Privacy Policy

Effective date: 2026-01-05
Last updated: 2026-01-06

This Privacy Policy explains how skills.garden, operated by TTS Truck Technology Services UG (haftungsbeschränkt) ("we", "us", "our"), collects, uses, and shares information when you use the service.

## Summary
- We collect the minimum data needed to operate the site.
- Skill submissions are public by default.
- We do not sell personal data.
- We use Cloudflare services to host the site and protect it from abuse.

## Information We Collect

### Account and Authentication
- GitHub OAuth: GitHub user ID, username, and avatar URL. Email may be provided by GitHub if available.
- Magic link login: email address you provide.

### Submissions and Content
- Skill metadata (title, description, tags, source type).
- Uploaded skill files (ZIP contents or GitHub URLs).
- LLM-generated summaries/tags derived from submitted content.

### Usage and Security Data
- IP address, user agent, and request metadata for rate limiting, abuse prevention, and security logging.
- Session cookies to keep you signed in.
- Turnstile challenge results to prevent automated abuse.

### Analytics (If Enabled)
- Basic, privacy-focused analytics via Cloudflare Web Analytics.
- No advertising cookies or cross-site tracking.

## How We Use Information
- Provide and maintain the service.
- Authenticate users and manage sessions.
- Validate, store, and display skill submissions.
- Detect and prevent abuse, fraud, and security issues.
- Comply with legal obligations and respond to requests (e.g., DMCA).
- Improve the service and measure usage.

## Legal Bases for Processing (GDPR)
We process personal data under the following bases:
- Contract: to provide the service you request.
- Legitimate interests: to secure and improve the service.
- Consent: when required (e.g., optional analytics).
- Legal obligation: to comply with applicable laws.

## How We Share Information
We share information only as needed to operate the service:
- Cloudflare (Workers, D1, R2, Turnstile, Queues, AI Gateway) as our infrastructure provider.
- GitHub for OAuth authentication.
- Email provider for magic link delivery (if configured).
- LLM provider via Cloudflare AI Gateway to generate summaries and tags.

We do not sell your personal data.

## International Data Transfers
Our service uses global infrastructure. Data may be processed in regions where our providers operate. We rely on provider safeguards where applicable.

## Data Retention
We retain data only as long as necessary to provide the service, comply with legal obligations, and enforce policies. We aim to minimize retention for logs and security data.

## Your Rights
Depending on your location, you may have rights to:
- Access, correct, or delete your personal data.
- Object to or restrict processing.
- Receive a copy of your data (portability).
- Withdraw consent where processing is based on consent.

To exercise these rights, contact us using the information below.

## Public Content
Skills and related metadata are public by default. If you submit content, you are responsible for ensuring you have the rights to share it.

## Children
skills.garden is not intended for children under 13 (or the minimum age required by local law).

## Contact
- Data controller: TTS Truck Technology Services UG (haftungsbeschränkt)
- Address: Kolonnenstr. 8, 10827 Berlin, Germany
- Privacy inquiries: privacy@skills.garden

## Changes
We may update this policy from time to time. We will update the "Last updated" date when changes are made.