How Skuto handles your data

The short version

• There are no ads and no accounts here. We never ask for your name.
• In the EU, the UK, Switzerland, Norway, Iceland and Liechtenstein, the analytics cookies stay off until you press Accept. Everywhere else, they're on by default (if we can't tell where you are, we ask first). Clarity makes its own location check, so see the Clarity section below for how it differs. You can switch them off at the bottom of this page.
• Apart from a quick country lookup, the tools do their work in your browser. The Paste Checker never sends the text you paste anywhere.
• The one exception is the Prompt Fixer: it's built to send your prompt to an AI company to be rewritten (the service is switched off right now). Don't put anything private in it.

Google Analytics

Google Analytics tells us how many people read a page and which tools actually help. It loads on every page, but before it does anything we set all four of Google's storage switches to "denied": analytics, ads, ad data and ad personalization. The three ad ones never change, because Skuto runs no ads.

The analytics switch flips to "granted" in two cases. In the EU, the UK, Switzerland, Norway, Iceland and Liechtenstein, when you press Accept on the banner. Everywhere else, automatically, with no banner. If we can't tell where you are, we show the banner and ask, whatever language you're reading in.

While the switch is off, Google's own documentation says its tag stores no cookies and sends only "cookieless pings". Once it's on, Google sets its usual cookies so it can tell a returning visitor from a new one.

The tools send Google a handful of events: a result was shown, a result was saved as a PDF, the sources were opened, a link to a vendor was clicked. Each one carries the tool name, the language and a short label from our own data, such as which AI came out on top. The Paste Checker, for example, sends only its verdict and how many kinds of private detail it spotted, never the text itself. The code is built so that nothing you typed can be sent, and these events only fire while analytics is switched on for you.

Microsoft Clarity

Clarity shows us heatmaps and replays of how people move through a page, like where they click and the point where they give up. It's how we find the button nobody sees. It loads on every page.

Whether Clarity uses cookies depends on where Microsoft places you, from your internet address. It makes that call with its own location check, not ours. Since October 31, 2025, for visitors in the EU, Norway, Iceland, Liechtenstein, the UK and Switzerland, Clarity sets no cookies until it gets a yes. Until then it gives every page view a fresh ID, so your pages aren't linked together. Everywhere else, our Clarity setup uses its cookies (_clck and _clsk) from your first page, with no yes needed.

We send Clarity that yes in two cases: you pressed Accept, or we know your country and it's outside the places listed above. If you press No thanks, we tell Clarity no, wherever you are. Microsoft says it then deletes any Clarity cookie, ends the session and keeps working without cookies, with a fresh ID for every page view, until you say yes.

Clarity blanks out anything typed into a text box, whatever the setting, according to Microsoft's documentation. On top of that, the text boxes in the Paste Checker and the Prompt Fixer carry Clarity's "mask" marker, so what you type or paste there is blanked out of any replay. For the rest of the page, we use the setting Microsoft calls Balanced.

Note: Microsoft's documentation says Balanced hides only numbers and email addresses shown on the page, while the Clarity dashboard says it masks images and text. Either way, what you type into a text box stays hidden, because that masking applies in every mode.

The country lookup

Some answers depend on where you live: which AI apps work in your country, whether you see the cookie banner at all. So the page asks our own small endpoint, /api/geo. It reads one thing, the two-letter country code our host Vercel attaches to every request (IT, US, VN and so on), and sends it straight back. Our server keeps no copy of it, and it tells the browser not to cache the answer.

The lookup runs on your first page, and the banner repeats it on each page until your cookie choice is saved. Your browser then remembers the country, though the Automate tool and the Setup Wizard still check it again each time you open them. You can change it any time with the location button at the edge of the screen.

The Prompt Fixer

This is the one tool where your words leave your browser, because an AI has to read them to rewrite them. When you press the button, the prompt you typed goes to our server. Right now the rewriting service isn't switched on, so your prompt gets an error back and goes no further. Once it's on, the server passes your prompt to Google's Gemini (or to Cloudflare's AI service if Gemini isn't set up). Nothing else goes with it except the page language.

On our side:

• We never write your prompt to a log. When something fails, the log only says that it failed.
• To answer the same prompt faster, the server keeps the rewritten prompt (which repeats most of yours) in memory for up to a day, filed under a scrambled fingerprint of the original. It disappears whenever the server restarts.
• To stop abuse, the server counts requests per internet address for an hour (10 an hour), also only in memory.

On Google's side, be careful. The tool is built for Google's free Gemini tier, and Google's terms for that tier say it may use what is sent to improve its products and that human reviewers may read it. They also ask people not to send anything sensitive or personal. So treat the Prompt Fixer like a public space and leave out names, health details, passwords and anything about your clients. Our Paste Checker can spot those for you first, and it never sends your text anywhere.

The microphone button

Only the Prompt Fixer's text box has a mic button. The Paste Checker has none, so nothing you check there goes to a speech service. The mic uses your browser's speech recognition. Skuto never receives your audio, but your browser may send it on: Mozilla's documentation notes that by default the recognition runs on a server, so your audio may go to a speech service, usually run by the company that makes the browser (Google, for Chrome). If that matters to you, type instead.

No email list

Skuto doesn't collect email addresses. There's no sign-up box for updates anywhere on the site right now. If we ever add one, this page will say so before it goes live.

What stays in your browser

Skuto keeps a few small notes in your browser's local storage. They never leave your device on their own:

• skuto:user-context: your country and the AI the Chooser recommended (or the one you picked with the small AI button at the edge of the screen), so the next tool can pick up where the last one stopped.
• skuto-consent: your Google Analytics setting (your answer, or the automatic one where we don't ask).
• skuto-clarity: your Microsoft Clarity choice.

Clearing your browser data for skuto.app deletes all three, along with the analytics cookies set on skuto.app.

The small print

This page describes what the site's code does, checked line by line against that code. It isn't legal advice. If you need a formal answer about your rights under the GDPR or your own country's privacy law, ask your data protection authority or a lawyer.

Want to know how we check everything else? Read how we test and who's behind Skuto.

Last verified September 26, 2026.