Privacy Policy

When you connect Skill Me in Claude, an authorization page offers two choices: sign in, so your library syncs with the website and across devices, or continue without an account. If you continue without signing in, we mint a random anonymous identifier and tie your installed library to it. We do not collect your name, email, or any profile information through the connector.

The website offers an optional sign-in (email magic link or GitHub) so you can manage your library, favorites, reviews, and collections from a browser. Authentication is handled by Supabase Auth; when you sign in we store your account identifier and email, and, if you sign in with GitHub, the public profile name GitHub provides. If you never sign in on the website, none of this is collected.

Only what is needed to provide the service: which skills and packs you install, the ratings and written reviews you submit, the skills you favorite, and the collections you create. These records are stored in our database (Supabase), keyed to your connection token or signed-in account, so they persist across sessions.

Written reviews are public: each review is shown on the skill’s page alongside a display name (your GitHub username or name when available, otherwise “Anonymous”). We never display your email address. If you join the newsletter — or when you sign in and we add your account email to it — we store that address so we can notify you about new skills and packs. Every email includes a one-click unsubscribe, and you can ask us to remove your address at any time.

If you buy a premium pack, or a team owner subscribes, payment runs through Stripe Checkout. Stripe collects and holds the card, billing email and billing address; we never see or store card details. We keep a record that your account has access to the pack, with Stripe’s payment identifier, so access can be checked and a refund can end it. For teams we keep Stripe’s customer and subscription identifiers and the plan status. We also record that a checkout started and that a purchase was confirmed (which pack, the amount and currency), keyed to your account.

To understand how the catalog is used and where it’s growing, we record our own (first-party) product events — for example that a skill was viewed or installed, which MCP tools were called, and the search terms you type into catalog search. These events are pseudonymous: they carry your connection token or account identifier, not your name or email. From network-edge signals we derive an approximate location: country, region, city, and a map coordinate rounded to two decimal places (roughly 1 km). We never store your raw IP address, and these events never contain your conversations, files, or contact details.

When you ask for skill recommendations (the recommend_skills tool), the task description you give is sent to OpenAI to compare it against the catalog and rank the results. When a catalog search (on the website or through the connector) finds few exact matches, the search terms are also sent to OpenAI to find related skills. We do not store recommendation task text ourselves; search terms are kept with product events as described above. OpenAI processes both under its API terms. Installing, loading, and managing skills do not send anything to OpenAI.

The website sets a few first-party cookies: a random anonymous identifier that ties product events from the same browser together (1 year), a marker that we already recorded how you arrived (1 year), a code from an invite link you followed (30 days), and, when you connect without an account, an identifier for that anonymous library (90 days). The connect screen also sets a one-hour security cookie, and signing in sets Supabase’s session cookies. We use no advertising or third-party tracking cookies.

On your first visit we record how you arrived: the campaign tags in the link (utm_ parameters), the referring page, and the page you landed on.

Skill Me does not read your conversations, your AI’s memory, uploaded files, or any data outside the tool calls your AI makes to it. What it does receive is what those calls contain, such as a skill name, a search term or a task description for recommendations. Its tools act only on the catalog, your own library, and the library of any team you belong to.

We do not sell your data. We share it only with the service providers listed under “Service providers” below, and only to run Skill Me. Aggregate counts may be shown publicly in the catalog (for example, a skill’s total install count). Collections are private unless you explicitly create a share link.

Library, rating, review, favorite, and collection records persist so your skills remain available. In Claude you can remove items with the uninstall_skill and manage_collection tools; on the website you can unfavorite skills, edit your reviews, and delete collections directly. Product events are currently kept without a fixed time limit; we will state a retention period here once automatic deletion is in place. To request deletion of your newsletter signup or of all data tied to your connection or account, including its product events, contact us.

• Vercel — hosting and network edge (the source of approximate location), Vercel Web Analytics for aggregate page views, and the Vercel AI Gateway, which can route the AI calls below.
• Supabase — our database and sign-in (Supabase Auth).
• OpenAI — ranks skills for the task text you send to recommend_skills, embeds catalog search terms when exact matches are few, and computes search embeddings of catalog content.
• Anthropic — the safety classifier that reviews skills submitted to the catalog. It sees submitted skill content, not your usage data.
• Resend — sends sign-in, notification, and newsletter email to your address.
• Stripe — only if you buy a premium pack or your team subscribes: processes the payment and holds the card, billing email and address entered at checkout. We store only Stripe’s customer, subscription and payment identifiers, never card details.
• Forward Email — delivers email you send to our addresses.
• GitHub — only if you choose to sign in with GitHub.

Questions or data requests: support@skillme.dev.