Privacy Policy

Last updated 11 November 2026

SkillCheatSheet, at skillcheatsheet.com, is a free website that grades public agent skills (SKILL.md files) and helps you build your own. This policy explains what information we collect, how we use it, who processes it for us, how long we keep it and the choices you have.

Information we collect

When you visit without signing in

• We store nothing on our servers that identifies you.
• The Skill Builder keeps your drafts in your own browser (localStorage). They leave your device only if you download them, and clearing this site's data in your browser deletes them.
• Our host, Vercel, keeps standard request logs, such as IP address, time, page and browser, to run and protect the site.
• Vercel Web Analytics counts page views without cookies. It records the page, the referring site, country and region, browser and device type, and recognizes a repeat visit for 24 hours only, by a hash of the request.
• Vercel Speed Insights measures how fast each page loads in your browser.

When you sign in

You can sign in with Google or with a link sent to your email address. Supabase runs sign-in for us.

• Sign in with Google: with your permission, Google shares your name, your email address and a link to your profile picture. We ask only for these basic permissions (the openid, email and profile scopes).
• Sign in with an email link: your email address.
• For every account, Supabase also records how you signed in and when the account was created and last signed in.
• A session cookie keeps you signed in. It is HttpOnly, so scripts on the page cannot read it, and signing out deletes it. We use no advertising or tracking cookies.

When you give a thumbs up or publish a skill

• Thumbs up: we store which skill you gave a thumbs up to, linked to your account, and when. Other people see only the total for each skill.
• Publishing to Verified: we store the skill you publish (its SKILL.md, files, score, checklist and test card results), its version, when you published it, and the name from your Google profile, if it has one. Everyone signed in to SkillCheatSheet can see the skill with that name as its author. We never show your email address. Your answers to the builder's step 00 are not published.

How we use Google user data

• We use your email address to create and identify your account, and your name to show who is signed in and, when you publish a skill to Verified, as its author. We do not use your profile picture.
• We use this data only to sign you in and run your SkillCheatSheet account. We do not sell it, use it for advertising, build profiles from it, use it to train AI models, or share it with anyone other than the service providers below that run sign-in for us.
• We do not ask for access to Gmail, Google Drive, your contacts or any other Google data.
• SkillCheatSheet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

We use the information above to run the site and your account, to keep them secure and stop abuse, and to understand overall use of the site through analytics. The only emails we send are the sign-in links you ask for.

Who processes your information

• Supabase runs sign-in and stores account records, thumbs up and published skills.
• Vercel hosts the site and provides its request logs, Web Analytics and Speed Insights.
• Resend delivers sign-in emails.
• Google provides Sign in with Google, and Google Fonts serves the site's fonts, so your browser asks Google for them when a page opens.

We do not sell or rent personal information. We disclose it only to these providers, or when the law requires it.

How long we keep it

• Account records: until you delete your account.
• Thumbs up: until you take them back or delete your account.
• Published skills: until you withdraw them, we remove them, or you delete your account.
• The session cookie: until it expires or you sign out.
• Request logs and analytics: for the limited time Vercel keeps them under its own policies.
• Drafts in your browser: until you delete them.

Your choices and rights

• Sign out at any time; this deletes the session cookie in your browser.
• Remove SkillCheatSheet's access to your Google Account at any time in your Google Account settings, under third-party apps and services.
• Delete your account at any time: sign in, open the sign-in page and choose Delete account. It deletes your account, its records, your thumbs up and the skills you published at once, and it cannot be undone.
• Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to how it is used.

Security

The site uses HTTPS everywhere, keeps the session in HttpOnly cookies, sends a strict Content-Security-Policy, and checks on the server that each change to thumbs up or published skills comes from a signed-in account that may make it. The database tables cannot be read or written with the public key. We collect as little as we can.

Children

SkillCheatSheet is not directed to children under 13, and we do not knowingly collect their personal information.

Skills from GitHub and removals

The registry lists public agent skills found in GitHub repositories. Each skill links to its source and shows the repository's license. Skills from repositories without a license we can identify show only their name, scores and a link, not their text.

The registry is rebuilt from GitHub every week. A skill deleted from its repository, or a repository made private, drops out at the next refresh.

Changes to this policy

When this policy changes, we update this page and the date at the top.