Overview

SkillsBase is a community directory for discovering, publishing, claiming, and discussing Agent Skills. We try to collect only the information needed to provide the service, protect accounts, process subscriptions, and maintain the community. We do not sell personal information or use it for cross-site behavioral advertising.

Information We Collect

• Account information: name, email address, password hash, email verification state, invite or redeem code state, subscription tier, subscription expiration, notification preferences, role, and session timestamps. When you use Google, GitHub, or LINUX DO sign-in, we store only the provider name, stable account identifier, and the email, display name, and avatar URL needed for sign-in and presentation. LINUX DO does not provide an email-verification state we can trust directly, so first-time registration requires both a SkillsBase email token and the original browser's authorization credential; no account or identity binding is created before both checks pass. Pending registration credentials normally become unusable after 15 minutes; after a LINUX DO email-verification request, hashed verification state becomes unusable after 30 minutes and is removed from active systems during the next scheduled or OAuth cleanup cycle.
• Content you submit: skill titles, summaries, categories, tags, repository or documentation links, install notes, cover images, claim verification information, comments, favorites, follows, keyword or topic watch terms, and related edit or moderation records.
• Subscription and entitlement information: if you use redeem codes, receive a registration-channel benefit, or receive an admin-granted subscription, we store the necessary plan, expiration, redeem-code usage state, and entitlement status identifiers.
• API and export information: API key names, public prefixes, hashes, creation time, revocation state, last-used time, read-only API rate-limit records, and the dataset and format you request for exports.
• Email and notification information: delivery records for email verification, password reset, weekly digest, followed-activity alerts, and keyword alerts, such as notification type, period, status, and timestamp. We use these records to avoid duplicate sends and troubleshoot delivery.
• Operational and security information: request times, IP-related rate-limit records, session tokens or identifiers, error logs, sync logs, and basic technical information used for abuse prevention and troubleshooting.
• Public-source information: we read repository names, descriptions, stars, forks, topics, licenses, languages, avatars, and update times from public sources such as GitHub.
• Browser storage and measurement: SkillsBase uses localStorage for your login token and language preference. Product events are sent only when an approved first-party collector is available; third-party analytics scripts are currently not loaded. We also sample 25% of eligible page loads for normalized page type, coarse device class, Cloudflare edge region, and performance values such as TTFB, LCP, INP, and CLS. Performance samples exclude IP, user/session identifiers, raw URLs, and query strings, respect DNT/GPC, and are retained for 30 days.

How We Use Information

• Create and protect accounts, verify email addresses, reset passwords, and manage sessions and notification preferences.
• Show the skill directory, detail pages, rankings, favorites, comments, activity feeds, digest previews, watch matches, exports, and read-only API results.
• Process redeem codes, plan expiration, entitlement activation, and subscriber-feature access.
• Send necessary service emails, such as email verification, password reset, weekly digests, followed-activity alerts, and keyword alerts you choose to receive.
• Detect abuse, rate-limit risky requests, troubleshoot issues, keep the site stable, and improve content quality.
• Sync public GitHub data so the directory and rankings stay useful and current.

Public Content and Sharing

Skills you publish or claim, repository links, cover images, author names, comments, public-source verification states, and some community interactions may be publicly visible. Do not submit passwords, tokens, private repository information, sensitive personal information, or materials you are not allowed to make public in those fields.

Public pages, RSS feeds, sitemaps, search engines, users, or third-party services may index, cache, quote, or forward public content. Data from public sources such as GitHub may also remain available at the original source.

Service Providers

We use necessary service providers to run SkillsBase, including Cloudflare hosting, database and object storage, Resend or similar email delivery services, Google identity services, GitHub OAuth/API, and LINUX DO Connect. Service providers should process information only as needed to provide, protect, or support the service.

We may also disclose necessary information when required by law, to handle abuse, to protect users, or to maintain service security. We do not sell personal information or share it for cross-site behavioral advertising.

Retention and Security

Passwords and SkillsBase API keys are stored as hashes. Full SkillsBase API keys are shown only once at creation. Active sessions can be reviewed and revoked from your profile page, and SkillsBase API keys can be revoked by you. Google, GitHub, and LINUX DO access tokens, refresh tokens, and ID tokens are used only during the sign-in callback to read necessary identity data and are not stored in the SkillsBase database; provider-returned api_key and external_ids fields are not stored either.

We retain information as needed to provide the service, secure the site, prevent abuse, comply with obligations, support audits, and maintain backups. When information is no longer needed, we delete it, anonymize it, or remove it from active systems. Email delivery records, redeem-code/subscription status records, and rate-limit records are retained as needed for troubleshooting, idempotency, and security.

No internet service can guarantee absolute security. If you discover a security issue, contact us promptly using the email below.

Your Choices

• You can update your name, password, notification preferences, active sessions, keyword watches, API keys, redeem-code entitlements, and data exports from your profile page.
• You can delete community skills or comments you authored, revoke API keys, and turn off notification preferences you no longer want. Public GitHub data comes from third-party public sources, so removal may also need to happen at the source.
• You can contact us to request access, correction, export, or deletion of account data. We may need to verify your identity before acting on a request.
• You can clear localStorage in your browser. You will need to sign in again and reselect your language preference afterward.

Children's Privacy

SkillsBase is not intended for children under 13. If you believe a child has submitted personal information to us, contact us and we will handle it promptly.

Policy Updates

We may update this policy as features, service providers, or legal requirements change. Material updates will change the date on this page and, when appropriate, will be announced in the product or by email.

Contact

For privacy, account data, deletion requests, or security issues, email support@skillsbase.cc.