Privacy

What this catalogue stores about you, where it lives, and how to get rid of it.

Last updated 21 October 2026

The short version

Signing in gives us your name, email and avatar from Google or GitHub. Your email is never shown to anyone else. Publishing a skill makes your handle and that skill public, because that is what publishing is — unless you publish it privately, and then only the people you share it with see it. The site itself sets no cookies. Our web server logs each request’s IP address and browser for 30 days, to stop abuse, and then deletes it. Firebase Analytics is the one third party that watches you, and it only runs on the live site.

What we collect, and when

Nothing tied to an account, until you sign in. Browsing the catalogue, reading a skill, downloading one — none of that is linked to a person’s account.

Every request is logged, and the log is kept for 30 days. Two programs handle each request, and each writes a line about it:

• The web server in front (Caddy) records your IP address, your browser’s user agent and the other request headers except cookies and sign-in credentials, the full address you asked for, and the status and timing. The address includes anything after the?, so a search typed on the website is in that line.
• The API behind it records only the method, the path, the status code and how long it took.

We use these logs to stop abuse, to set rate limits fairly and to find out what broke. They are not joined to accounts, analytics or anything else, and they are deleted after 30 days.

When you sign in with Google or GitHub, that provider tells us who you are and we keep: your handle, your display name, your email address, a link to your avatar image, and the identifier the provider uses for you. We never see your password — the whole point of signing in this way is that you type it into Google or GitHub and not into us.

While you are signed in we hold a session token, valid for fourteen days, and any personal access tokens you create for the command line. Both are stored so that the server can recognise them again; the copy in your browser lives in local storage, not a cookie.

When you publish or review we record it in an audit log: who acted, what they did, which skill it was and when. That is what makes a catalogue of other people’s instructions accountable, and it is kept for as long as the skill is.

Searches and AI agents

Search queries are not stored anywhere except the 30-day request log above. Searching by meaning runs a small language model on our own server, so your query is not sent to anyone else to do it.

Agents such as Claude can read the catalogue through our MCP server (api.llmskillhub.com/mcp) or the LLM SkillHub plugin. An agent’s search goes in the body of the request, which is not logged; the request line itself is logged like any other, IP address included. Reading the public catalogue this way needs no account and tells us nothing about who the agent is working for.

Writing with AI

When you use Write with AI in the editor, we keep what you typed into it — the description or instruction, and the text you selected when you improve a selection — together with what the model wrote back, the model’s name and how many tokens it used. We keep it to improve the feature: to see which requests produce poor drafts and to fix the instructions the model is given. It is read by the people who run LLM SkillHub, it is not shown to anyone else, and we do not sell it or give it to anyone to train a model.

The text is deleted after 180 days. The counts stay — that a draft was written, when, and what it cost — because the limits on how many drafts each account may write are worked out from them. The draft you send along for context when you improve one is not kept. To have yours deleted sooner, write to hello@llmskillhub.com.

Your drafts. What you write in the editor — with AI or by hand — is saved to your account as you go, so you can come back to it from Your drafts. Only you can see your drafts. You can delete one at any time from that list, and a draft you have not edited for 90 days is deleted on its own.

So don’t put anything in a prompt or a draft you would not want us to read: passwords, keys, or other people’s personal details.

Email we send you

Only about your own submissions: that a version reached the review queue, and what a reviewer decided. That is the whole list. There is no newsletter, no digest and no announcement, which is why there is no unsubscribe link — there is nothing to unsubscribe from, and mail about work you asked us to review is not something we would send to anyone who had not.

What is public

Your handle, display name and avatar. The skills you publish, their versions, what is in them, how many times they have been downloaded, and the outcome of each review. Assume anyone can see all of it, including people who are not signed in and automated agents reading the catalogue over the API.

Your email address is not in that list. It is returned only to you, on your own account page.

Private skills

A skill in your private space is not in that list either. It is not shown in the catalogue or in search, not served to anyone who is not signed in, and not shown to reviewers — private skills are never reviewed. You see it, and so do the people you share it with: they see the skill and your handle, and you see theirs. A token you make sees it only if you gave that token the reach.

It is kept the same way as everything else here, in the same database and the same storage, which the people who run this service can reach.

Where it is kept

Account records and the catalogue live in a PostgreSQL database on Google Cloud, in their Mumbai region. Published packages are stored in Cloudflare R2. The website is served by Cloudflare. That means your data is processed in India and, depending on where you are reading this, crosses a border to get to you.

Who else sees it

• Google or GitHub, whichever you sign in with. They know you signed in here. We receive your profile from them; they receive nothing from us.
• Firebase Analytics, which is Google Analytics underneath and reports into a Google Analytics property. It runs on the live site only — not on a developer’s machine, so the numbers are visitors rather than our own reloads. It is the one thing here that sets cookies, and it is what tells us which pages are worth keeping. Its code is fetched from Google’s CDN, so that request tells Google you loaded a page here before any measurement does.
• Brevo, who deliver our email. When a version you published enters the review queue or is decided on, we send you a message about it, and your address and name pass through them to do that. Nothing else is sent to them: no browsing, no downloads, no list to be added to. They are in France, so that is one more border your address crosses.
• Google Cloud and Cloudflare, as the companies whose computers this runs on.
• Gemini models on Google Cloud’s Vertex AI, which read the contents of skills and evals: an automated reviewer reads each public submission and leaves notes for the person who decides, and an eval run sends the skill under test and the eval’s cases to the model. When you use Write with AI in the editor, what you type there and the draft you are editing are sent to the model to write the file (see Writing with AI above for what we keep). Nothing about you is sent with any of these beyond what you put in the package or the prompt.

Nobody else. We do not sell anything to anyone, and there is no advertising on this site to sell it for.

Mirrored authors

Some pages here were created for people who have never visited. When a skill is copied from a public repository, a placeholder account is made in the author’s name so the work is attributed to them rather than to us. Those accounts hold only what the repository already said in public: a username and an avatar. No email address, because we were never given one.

If one of those is you, you can claim the account and it becomes yours — or ask us to remove the page, and it goes.

Deleting things

You can remove a skill yourself from its page at any time. For a skill in the catalogue, existing downloads keep working, deliberately: withdrawing a package should not break someone’s build this afternoon.

A private skill is different. Removing it deletes it — every version and its files — within minutes, and it cannot be brought back. Versions that were still waiting for review are deleted the same way when a newer version of the same skill is approved; they were never listed.

For your account and everything attached to it, write to hello@llmskillhub.com from the address you signed up with. We will confirm before anything is deleted, because an account deletion arriving by email is exactly the sort of request that should not be taken at face value.

One thing survives deletion: the audit log keeps a record that an action happened, with the account identifier removed. Losing the fact that a version was approved would undo the only evidence that anyone checked it.

Age

You can have an account from 13, or from the older age your country sets for agreeing to an online service yourself (16 in parts of the EU). Those are the same minimums Google and GitHub, which you sign in with, already apply to their own accounts. Students under 18 are welcome, and an account of theirs is handled exactly like everyone else’s: we collect nothing extra and nothing less.

If you believe someone younger than that has an account, write to hello@llmskillhub.com and we will delete it.

Asking what we hold

Write to hello@llmskillhub.com and we will tell you, and send you a copy. Most of it is already visible on your account page.

Changes

If this page changes in a way that affects what is collected or who sees it, the date at the top changes and we say so on the site rather than quietly editing the text.

This page describes how LLM SkillHub actually works and what it undertakes to do. It was not drafted by a lawyer and is not legal advice. If you need it to carry legal weight in a particular jurisdiction, have someone qualified read it first.