Analytics (for aggregated product analytics)
• Lemon Squeezy (for checkout and subscription billing)
• Cloud Functions (for account operations, entitlement/limit checks, and public tree lifecycle actions)

These services are provided by Google LLC and are subject to Google's privacy and security terms.

Payment processing is provided by Lemon Squeezy. We do not directly collect or store full payment card details. Lemon Squeezy may process personal and transaction data under its own legal terms and privacy policy.

For restore-purchase safety, we may keep minimal orphaned purchase metadata until linked, expired, or no longer required for support, fraud prevention, or legal compliance.

13. Data Retention

We retain account-linked data while your account is active, and we delete or anonymize data when no longer required for service operations, security, or legal obligations. Local data stored on your device remains under your control and can be removed by clearing app/browser storage.

Because guest/local-only data remains on the device and is not necessarily transmitted to our servers, account deletion requests do not remove copies that remain only in your local browser or app storage. You can remove that local data by clearing app/browser storage on the relevant device.

If you submit an account deletion request, we will process deletion of associated account data within a reasonable operational timeframe.

Template moderation records and related audit metadata may be retained for fraud prevention, abuse response, dispute handling, or legal compliance as permitted by applicable law.

14. Contact

If you have any questions about this Privacy Policy, contact us at: pramoddhhalo@gmail.com

or visit our official website once live at https://skilltreesapp.com/