Privacy
Skool Copilot · Diagnostics supplement added October 20, 2026
Skool Copilot helps you manage your Skool communities. This is a short explanation of our privacy practices; the full privacy notice and the separate optional diagnostics supplement provide the details.
What we collect and why
- Account and access: your Copilot email, account details, Skool user ID, membership and plan status, accepted agreements and security records. Copilot has its own login and never asks for your Skool password.
- Your workspace: contacts, notes, tags, saved content, drafts, media, schedules, events and planning records you add or capture through enabled features. Your general CRM workspace stays on your device.
- Cloud features: the Skool session, content, recipients, community and payment-status information, settings and activity records needed for scheduling, monitoring, Auto DMs and Payment Recovery. Recovery can check recent replies to avoid unwanted follow-ups; it does not keep a conversation archive.
- Optional Plan sync: tasks, goals, results, focus records and limited planning context when you enable synchronization across devices.
Copilot uses your signed-in Skool session to check your own community membership directly. It retains the result and verification time, not the session or page content from this check. The verified community owner may also supply the current member IDs, roles, tiers and active status, including members without Copilot accounts; that list excludes names, email addresses, notes and messages.
Optional automatic failure diagnostics
This separate feature requires its own choice in Settings on each installation. Read the Automatic failure diagnostics disclosure (diagnostics-v1) before enabling it. This supplement applies only to that optional feature; existing account and Cloud notices remain available at their original versions.
When you separately enable Automatic failure diagnostics on an installation, Skool Copilot sends limited technical summaries of unexpected failures to its Supabase backend. Authorized support uses this evidence with existing Cloud execution history to investigate a problem you report in the community and identify a correction. Successful activity is not recorded by this feature, and receiving a diagnostic does not automatically start AI analysis.
Summaries are associated with your Copilot account and installation. They contain random event or operation IDs, existing Cloud job IDs when available, feature/stage/error codes, first/latest occurrence times and repetition counts, extension build/browser major version, a bounded sequence of technical stages, and small numeric or boolean context such as HTTP status. Records can indicate discarded evidence or incomplete job correlation. Diagnostic records exclude message contents, text you type, screenshots, page HTML, browsing history, cookies, passwords, access tokens, raw exception messages and raw request/response bodies. Existing account and installation proofs authenticate requests but their secret values are not retained in diagnostic records.
The service stores access-controlled technical metadata; this is not end-to-end encryption. Authorized backend processes and support operators can access it. Other browser accounts cannot read it through the diagnostics service. This feature does not add a general session recorder, collect successful activity, investigate Skool activity automatically, or send information to an AI service.
The first failure starts an approximately 15-minute collection window. Reports normally become available within 15–30 minutes while online, authenticated and the service is available; sleeping browsers, offline devices, unavailable authentication and outages can delay uploads. Repeated failures are combined and pending batches are bounded. There is no daily reporting quota.
Pending local summaries are limited to 100 records and 128 KiB and expire after seven days; local expiry is processed when the extension next handles diagnostics. Server summaries expire 30 days after first receipt and are removed through bounded maintenance, so physical cleanup may occur later. Diagnostics are excluded from workspace backups, Plan sync and cross-device restore. Finite storage and expiry can discard evidence, and some failures leave no diagnostic.
Turning collection off clears pending diagnostics and stops future collection and uploads on that device. An in-flight upload may already have reached the service. Off does not remove previously accepted server records or disable another installation. Logout, account changes and local reset clear pending diagnostics. Optional disclosure acceptance remains on the installation record. Account-data access includes diagnostic metadata, and account deletion removes associated diagnostic records.
Diagnostics do not send, retry or reschedule messages, change a delivery outcome, or preserve message contents as a recovery backup. Existing Cloud execution history, encrypted schedule retention and backup controls retain their separate purposes and rules. A missing diagnostic does not establish that an operation succeeded or that a retry is safe.
Your choices
Accepting the account agreement enables membership verification and prepares the Skool connection for eligible Cloud tools. This can let authorized work run while your computer is off. You separately choose the schedules, communities and automations to enable; Plan sync is optional. Preparing a connection does not itself start monitoring or send messages.
Where data is stored and shared
Local records and downloaded backups are readable by someone with access to those files or your browser profile. Supabase hosts account and enabled Cloud services in Paris, France. Skool sessions and supported Cloud content are encrypted with server-managed keys; they are not end-to-end encrypted. Plan sync uses access-controlled records without that additional content-encryption layer.
We use HTTPS. Supabase provides authentication and backend services; Namecheap Private Email delivers account emails. Skool and its media providers, Amazon S3 and Mux, receive authorized content and uploads. GIPHY receives searches when you use its GIF search. These providers may process request metadata, including IP addresses, outside the EU. Exports go to destinations you choose.
Retention and deletion
Local records stay until you delete them or clear the extension’s data. Account and active service records stay while needed. Completed Cloud content normally becomes eligible for cleanup after seven days, most job history after 90 days, and notification events within 30 days. Active work, limited security records and provider backups have separate retention rules in the full notice. An aggregate recovery-revenue total without stored owner or member identifiers may remain.
Account deletion removes linked live Cloud and Plan records. It does not erase local work, downloaded backups or content already posted to Skool. Signing out or turning sync off does not delete saved data. Stop or cancel workflows you no longer want.
Use of your information
Skool Copilot complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use data only to provide or improve disclosed features. We do not sell it or use or transfer it for personalized advertising. Transfers are limited to those features, security, legal requirements, or a business transfer with your explicit prior consent. Human access is limited to your consent to specific information, necessary security or legal work, or aggregated and anonymized data for internal operations.
We process necessary service data to fulfil our agreement with you and use legitimate interests for security and membership-access checks. Community operators are responsible for their member workflows.
Contact and your rights
Skool Copilot is provided by Amirthan Puvaneswaran trading as Avino Labs, a Finnish sole trader (Business ID 3383759-5), independently of Skool. Email copilot@avinolabs.com to request access, correction, deletion, portability, restriction or objection, or a review of an access decision. You may complain to Finland’s Data Protection Ombudsman.