Privacy Policy

Account information.When you sign in, we collect information from your authentication provider: your username, display name, avatar URL, and email address. For GitHub sign-in, we also receive your GitHub user ID. For Google sign-in, your Google account ID. For email/password sign-in, we store a securely hashed version of your password — we never store plaintext passwords.

Profile information. Any additional information you choose to add to your profile, such as a bio or website URL.

Content you publish. Skills, reviews, ratings, comments, and other content you create on the Service.

Usage data. We collect anonymized usage data including page views, skill install counts, search queries, and API request metadata (timestamps, endpoints, response codes). We do not track individual browsing behavior across sessions.

Error and performance data. We use Sentry for error monitoring, which may collect browser type, operating system, and stack traces when errors occur. This data is used solely for debugging and improving Service reliability.

We use your information to:

• Provide, maintain, and improve the Service
• Display your public profile and attribute skills you publish
• Enable community features (reviews, ratings, follows, organizations)
• Send transactional emails (account verification, password resets, organization invites) — never marketing emails unless you opt in
• Generate aggregate analytics for skill authors (install counts, referrer data) — this data is anonymized and does not identify individual users
• Enforce our Terms of Service and protect against abuse

Your data is stored in encrypted databases hosted on Amazon Web Services (AWS) in the United States. We implement industry-standard security measures including:

• Encryption at rest. All database storage is encrypted. GitHub and Google access tokens are additionally encrypted using AES-256-GCM with dedicated encryption keys.
• Encryption in transit. All connections to the Service use TLS 1.2 or higher.
• API key security. API keys are cryptographically hashed before storage (bcrypt) and cannot be retrieved in plaintext. Only the key prefix is stored for identification.
• Password security. Passwords are hashed using bcrypt with appropriate work factors and are never stored in plaintext.

While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

We do not sell your personal information. We do not share your data with advertisers or data brokers.

Public information. Your username, display name, avatar, bio, published skills, and reviews are publicly visible. Your email address is never exposed publicly through the Service.

Service providers. We share data with third-party service providers who assist in operating the Service, including: AWS (hosting and infrastructure), Sentry (error monitoring), and SendGrid (transactional email). These providers are bound by contractual obligations to protect your data.

Legal requirements. We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, prevent fraud, or ensure user safety.

We use only essential cookies and local storage for authentication (session tokens, refresh tokens). We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

Local storage is used to persist your authentication state and UI preferences (such as theme selection). You can clear this data through your browser settings at any time.

We retain your account data for as long as your account is active. Published skills remain available until you delete them or delete your account. Usage data and server logs are retained for up to 90 days for operational purposes, then deleted or anonymized.

When you delete your account, we delete your personal data within 30 days. Some data may persist in encrypted backups for up to 90 additional days before being permanently purged. Published content that has been installed by other users may remain available in anonymized form.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data through your Settings page
• Delete your account and associated personal data
• Export your data in a portable format
• Object to certain processing of your personal data

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.