What Skylight keeps, and what it never sees

Your Skyward password

It is used for one thing: signing in to Skyward as you. In guest mode it is not stored at all. You type it, Skylight uses it, and it is gone when you close the tab. With an account it is stored encrypted, under a key that comes from your Skylight password, which Skylight does not keep.

What-if math never leaves your browser

The what-if calculator and the solver run in the page you are looking at. Nothing you try is uploaded, logged or visible to anyone, including whoever runs Skylight.

The AI overview stores nothing

Turn it on and Skylight can write a short summary of how your classes are going. It is sent only your course names and grades, not your name, your login or your schedule. It runs on Cloudflare Workers AI, and neither the request nor the answer is stored. Leave it off and it never runs.

Notifications

Phone notifications use Web Push. Each message is encrypted to your device before it leaves, so the service relaying it cannot read it. Subscriptions are deleted when you turn notifications off, drop the background-alerts level, or delete your account.

Anonymous usage counts

Skylight counts how it gets used, so it can tell what is worth improving: how many times each page was opened, how many people signed up, signed in or synced, and how often each feature was used. Those are totals per day, never a record of what any one person did. They are kept on Skylight's own server, and no outside analytics company sees them.

It also counts how many different students used it each day and each month. To do that without knowing who they were, it makes a new random key every day and every month, turns each student into a code under that key, and stores only the code, so the same student counts once. When the day or month ends, the codes are counted and then deleted along with the key. Codes from different days cannot be matched to each other, because each day's key is different. For people browsing without signing in, the code is made from their network address and their browser's user-agent string. Those two values are used only as the input to the code and are never stored as themselves. The codes for a day or a month are kept only until that period ends, then counted and deleted, and only the counts remain. Because the key changes every period, the same visitor gets a different code the next day or month, so codes cannot be linked across periods.

No cookie is set for this and nothing is stored in your browser. If your browser sends Do Not Track or Global Privacy Control, nothing is counted from it at all.

Your account identity

There is no email address. You sign in with a Skylight username, which starts out as your Skyward username, and a working Skyward login is what proves the account. The account is tied to its student by a keyed one-way hash of the Skyward username; the username itself is never stored. That is what lets you reset a forgotten password by signing in to Skyward again, and why there is one Skylight account per student.

Deleting everything

Settings has a Delete everything button. It removes every row Skylight holds about you: the account, the keys, the encrypted blobs, your settings, your sessions and the audit log. Nothing is kept for later and nothing can be recovered.

Changes to this page

Skylight is a small independent project, not a company with a legal department. If what it stores changes, this page changes with it, and anything that stores more than before starts off.