Privacy Policy

Version 2026-09-29

This explains what Norns collects when you use Skema, what it does not collect, what the people who run Skema can and cannot see, who else handles your data, how long it is kept, and what you can ask us to do about it.

In short

We collect what is needed to run your account, keep it secure, and store your workspace.
No advertising, no third-party analytics, no tracking pixels, no session recording. Every script, style and font is served by Skema itself.
The operator console shows accounts, counts and errors — never the content of your workspace.
When you use a model-backed feature, the text it needs is sent to a model provider.
We do not sell personal data, and Skema does not train any model on your content.

Who is responsible

Norns operates Skema and decides how your account, sign-in and website data are used. The content of a workspace belongs to the organisation that owns the workspace; we store and process it on their behalf to provide Skema. Questions about a workspace’s content usually go to its owner first, and we will help them.

What we collect

What	Details	Why
Account	Your email address (which is also your sign-in name), your password stored only as a salted hash, your role and the domains it applies to, when the account was created, whether your email is confirmed, and whether the account is active. The name you give when you sign up is held only while the sign-up is in progress.	To let you sign in and to enforce who may do what.
Company sign-up	If you sign up for a company: the company name, website and size, and your name and role. These are recorded as you declared them; we do not verify them.	To know who a workspace is for.
Sign in with Google	Only if you choose it: your Google account’s stable identifier, its email address, and whether Google has confirmed that address. Nothing else from your Google account.	To sign you in.
Two-step sign-in	The authenticator secret you set up, a record of each device you chose to trust (30 days), and one-time codes (stored hashed, valid for 10 minutes).	To confirm it is you.
Sessions	A random session token, when it started and when it expires (12 hours).	To keep you signed in.
Acknowledgements	Which document and version you acknowledged, when, and the network address it came from.	To show which terms you agreed to.
Workspace content	The schema, proposals, rationales, evidence, comments, decisions and signatures, competency tests, releases, uploaded documents and what was read from them, notifications, invitations (the invitee’s email and role) and release subscriptions (the address a notice is sent to).	This is the service.
Security records	Sign-in attempts and their outcome, refused requests, changes to accounts and permissions, and every view of the operator console — each with the time, the account, the action, the outcome and the network (IP) address the request came from. Changes to accounts, roles and permissions are also kept with the account records as evidence of who changed what.	To detect and investigate misuse.
Request log	For each request: the time, the kind of request, the address with identifiers removed, the result, how long it took, the workspace, whether the caller was signed in, and a reference number. Visitors are counted per day with a value derived from the network address, a secret and the date, which cannot be traced back to the address and changes every day. No IP address and no account name are stored here.	To see what is used and what fails.
Model usage	How many model-backed actions were used per day — counted per person to apply daily limits; shown to the operator only as totals per workspace.	To apply limits and control cost.
Problem reports and feedback	What you type, the page you were on, the reference number of a failed request if there was one, your account name if you were signed in, and the workspace.	To fix what you reported.
Website visits	Only when visit counting is switched on for the site: a random visitor identifier in a cookie, the page, the host name of the site that linked to it, whether the screen is a phone, tablet or desktop, and the date. Never linked to an account.	To know whether anyone reads the site.
Email	Your address and the message we send.	To deliver the emails listed below.

What we do not collect

No payment card or bank details. Skema takes no payments in the product.
No advertising identifiers, third-party analytics, tracking pixels, session recording or social-media plugins.
No browser fingerprint: we do not store your browser’s full user-agent string, and the request log and visit counts keep no IP address.
No precise location. The only location-like data is the network address in security records and acknowledgements.
Nothing from your Google account beyond what is listed above.
Your password itself is never stored, and it is never sent to anyone.

What the people who run Skema can see

Named product administrators use an operator console. Each view they open, and each export they take, is recorded with who did it. The console shows:

workspaces, their state, when they were created and how many members they have;
accounts: email address, role, whether active, whether the email is confirmed, and whether a temporary password is still in use;
who is signed in, with when each session started and expires;
sign-ups that were not finished and invitations not yet accepted, with the email addresses involved;
the request log and failed requests (addresses, results and reference numbers — not their content);
model usage totals per workspace, storage size per workspace, and backup and restore status;
security records, including network addresses;
problem reports and feedback, as you wrote them;
the console’s own audit log.

What they cannot see

The console cannot display the content of a workspace: its schema, proposals, documents, decisions or comments. Its exports contain only counts and identifiers.
Nobody can see your password, only a hash of it.
The limit, stated plainly. The people who operate the servers can technically read workspace data, because Skema must work on it unencrypted in order to reason over it. We do not look at it in the ordinary course of running the service. If we ever must — to restore service, to investigate abuse or a security incident, or because you asked — the access is time-limited and recorded in an access ledger with the reason and the person at your organisation who approved it. If an emergency does not allow asking first, it is recorded as an emergency and we tell you afterwards.

What the model provider sees

These features send text to a model provider: reading uploaded documents, extracting facts from them, drafting terms, proposals and change sets, suggesting edits and relationships, second opinions on a proposal, drafting the merge of duplicate terms, and matching terms by similarity.

What is sent: the text the feature needs — excerpts of your documents, term names and definitions, proposal text, and the recorded reasons of related decisions in the same workspace. If a document contains personal information, that information is sent too.
What is not sent: passwords, one-time codes, cookies, session tokens, or your account details.
Who: on skema.world, Google Cloud Vertex AI (Gemini models), with requests pinned to the asia-south1 region in Mumbai, India. Google processes these requests under its Google Cloud terms.
What comes back is labelled advisory, and nothing a model produces is applied without a person accepting it.

Other service providers

Provider	What it does	What it receives
Google Cloud	Runs the servers, stores the data and its backups, and provides Vertex AI.	Everything Skema stores, held in the asia-south1 region; model requests as described above.
Resend	Delivers email from contact@skema.world.	Your email address and the message: email confirmation codes, sign-in codes, password reset codes, workspace invitations, and security notices about your account.
Google Sign-In	Signs you in, only if you choose it.	The sign-in request; Google returns the details listed above.
GoDaddy	Hosts the mailbox that receives mail sent to contact@skema.world.	Whatever you write to us.

We do not share personal data with anyone else, except where the law requires it.

Cookies and browser storage

Skema sets only its own cookies. None is used for advertising or to follow you on other sites, and none can be read by scripts on the page.

Name	Purpose	Lasts
`skema_session`	Keeps you signed in.	Until you sign out or close the browser; the session itself ends after 12 hours.
`skema_tenant`	Remembers which organisation you are signing in to.	Until the browser is closed.
`skema_2fa`	Holds a two-step sign-in while it is in progress.	10 minutes.
`skema_trusted`	Remembers a device you chose to trust for two-step sign-in.	30 days.
`skema_oauth_state`	Protects Sign in with Google against forged requests.	10 minutes.
`skema_v`	Counts returning visitors to the public site. Set only when visit counting is switched on, and never linked to an account.	1 year.

The workspace also keeps a few things in your browser’s own storage. They stay on your device and are not sent to us:

skema:entered — that you entered the workspace in this tab;
skema.tour.v1 — which guided tours you have seen;
skema.composer.draft and skema.author.draft — a draft you have not sent yet, until you send or discard it;
skema.graph.mode and saved graph layouts — how you arranged the graph.

How long we keep it

Accounts — while the account exists. A deactivated account’s name stays on the decisions it signed.
Sign-in data — a session is valid for 12 hours and is deleted when you sign out; one-time codes and two-step sign-in challenges are valid for 10 minutes; a trusted device is trusted for 30 days; an unfinished sign-up (your name and email) expires after 24 hours; an invitation expires after 7 days. Nothing expired can be used, but some expired records stay stored until they are cleared out.
Request log — each request’s row for 30 days; daily totals are kept after that.
Security records — in a size-limited log on the server, where the oldest entries are removed as new ones arrive, and in the hosting platform’s logs under its retention settings. The evidence of changes to accounts, roles and permissions is kept permanently and cannot be deleted.
Workspace content — while the workspace exists. Its governance record is append-only.
Acknowledgements — while the account exists, as the record of what was agreed.
Problem reports, feedback and website visit records — until they are deleted; nothing deletes them automatically yet.
Backups — deleting something does not remove it from backups already taken; it is gone from those when they are deleted.

Your rights and choices

You can ask for a copy of your personal data, ask us to correct it, to delete it, or to stop using it for a purpose. Write to contact@skema.world; we will reply and tell you what we did.
What deletion can and cannot remove. We can close your account, delete facts read from documents, and remove quoted text from rationales and evidence — which leaves a visible note that it was removed under a request. The name of the account that signed a past decision stays in that workspace’s governance record, because the record of who decided is what the workspace relies on.
You can turn on two-step sign-in, forget trusted devices, and sign out of a session at any time.
You can block cookies in your browser. Signing in needs skema_session; the site works without the others.
You may also complain to the data protection authority where you live.

Where your data is held

Skema runs on Google Cloud in the asia-south1 region (Mumbai, India), and each workspace is stored in its own database. Email delivery by Resend and Sign in with Google may process data outside India.

Security

How accounts, sessions and workspaces are protected is described on the Security page.

Changes to this policy

This policy carries a version and a date. When it changes, Skema asks you to read and acknowledge the new version before you continue, and records which version you acknowledged and when.

Contact

Write to contact@skema.world with any question or request about your personal data.

Acknowledge

Acknowledging records, against your account, that you have read and agree to the Terms of Service (version 2026-09-29) and the Privacy Policy (version 2026-09-29), with the date and time. If you are not signed in, you will be asked to sign in first.