Privacy Policy

1. Information We Collect

Account Information

When you sign in (via Google, GitHub, or email), we receive your name or username, email address, and profile picture (if available). We use this information to create and maintain your account.

API Keys

We generate and store hashed API keys that you use to authenticate with the SkillSafe registry. We do not store plaintext API keys after initial creation.

Saved & Shared Skills

When you save or share a skill, we store the skill archive, metadata, scan reports, and tree hashes. Shared skills with public visibility are discoverable via search.

Usage Data

We collect basic usage data such as API request counts and timestamps to enforce rate limits and maintain service quality. We use Cloudflare Web Analytics for privacy-friendly, cookie-free, GDPR-compliant page view analytics. We do not use third-party advertising trackers or cookie-based analytics.

Hosted App Usage

Some skills are deployed as hosted apps metered by prepaid credits. If you use a hosted app, we process usage data — requests made and credits consumed — for metering and billing purposes. Credit purchases are processed by Stripe.

IP Addresses & Security Logging

We collect IP addresses for rate limiting purposes. Rate limit data is held in memory only and is not persisted to disk or database. IP addresses and User-Agent strings are logged in audit trails for security purposes (e.g., detecting unauthorized access). These security logs are retained for a limited period and used solely for abuse prevention and incident response.

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain the SkillSafe registry service
• Authenticate your identity and manage your account
• Process skill saves, shares, and verification requests
• Enforce rate limits and prevent abuse
• Communicate service updates and security advisories

3. Data Storage and Security

Your data is stored on Cloudflare infrastructure. We implement industry-standard security measures including:

• All data transmitted over HTTPS/TLS
• API keys stored as cryptographic hashes
• Skill archives stored in authenticated, account-scoped cloud storage
• SHA-256 content integrity verification for all saved skills

In the event of a data breach affecting your personal information, we will notify affected users without undue delay.

4. Data Sharing

We do not sell or rent your personal information. We may share data only in the following circumstances:

• Public skill metadata: Skill names, descriptions, publishers, versions, and scan verdicts are publicly visible
• GitHub-sourced metadata: For skills imported from GitHub, we display publicly available profile and repository metadata (usernames, avatars, star counts) sourced from GitHub
• Legal requirements: When required to comply with applicable law, regulation, or legal process

Third-Party Service Providers

We share limited data with the following service providers, each subject to their own privacy policies:

• Cloudflare — Hosting, CDN, DNS, and Web Analytics. Processes page views, browser information, and IP addresses.
• Stripe — Payment processing. Receives your email address and billing information for subscription management.
• Resend — Email delivery. Receives your email address to send transactional emails (e.g., verification, security alerts).
• Google — OAuth authentication. Receives and provides your Google account ID and email for sign-in.
• GitHub — OAuth authentication. Receives and provides your GitHub account ID and email for sign-in.
• Supabase — Database hosting. Stores account data, skill metadata, and API keys in PostgreSQL.
• Dropbox — Optional backup integration. If you connect Dropbox, your skill archives are copied to your Dropbox account.

5. Data Retention

We retain your account information for as long as your account is active. Saved skills remain in the registry unless you delete them. Share links can be revoked at any time. If you delete your account, deletion takes effect after a 24-hour grace period, after which your personal information is permanently deleted. Residual copies in security logs and backups are purged on a rolling basis. We may retain anonymized usage data.