Search skills or jump to a section.
Legal
This policy explains what SkillPort collects, why, and the choices you have. We collect the minimum needed to run a secure skills marketplace.
Last updated: [operator to complete]
The data controller for the information described here is [operator to complete]. For any privacy request, including access, correction, or deletion, contact [operator to complete]. Where required, our data protection contact is [operator to complete].
When you sign in with GitHub or Google, we receive a basic profile from that provider, which may include your username, display name, avatar, and email address. We use it to create your account, attribute your reviews and any skills you publish, and secure the service. We do not receive your GitHub or Google password.
We store only a short prefix and a SHA-256 hash of each API key, never the key itself. The hash lets us verify a key at install time without being able to reconstruct it. We also record a key’s name and the time it was last used so you can manage your own keys.
When a skill is installed through the CLI, we record a download event: which skill version was fetched, which key authorised it, the time, and a coarse client signal. We store a hashed form of the IP address rather than the raw address, so we can spot abuse and enforce rate limits without keeping a plain log of where you install from. We do not use this data to build advertising profiles.
On the public pages of this site (the home page, catalogue, skill pages, docs and legal pages) we use Microsoft Clarity to understand how the site is used: pages viewed, clicks, scroll depth and anonymised session replays. Clarity is not loaded on account, onboarding, publishing, organisation or admin pages, so the parts of the site where API keys or private data appear are never recorded, and the signed-in user menu is masked in replays. For visitors in the European Economic Area, the United Kingdom and Switzerland, Clarity sets no cookies until consent is given. Microsoft processes this data under its own privacy statement at privacy.microsoft.com. You can opt out of Clarity across all sites at clarity.microsoft.com/opt-out, or block the clarity.ms domain with a content blocker.
Every page also shows a single public count of page views at the foot of the site. Each page is counted once per visitor per day, so reloads within the same day do not raise the number. We do this without setting a cookie or using browser storage. For each day we keep two one-way hashes made with a random value that changes daily: one of your IP address together with your browser’s user agent string (its name and version), and one of your IP address alone. With them we keep that day’s count of pages viewed, and for the first hash the list of pages viewed, so that limits on repeat counting can be applied. SkillPort never stores your IP address or user agent string themselves. At the end of each day (UTC) the random value, the hashes and the page lists are deleted automatically, within about an hour of midnight; after that only the site’s daily totals remain, and nothing links a view to you. The count is never linked to your account. As with any website, our hosting providers keep short-lived request logs that can include the IP address and user agent of each request, and routine database backups may hold copies of the day’s hashes until those backups expire.
Reviews, reports, and any skill you publish are stored to operate the marketplace. Reviews are shown publicly with a rating and your text, rendered as plain text; the identity behind a review is not published. Reports can be filed anonymously, and when you are signed in a report is linked only to your own account for moderation. Published skills and their documentation are shown publicly once approved.
We use the data above to provide and secure the service, prevent abuse and fraud, meet legal obligations, and communicate with you about your account. Where a legal basis is required (for example under UK or EU law), we rely on performing our contract with you, our legitimate interests in a safe marketplace, consent where you have given it, and compliance with law. The applicable basis for your region is [operator to complete].
We keep account data for as long as your account exists, and operational records such as download events and audit logs for as long as needed to run and secure the service or to meet legal obligations. We apply access controls, hashing of keys and IP addresses, and an append-only audit log, as described on our Security page. No system is perfectly secure, and we cannot guarantee absolute security.
Depending on where you live, you may have rights to access, correct, delete, export, or object to the processing of your personal data, and to withdraw consent. You can update your profile and revoke API keys from your account at any time. To exercise other rights, contact [operator to complete]; you also have the right to complain to your local data protection authority.
We may update this policy as the service changes. We will update the “last updated” date and, for material changes, take reasonable steps to notify you.