Terms of use

Skillstore lets people create, share and use reusable methods in their AI. By using it you agree to the following, in plain language:

Available here

Creating and sharing free skills does not start a payment. New built-in paid checkout is not available on this instance. The paid-access provisions below apply only where paid access is explicitly offered, including any existing purchase; they do not activate checkout or change existing purchase and payout handling.

Paid access, where offered

Renting a stack grants you a private, revocable connector to the author's latest version, not a copy or a license to redistribute. The author can revoke access and change or withdraw the stack at any time. Where paid checkout is offered, payments are processed by Stripe; a rental is a one-time charge for ongoing access while the stack remains published.

Refunds

Refund requests go to the stack's author or to the operator of this instance. Because access is delivered immediately, refunds are discretionary.

Authors

You are responsible for the content of stacks you publish and must have the right to share it. Don't publish anything unlawful, malicious, or that isn't yours. We can remove content and revoke identities that abuse the service.

What we record

When you sign in with Google, Skillstore stores Google's stable account identifier, your verified email address and the date the login was linked to your Skillstore account. Skillstore requests identity and email only, not Gmail or Drive access, and does not store Google access or refresh tokens. An HttpOnly session cookie keeps you signed in. Optional email sign-in stores a verified address and short-lived, hashed login challenges. Account and organization records include membership roles, invitations and skill access grants; these remain until removed or you request account deletion through the contact options below. A shared AI subscription does not identify the individual person or client project using it. Private imports store the content you choose on Skillstore; organization members and invitation recipients receive access only through an explicit grant. Revocation prevents future access but cannot erase instructions already delivered.

When a supported search returns no strong candidate or limited provider coverage, Skillstore can count it under a fixed broad topic: job applications, app icons, diagrams, code review, software testing, presentations or unknown. This topic is inferred only from the minimal task summary, never the extra context; it may be wrong. These review counters contain only the topic, result category, daily count and timestamp, not the search text, identity, private skill or project name. The same operator/test, Do Not Track and Global Privacy Control exclusions apply. Counters and review snapshots stay for up to 30 days. The operator review can suggest research, but a recorded count does not mean a skill is missing, someone was notified or research has run.

Private AI reports are off by default. If you explicitly enable them after starting your private activity record, a separate reading and reporting connection can record the AI’s declared method application and fixed test, typecheck, build and artifact-review results. Records include your account association, time, exact delivered method version, source and correction references and hashes, and delivery coverage. They contain no task text, chats, outputs, file contents or credentials, and do not establish your approval or independent verification. They expire with the existing private-record window of up to seven days, subject to the shared 1,000-event limit; deleting a delivery also deletes its report. Your activity shows up to 100 recent events. Stopping reports revokes that connection but keeps retained records until expiry or deletion. Stopping and deleting the private record removes these reports and revokes reporting. Read and save connections keep their existing permissions. Reporting does not enable automatic learning, publication, public ratings or product-learning sharing; these reports are not included in the separately consented learning summary.

Skillstore keeps daily totals of connection, search, delivery and import diagnostics for product reliability. These totals contain fixed success/error categories, a broad category for the requesting app (from the name it reports or its User-Agent), the tool category and timestamps, not account identifiers, raw app names, task text or skill content. Marked test traffic and requests with Do Not Track or Global Privacy Control are excluded from these new counters. Counts and operator review snapshots stay on the server for up to 30 days. Separately, Your activity offers an off-by-default choice to share future minimal learning counts with Skillstore and its Conductor coding agent, including optional application, output and return reports. Private activity recording and diagnostic links do not enable that sharing. Sharing ends with the private record's consent window and can be stopped sooner; current reports then exclude those receipts. Previously exported aggregate review reports have separate retention and cannot be recalled by stopping. Conversation capture remains a separate permission.

When enabled, Skillstore forwards fixed website and workspace events to PostHog Cloud: page views, sign-in starts and completions, skill creation and imports, sharing actions, organization creation, method deliveries and broad error categories. Existing English landing-page button counters are also included. The developer page also counts clicks to try Skillstore, successful or failed command and prompt copies, and selection of the existing-connection shortcut. Fixed event names distinguish Claude Code from Codex commands and the example prompt from the own-code prompt; no clipboard contents are collected. These are reported browser actions, not verified installations or completed tasks. Use-case pages count views and clicks on booking or AI-connection buttons under six fixed audience categories; these events are not confirmed bookings or completed AI connections. These records use random page or event identifiers, fixed surface/provider/error categories and, for the landing counters, a broad screen-size category. They contain no account IDs, emails, URLs, referrers, browser text, chat contents, skill instructions or access tokens. The browser does not load a PostHog SDK; there is no session replay, automatic click capture, person-profile creation or account identification in PostHog. Separately, Skillstore keeps daily operational totals and a purpose-specific keyed hash of authenticated library accounts locally for 30 UTC days including today. These local account/day records support aggregate creation/import and later-day workspace or delivery counts; they are not exported to PostHog. A library account or shared connector does not identify which human or client acted, and a recorded delivery does not prove installation, application or useful work. Anonymous page views are not joined to account activity, and displayed stage counts are not an ordered conversion funnel. The new records expire from reports after 30 UTC days and are deleted at startup, on new events and hourly while the service runs; outages delay cleanup until restart. Do Not Track, Global Privacy Control, marked tests, operators, impersonation and requests marked metrics-off are excluded from these new counters. Open a page with ?metrics=off to disable its browser page counters. PostHog copies have separately managed retention and are not deleted by Skillstore's local cleanup; contact the operator with privacy or deletion requests.

Skillstore is a separate external service from your AI provider. Searches send the query and any context supplied by the AI to Skillstore's server, even when query text is not retained in standard search telemetry. Private skill import uploads the files you select for storage on Skillstore; private means access-controlled, not stored only on your device. Use general task descriptions and omit credentials, customer identifiers, private code and confidential material unless your organization permits that sharing. An employee's consent does not replace their organization's approval.

The English landing page reports predefined button actions, sections viewed, approximate active time, scroll depth, and a broad screen-size category. A random page-load identifier stays in browser memory and groups these counters; it does not identify a person across visits. This counter creates no tracking cookie and stores no input text, full URLs, IP addresses, or session recordings. Do Not Track and Global Privacy Control disable it. Operator and marked test traffic are excluded. Records expire seven days after their first receipt and are deleted at startup, on access, and each minute while the service runs. The aggregate dashboard is private to the operator. Opening a setup guide is not counted as a completed installation. The /para-pms and /empresas pages count each load under one fixed link source (WhatsApp, LinkedIn, other or none), and each click on the /para-pms method links or the /empresas demo button. They keep only the fixed event name and the time, not the URL, cookies, identifiers or an IP address, and apply the same Do Not Track, Global Privacy Control, operator and test exclusions. Unlike the landing page records, these counts are kept for 30 days and then deleted.

When a skill is served or rated we record: the skill's id, whether the run was reported to work, an optional one-line note about the skill, a timestamp, and an address-derived identifier that changes daily. This identifier matches ratings to recent deliveries, groups repeated reports, and supplies distinct address-day counts for usage and ranking. Besides the daily identifier, Skillstore keeps a salted per-address key that does not change daily. It is used only to count whether a connection returns on a later day and how many distinct callers there are. It is kept for 90 days and is never combined with account identity. These address-based counts do not identify individual people. Network addresses are also used to limit request rates. Run pages assemble their prompt in your browser; the task text entered there is not sent to Skillstore. Library search sends your query to find matching skills. Standard search telemetry does not retain query text. Anonymous library requests have no account identity; an optional personal library connector groups runs and ratings under its chosen token. Step outcomes are recorded as categories, not task text. Skill ratings happen as tool calls in your conversation.

To learn whether people come back, Skillstore keeps a return ledger: for each UTC day, the salted per-address key (for an IPv6 address, the key of its /64 network prefix) and one fixed activity kind (connected, searched, received a skill, or rated one). It stores no query text, tool arguments or network address. Marked test traffic, operator traffic and requests with Do Not Track or Global Privacy Control are excluded. Ledger rows are deleted after 90 days. The optional feedback survey at /feedback, which also takes problem and skill reports, stores your answers (for a report, the skill and app it names) and, only if you give one, a way to reach you. Survey replies are kept for 180 days and read only by the operator; review reports receive answer counts, never your text or contact. To see or delete what is held about you, message the operator on X (@jkkorn) or LinkedIn (jkkorn). For anonymous use, Skillstore does not know who you are, so the operator can only find those records by the network address and approximate time you provide. If you have an account or gave an email, say so in your message.

On an imported creator page that names a canonical public GitHub profile but has no uploaded portrait, Skillstore may relay the current public GitHub avatar through a same-origin image route. The page labels GitHub as the photo source. This does not verify identity or imply that the person joined or endorsed Skillstore. The image may be cached under the response's cache policy.

Creator briefs, source notes and skill instructions you save are stored in your private creator workspace. A private authoring connector you enable can read that brief and source material and edit its draft. Your browser may also keep recovery copies of unsaved edits.

Project debugging is optional and expires automatically. It records request metadata, candidate skill ids, delivery issues, and agent-reported use for an authorized operator. Search query text is off by default and requires a separate opt-in. If you enable the local Codex collector, it sends check categories and exit codes in the background, never command text, output, prompts, or source code. Debug records older than seven days are removed on the next cleanup. Stop recording at any time from the private debug dashboard.

A separate optional visible-session collector for Claude Code shares future visible user and assistant messages, tool inputs and results, session references and available usage counts from one project with the Skillstore operator. This may contain code, file contents and private conversation. It requires a new local disclosure and explicit SHARE confirmation; installing the library connector or consenting to minimal telemetry does not enable it. Collection has a fixed window of at most 24 hours, excludes hidden reasoning and marks known coverage gaps. Credential redaction is best effort, not a guarantee. You can stop collection and request deletion. Server captures become unavailable seven days after creation. Live records are deleted on access, at service startup, and every minute while the service runs; during an outage, cleanup waits until restart. Local queued content remains until you delete it. Deletion removes live records but cannot recall exported copies or backups. Only enable it for work you are authorized to share.

Optional private experience scorecards retain aggregate token and duration counts, opaque session references, and short task labels, completion criteria, and reviews entered by the operator. Automatic experience collection excludes prompts, command text, file contents, and credentials. Scorecards persist separately from debug sessions and are not removed by the seven-day trace cleanup. Unknown cost and acceptance remain unknown; observation alone does not establish improvement.

If you explicitly submit a choice on a page's before-and-after example, Skillstore stores your choice, the published revision, the example's fingerprint, timestamps, and a hashed browser code. A separate HttpOnly cookie is scoped to that skill's feedback endpoint to group repeat choices; it is not an account or cross-skill identifier. No example text, task text, IP address, or contact details are stored with the choice. Aggregate results are private to the publisher and available to Skillstore, not public rankings. A preference about an example does not establish actual skill use or better results. Responses expire from results after 90 days without an update and are deleted on the next feedback submission or results cleanup. The browser cookie also lasts 90 days.

Configured workspace connections offer a separate optional feedback tool. An eligible delivery may include a signed receipt valid for 24 hours; issuing it does not save reading history. If you or your AI explicitly submit feedback, Skillstore stores the account and connection association, exact method version and hashes, timestamps, and fixed application, helpfulness and reason choices. Agent reports and signed-in human reports stay separate. No task text, instructions, conversation or free-form notes are stored in this feedback. Up to 100 reports per connection remain available for 30 days after their last change and are deleted on access, at startup and during periodic maintenance; outages delay deletion until restart. These reports remain private, are not sent to PostHog or public rankings, and do not establish independently verified results. Explicit self-check requests cannot submit feedback. Pinned skills remain until removed or account deletion is requested. Active connection settings remain while the connection is available; creating another connection can prune older expired or revoked summaries beyond the most recent 50.

A shared collection offers an optional connection check. Only when you explicitly start it and agree to share the result does Skillstore create a short-lived check code. A successful call through that exact invitation records the check time, collection revision, names and versions of skills available then, and the server build and advertised capabilities. The sender can see that limited result for up to seven days; it identifies an invitation, not a verified person, Claude account or every conversation. It contains no chat, task text, skill instructions, IP address or raw client identifier and enables no ongoing usage tracking. Checks expire after ten minutes. Retained check records are deleted at startup and during regular cleanup while the service runs; outages delay cleanup until restart. Exported copies and backups have separate retention. Revocation stops future verification and access; it does not recall material already delivered.

For the separate work-domain confirmation and team-access request flows, Skillstore stores a keyed hash and masked address such as j***@example.com, instead of the full address. Domain confirmation also keeps the domain; team-access requests keep the company field but no message or reply address. Unconfirmed domain claims expire after 30 minutes; confirmed claims and team-access requests are deleted after 90 and 90 days respectively. Cleanup runs at startup and each minute while the service runs. These limits do not delete the verified email addresses needed for Google/email sign-in or organization invitations. The hash is pseudonymous, not anonymous: someone with the database can test guessed addresses. Company names are free text. Existing backups and previously exported copies have separate retention.

No warranty

The service is provided "as is", without warranty. AI output can be wrong. Verify anything that matters. To the extent permitted by law, liability is limited to the amount you paid in the last 30 days.

Questions: the operator of this instance.