Privacy policy

Last updated: October 9, 2026

skylls is an open-source tool (github.com/jcsancho/skylls) for sharing agent skills, agents and swarms through your own private GitHub repositories. This page explains what the skylls website and dashboard at skylls.dev and the skylls command-line tool do with your personal data, and the rights you have under the EU General Data Protection Regulation (GDPR) and similar laws. In short: skylls has no database and doesn't store your data.

Who is responsible

The data controller for skylls.dev is Jose Carlos Sancho Pitarch, Spain, maintainer of the skylls project (@jcsancho on GitHub). Email: privacy@skylls.dev.

Signing in with GitHub

When you sign in, GitHub gives the dashboard an access token for your account with the repo and read:org permissions you approve on GitHub's screen. The dashboard uses it only while you use it, to:

• list your skylls repositories and the ones shared with you (names, topics, CHANGELOG.md, SKILL.md/CLAUDE.md/AGENTS.md, open suggestion issues);
• show and change who can see each of your skylls repositories (collaborators and invitations), and accept invitations or answer suggestions when you click to do so.

It does not read or change any other repositories.

What is processed, why, and on what legal basis

• Your GitHub login, avatar address and access token — to sign you in and run the dashboard you ask for. Legal basis: performance of the service you request (GDPR art. 6(1)(b)).
• Request data (IP address, URL, time, browser) in the hosting provider's logs — to deliver the site and keep it secure. Legal basis: legitimate interest in running a secure service (art. 6(1)(f)).
• Your IP address sent to Google Fonts — only if you accept "Functional" in the cookie settings. Legal basis: your consent (art. 6(1)(a)), which you can withdraw at any time.
• GitHub Marketplace plan events (your GitHub login and plan name), if you install skylls from the Marketplace — to acknowledge the event. Legal basis: performance of the service (art. 6(1)(b)).

What is stored, where, and for how long

• In your browser only: an encrypted, HttpOnly cookie with your GitHub access token, its renewal token, your GitHub login and avatar address. It lasts up to 30 days. Signing out deletes it. Your cookie choice is kept in your browser's local storage for 12 months. Details in the cookie policy.
• On our side: nothing. There is no database and no user accounts.
• Hosting logs: the site runs on Vercel, which keeps standard request logs for a short period under Vercel's privacy policy.

No analytics, no advertising, no tracking cookies, no profiling or automated decisions, and your data is never sold.

Who receives data

• GitHub (GitHub, Inc.), which holds your repositories and handles sign-in, under GitHub's privacy statement.
• Vercel (Vercel Inc.), our hosting provider, acting as processor.
• Google (Google Fonts), only with your consent.

These companies are based in the United States. Transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

The command-line tool

The skylls CLI runs on your computer and talks directly to GitHub with your own gh/git login. It sends nothing to skylls. Optional features contact other services you choose to use: skylls search queries skills.sh, and when the claude CLI is installed, skylls push sends the item's instruction file to Anthropic to write a one-sentence summary (skip it with --about).

Your rights

You have the right to access, correct or delete your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Since we store nothing, in practice:

• Sign out at any time from the dashboard; this deletes the session cookie.
• Change or withdraw cookie consent from Cookie settings.
• Revoke skylls' access at github.com/settings/applications; the next request fails and nothing remains on our side.
• Your skills, agents and swarms stay in your own GitHub repositories, under your control.

You can also complain to a data protection authority: in Spain, where skylls is run, the Agencia Española de Protección de Datos, or the one where you live (see the list of authorities).

Children

skylls is not meant for children under 16 and doesn't knowingly process their data. GitHub accounts require users to be at least 13.

Contact

To exercise your rights or ask anything about your data, email privacy@skylls.dev. We answer within one month, as the GDPR requires. General questions can also go to github.com/jcsancho/skylls/issues (it's public, so don't include personal details there). If this policy changes, the date at the top changes too.