Privacy Policy

1. Controller

Controller within the meaning of the GDPR: Cornelius Krämer, Kalkstraße 135, 51377 Leverkusen, email: [email protected]. Further details in the Legal Notice.

2. Your rights

You have the right at any time to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). An email to the address above is sufficient for requests.

Right to complain: You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de. You may also contact the supervisory authority of your place of residence.

No automated decision-making: No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

3. Server log files & hosting

The site is served by Railway (region EU-West) via the Caddy web server; DNS, TLS protection and the CDN run via Cloudflare. For technical reasons, server log files are generated on each request (incl. IP address, browser type/version, operating system, referrer URL, time). The legal basis is our legitimate interest in secure, stable operation and in defending against attacks (Art. 6 (1) (f) GDPR). All data is transmitted exclusively via TLS/HTTPS encryption.

4. Local settings & cart

Theme (light/dark), language choice and the cart are stored exclusively locally in the browser (localStorage/sessionStorage: sfa-theme, sfa-lang, sfa-cart, sfa-last-order) and are not transmitted to us as long as you do not trigger a purchase/unlock. Fonts are served locally — no Google Fonts CDN. Without your consent, no analytics or marketing cookies are set.

5. Account & sign-in

For “My Skills”, purchases and downloads you can create an account. Authentication is handled by Supabase (auth/database/storage; region EU). Sign in either via magic link (passwordless by email) or via OAuth with Google, GitHub or Discord. We process your email address, possibly the provider’s display name/avatar and an internal user ID; multiple sign-in methods with the same email are assigned to the same account. Legal basis: contract/pre-contractual measures (Art. 6 (1) (b) GDPR). Providing this data is voluntary; without an account you can continue to use the freely accessible areas, but not personal features such as “My Skills”, unlocks or downloads. If you sign in via Google, GitHub or Discord, we obtain your display name and avatar from the respective provider as the data source (Art. 14 GDPR).

6. Free of charge

All Skills & Agents are currently provided free of charge. No payment processing takes place; no payment data is collected and no data is transmitted to a payment service provider.

7. Delivery & license key

Free-of-charge unlocked skills are delivered only after sign-in and ownership check — either via an install command (CLI) or via short-lived, signed download links from non-public storage. A personal LICENSE.txt is embedded in the downloaded file as proof of license, containing your license key, your email address, the purchase date and the order reference. Legal basis: contract (Art. 6 (1) (b) GDPR).

8. Statistics

We count only aggregated view and download numbers per skill. No IP addresses, no visitor IDs and no personal data are stored; a cookie banner is not required for this. Legal basis: legitimate interest in simple reach measurement (Art. 6 (1) (f) GDPR).

Web analytics & advertising with Google — only with your consent

If you agree in the cookie banner, we use Google Analytics 4 (reach and usage analysis) and/or Google Ads (ad performance measurement, remarketing). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). Cookies or similar identifiers are set and usage and device data are processed.

The Google tags are loaded only after your consent — before that, no connection to Google takes place (Google Consent Mode, "basic" variant). The legal basis is your consent (Art. 6 (1) (a) GDPR); the associated data transfer to the USA is based on your explicit consent (Art. 49 (1) (a) GDPR) and the EU-US Data Privacy Framework. You can withdraw or adjust your consent at any time with effect for the future via "Cookie settings" in the footer.

9. Public content: profile, reviews & creator credit

Some features publish details about you on the open web — visible to everyone and findable via search engines. This only happens if you actively use or enable the respective feature:

• Public profile (/u/<handle>) — display name, handle, short bio, website link and avatar. Only with the opt-in enabled in your settings; by default the profile is not public.
• Reviews — review text, stars and date. Your real name only appears if you enabled name display; otherwise it says “Verified buyer”.
• Creator credit — whoever submits a skill is credited as its author on the skill page (also subject to name display).

The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time in your settings with effect for the future. Please note: once published, content may have been indexed by search engines or copied by third parties — we have no influence over that. If you delete your account, any review you left is anonymised (name removed, review text deleted) so that other users’ star ratings are not distorted.

10. Abuse prevention & security

To protect delivery we process technically necessary security data. Your IP address is not stored in clear text, only as a non-reversible hash value:

• Delivery throttling — hashed IP value and timestamp, to prevent mass automated downloads (automatically deleted after 24 hours).
• Browser security reports (Content Security Policy) — hashed IP value, blocked address, time (automatically deleted after 30 days).
• Installation and delivery tokens — linked to your account so that only you can fetch the skills you unlocked.

Legal basis: legitimate interest in operational security and abuse prevention (Art. 6 (1) (f) GDPR).

11. Newsletter

If a newsletter is offered and subscribed to by you, we process your email address using the double opt-in procedure on the basis of your consent (Art. 6 (1) (a) GDPR). Consent can be withdrawn at any time with effect for the future. (Currently not active.)

12. Contacting us

When you contact us by form or email, we process your details to handle the request (Art. 6 (1) (b) or (f) GDPR).

13. Recipients & processors

We use carefully selected service providers as processors and, where required, conclude data processing agreements pursuant to Art. 28 GDPR (or rely on their standard data processing clauses) with them:

• Supabase — account/authentication, database, file storage (region EU); also sends the sign-in links (magic link) and system emails via a dispatch provider as its subprocessor.
• Railway — application hosting (region EU-West).
• Cloudflare — DNS, CDN, TLS and attack defense (USA/global).
• Strato — domain registration.

If you sign in via OAuth, the sign-in takes place at Google, GitHub or Discord; the respective provider learns that you are signing in to skills-for-ai and processes the sign-in data under its own responsibility (partly in the USA). In that respect these providers are not our processors.

14. Transfer to third countries

Some services (especially Cloudflare) may process data in the USA. A transfer takes place only on the basis of appropriate safeguards (EU standard contractual clauses or the EU-US Data Privacy Framework).

15. Storage period

• Account and ownership data — until you delete your account, or as long as necessary to provide the skills you unlocked.
• Reviews — until you withdraw them or delete your account (anonymised afterwards, see section 9).
• Server log files — briefly, for operational security, then deleted automatically.
• Delivery throttling — 24 hours.
• Security reports (CSP) — 30 days.
• Consent records — for as long as the account exists; afterwards for as long as we must be able to demonstrate the lawfulness of processing.

Otherwise we delete data as soon as the purpose ceases to apply and no statutory retention obligation stands in the way.