Privacy

What we collect

When you log in with GitHub, we receive your GitHub user ID, login name, and avatar URL. If you star a skillset, we store the skillset ID in a list keyed to your user ID.

How we use it

Your login name is used to display your authentication status. Your starred skillset list powers the star feature — that's it.

Cookies

We set a single session cookie — httpOnly, secure, SameSite=Lax, 7-day expiry. It contains a JWT with your GitHub ID, login, and avatar URL. No tracking cookies, no analytics cookies.

Data retention

Your starred skillsets persist until you delete your account. Rate limit entries and session revocation records auto-expire. Download counts are keyed by IP address, not user ID.

Your rights

You can view, export, and delete your data using the controls below (visible when logged in). Exported data is returned as JSON per GDPR Article 20. You also have the right to lodge a complaint with your local data protection authority.

Contributors

Skillset submissions are public git history. To request removal of a published skillset, open an issue or email us. We'll remove the listing from the registry. Git history retention is GitHub's responsibility.

GitHub authorization

Deleting your account on skillsets.cc removes your data from our systems. The OAuth app authorization on your GitHub account persists — revoke it at Settings > Applications > Authorized OAuth Apps.

Rate Limiting & Abuse Prevention

To prevent abuse and protect the integrity of our platform metrics, we implement rate limiting on certain actions (stars, downloads, reservations, account deletion).

IP Address Processing

For download-related rate limiting, we hash your IP address using SHA-256 and store the hash (not your raw IP address) in our systems. This is pseudonymous data processed under our legitimate interest in abuse prevention (GDPR Art. 6(1)(f)).

Data Retention

• IP-based rate limit data (hashed): automatically deleted after 3 months
• Daily action counters: automatically deleted after 25 hours
• Download verification tokens: automatically deleted after 10 minutes

Account Suspension

Accounts that repeatedly exceed usage limits may be suspended. Suspension flags are retained after account deletion under GDPR Art. 17(3) (legitimate interest in security) to prevent abuse through account cycling. These flags contain only your user ID and a boolean value — no other personal data.

If your account has been suspended, you will be notified via a 403 response. To request a review, contact privacy@skillsets.cc.

IP-Based Data & Account Deletion

IP-based rate limiting data is stored using hashed identifiers that are not linked to your user account. This data cannot be included in account deletion requests but automatically expires within 3 months.