Privacy policy

When you sign in we receive your name, email address and organization memberships from WorkOS, which runs sign-in for us. We use them to show who published a skill and to decide which skills you can see and install.

When you publish a skill we store its files, its versions and the visibility you chose. A public skill can be seen and installed by anyone; an organization or team skill only by its members; a private skill only by you. We also record which versions are installed, so owners can see how many people use each one.

Agents record each use of a skill with bas record-usage, and report the skill's problems in the same record. A record holds the skill, its version, the model that used it and who sent it, plus what the agent writes into its fields: the problems it met (each with a category, severity, summary, and optionally details and a suggested fix), a message for the skill's owner, a summary of what the skill was used for and how it went, and the structured result the skill asks for. Secrets such as API keys, tokens, private keys and passwords in URLs are removed on your device before the record is saved or sent. No conversation, transcript, file contents or repository name is attached.

The command sends each record to us when the agent runs it. If it cannot, the record waits on your device until a later record is sent. Records about a skill of yours that you never published are never sent. You can turn usage sharing off in the app's settings; the command then sends no records at all.

Only the skill's owner sees its records. For a skill added from GitHub, its repository's verified maintainers see them, and only while you leave sharing with maintainers on; with it off, that skill's records are not sent.

If you connect GitHub on the website, we ask GitHub whether your account can write to a repository, to confirm you maintain its skills. GitHub tokens we hold are stored sealed (encrypted) and used only to call GitHub. A personal access token you add in the app stays in your Mac's keychain and is sent only to GitHub.

There are no analytics, advertising or tracking scripts, and no cookies beyond the ones sign-in needs. We do not sell your data. Besides the processors below, usage records reach only the people named above: a skill's owner and, for a skill from GitHub, its verified maintainers.

• WorkOS: accounts, sign-in and organization membership.
• Cloudflare: the API and the storage for skills and usage records.
• Vercel: hosting for this website.
• GitHub: app downloads and, when you connect it, the repository access check.

You can delete skills you published at any time. When you delete your account, your account data is removed; usage records you sent stay with the skill's owner with your name removed.

When this policy changes we update this page and the date below.