Last updated: 2026-08-10. Applies to skillsmith.ch and skillsmith-web.vercel.app (same service, two domains).
SkillSmith, operated by Lars Hänggi, Talweg 19, 8707 Uetikon am See ZH, Switzerland. Contact for privacy requests: open an issue on GitHub (public) or use the domain's registered contact details. This notice is written to meet the Swiss Federal Act on Data Protection (revFADP, in force since 1 September 2023) and, for EU/EEA visitors, the GDPR.
The scan endpoints (/api/scan, /api/scan_pro)
process the SKILL.md text or URL you submit entirely
in-memory, for the duration of a single request, to run the lint and
security-scan checks. The raw text/content itself is never
stored. We do keep a SHA-256 hash of what you scanned plus the
scan result (lint issues, security findings, risk score) so repeat scans
of the same file are instant and so the public "Safe Skills Database" can
list clean results by name -- see the Scan history & safe registry
section below.
Scanning requires an account, created either anonymously
(POST /api/signup) or via GitHub OAuth sign-in. Depending on
how you sign up, we store:
| Data | Source | Why |
|---|---|---|
| A randomly generated API key | Generated by us | Identifies your account across devices; this is the only "password" for an anonymous account |
| GitHub user ID, display name, email, avatar URL | GitHub OAuth, only if you sign in with GitHub | Recognize your account across devices without a manual key, and to grant our own account owner status |
| Daily/Pro scan usage counters, Pro expiry date, purchased pay-per-use credits | Generated by us as you use the service | Enforce the free/Pro/pay-per-use quota |
| On-chain USDC payment signature and verified amount (Pro / pay-per-use) | Public Solana blockchain, submitted by you | Verify payment; this is public ledger data, not something we collect beyond what's already public |
| A hash of your IP address (not the IP itself in plain text) | Your request | Rate-limit anonymous signup abuse (max 3/day); GitHub sign-in is exempt from this limit |
This is stored in a private Vercel Blob store that is not publicly readable (access requires our server-side credential). We do not sell, rent, or share this data with third parties beyond the infrastructure providers named in "Where this is hosted" below.
Every scan is indexed by the SHA-256 hash of its content, together with
the skill's declared name field, the lint/security result,
and how many times that exact hash has been scanned. By default the
content itself is not stored -- only the hash and the
result. GET /api/lookup?sha256=... lets a signed-in user look
up a hash's verdict directly. Scans that come back clean and lint-valid
are also listed in the public "Safe Skills Database"
(GET /api/registry), showing the skill's declared name and
how many times it was seen -- explicitly labeled in the product as an
automated heuristic result, not a manual audit.
Publishing (opt-in, explicit action, separate from scanning):
if you tick "Publish to Safe Skills DB" before running a scan, and the
result comes back clean and lint-valid, we additionally store the actual
SKILL.md content you submitted, and make it fetchable by anyone (signed
in, subject to their own lookup quota) via GET /api/skill?sha256=...
-- this is what makes the database actually usable, not just a safety
verdict. Only ever your own submission, only if you explicitly opt in,
and only for content that scanned clean. If you published something and
want it removed, contact us (see "Your rights" below) with the hash or
the skill's declared name.
This site and its data run on infrastructure operated by:
We rely on each provider's own standard contractual safeguards for international transfers (Vercel and Google both publish and maintain GDPR-oriented data processing terms); we have not additionally negotiated a bespoke Swiss/EU data processing agreement with either, being a small open-source project rather than an enterprise customer. If this matters for your use case, please read their linked policies directly before using the service.
Vercel may retain standard, short-lived infrastructure request logs (e.g. IP address, timestamp, URL requested, status code) for operational and security purposes. We do not separately collect, sell, or analyze this data ourselves.
This site shows ads served by Google AdSense. Google and its partners may use cookies, device identifiers, and similar technologies to serve personalized or non-personalized ads and measure their performance. We do not control what Google does with this data beyond what is described in How Google uses information from sites or apps that use our services and Google's Privacy Policy.
We use Google's Consent Mode: the base AdSense script is present on every page (as Google's own setup requires), but by default no ad or analytics cookie is stored and no personalized ad is served -- that only happens after you accept the consent banner shown on first visit. You can change your choice at any time via the "Cookie / ad consent settings" link in the footer, or opt out of personalized advertising globally via Google's Ad Settings or aboutads.info.
Your browser's localStorage holds two things on this
domain: your API key (so you stay signed in) and your ad-consent choice.
Neither is sent to any third party by our own code; the API key is only
sent to our own API when you scan something.
This site does not run its own analytics/tracking script. Any usage statistics available to us come solely from Vercel's own hosting-level metrics and, where consented to, Google AdSense's ad-performance reporting.
Account records (API key, quota counters, GitHub profile fields) persist until you ask for deletion. Scan-history hash records persist indefinitely to keep "seen before" and the Safe Skills Database useful -- they contain a hash and a declared skill name, not your account identity, and are not linked to who ran the scan.
Under the revFADP and, where applicable, the GDPR, you can ask us to:
Requests: open an issue on GitHub. We aim to act on legitimate requests within 30 days.
Paid scans are unlocked via a public, on-chain USDC transfer on Solana. We verify your payment by reading the public Solana blockchain -- a public ledger, not something we control or that identifies you personally beyond your wallet address. We do not collect names, emails, or card details for this flow.
See /impressum.html for the legal notice (operator identity, address). For privacy-specific requests, use the GitHub issue channel above.