Privacy policy: what data we collect

Operator

Personal data operator: Valisher Timurovich Kholmatov, self-employed (professional income tax payer), taxpayer number (INN) 502756055318. Mailing address: bld. 3/1, Akademika Bochvara St., Moscow, Russia.

Requests about personal data: info@skillfoxx.ru. The operator is personally responsible for processing personal data.

Legal basis and purposes

We process accounts, messages and submissions on the basis of your consent. The consent text is published on the “Consent to personal data processing” page, and you give it with a separate checkbox in the form.
We show a public profile only if you turned it on and gave a separate consent to making your data public.
Counters, the request log and spam protection work with hashes and truncated addresses that cannot identify a person. Their purpose is site security and statistics.
Whose data: site visitors, members with an account, authors of messages and submissions.

Account

You can sign in with Yandex ID or with email and password.
Yandex ID sign-in works through a service of YANDEX LLC. When you sign in, Yandex gives us the account id, login, name, primary email and avatar id. If Yandex does not pass an email, we store the service address yandex-id@users.noreply.skillfoxx.ru. We do not keep the Yandex access token after sign-in.
If you uploaded an avatar in settings, we store the file on the site server. The browser loads a Yandex ID avatar from avatars.yandex.net by its id, and we do not store that file.
If an account with the same email was created earlier through GitHub, we link Yandex ID to it. Such accounts keep the GitHub login and id, and the browser loads their avatar from github.com until the account has a Yandex avatar.
The public profile at /u/<login> is off by default. If you turn it on, it shows your name, login, avatar, bio and published submissions. You can turn it off in settings at any time.
Favorites live on the server and belong to your account.
When you sign up with email, we store the email address, name, site language for emails and a password hash. We never store the password itself: the database keeps only the result of a one-way salted transformation, and the password cannot be recovered from it.
Emails with the confirmation link and the new password link are sent from no-reply@skillfoxx.ru through Yandex 360, a service of YANDEX LLC. Yandex receives the recipient address and the text of the email. The confirmation link works once, the new password link works for 1 hour.
If you sign in with Yandex ID using the same email as an email account, it stays one account.
If you linked Telegram, we store your Telegram id and username to send notifications. When you link it, the site checks the subscription through the Telegram Bot API.
The payload-token cookie keeps you signed in for 30 days.
We need this data for sign-in, favorites, submissions and the profile. You consent to its processing with a separate checkbox when you sign up or before you sign in with Yandex ID.

Submissions and problem reports

The submission form stores the link, description, email and, if you give them, your name and Telegram. We need the email to reply about the submission.
A problem report stores the text and the email if you left one.
To fight spam, the submission form and pack links store a hash of the IP address with a secret salt. The address itself is not stored.

Discussions on entry and article pages

You can post in discussions with an account or without signing in. With a member’s post we store the text, the kind of post, the “works” or “did not work” mark with the agent, the date, the author’s account number, the check result and the moderator’s decision.
Without signing in we store the same minus the account number, plus the name if you gave one and a hash of the IP address with a secret salt. The hash is used only against spam: to limit how often posts, Helpful marks and reports come from one address. The address itself is not stored. The name is published under the post as its signature; without a name the post is signed “Guest”. If you do not want to show your name, use a nickname. We do not ask guests for an email, so we cannot notify them about replies.
Everyone sees the text and the signature. By default it is a nickname not linked to your email or full name. Your name with the avatar is published only with your consent to publishing it, given in your profile; after you withdraw it, posts are signed with the nickname again. Your email and other account data are not published.
Before publication an OpenAI model checks the text and the page title; your signature and email are not sent. Strings that look like keys or tokens are replaced with asterisks before saving.
Helpful marks and reports on posts are tied to your account, or to the IP hash without signing in. Only moderators see them. After the account is deleted, marks stay without a link to it.
A member can edit or delete their post; without signing in you can delete it within 10 minutes of sending, from the same device. The text of a deleted post is erased at once; if it has replies, a placeholder “comment deleted by its author” stays in its place. After the account is deleted, posts stay on pages without a link to the account, signed “former member”.

Yandex Metrica

Every page runs Yandex Metrica (counter 112651214) with Webvisor, click maps and link tracking. Metrica sets its own cookies and records how you use the page: views, clicks, scrolling and sessions for Webvisor.
Metrica records goals: copying a command, one-click install, opening the source code, asking Foxx AI, adding to favorites or a pack, matching with Foxx AI and sending a submission.
Yandex receives and processes Metrica data under its own terms.

Our own traffic statistics

For statistics the site records the address of the viewed page, the traffic source, the device type (phone, tablet, computer), the site language and a daily visitor hash. The hash is built from a secret salt, the date, the IP address and browser data. None of those are stored, and the hash cannot link one person across days.
This statistics does not use cookies. Records are kept for 90 days and then deleted. Bots and editorial staff are not counted.

Copy counter

When you copy a command, the browser sends only the entry number, without cookies. Abuse protection lives in server memory and is not stored.

View and download counter

To show how many times entries were viewed, posts were read and apps and agents were downloaded, the server stores a hash of the address, browser and date. When you click a Download link, the browser sends only the app or agent name and the platform, without cookies. The salt changes every day, so visits on different days cannot be linked, and the address itself is not stored. Raw records are deleted after 35 days, only the totals remain.

Server request log

To protect the site from attacks and investigate failures, the server keeps a request log: time, page without parameters, response code, browser and the address with the last part zeroed (for example, 203.0.113.0). Such an address cannot identify a person. The log is kept for 14 days.

npx skillfoxx CLI telemetry

After add, update and remove the CLI sends an event: entry, agent, event type, CLI version, a CI flag and a random install id. The CLI creates the id itself and keeps it in ~/.skillfoxx/config.json.
The CLI never sends paths, environment variables, secrets, the user name or project contents.
The server keeps the id only as a hash. We do not store the IP address: we keep a hash of it with a salt that includes the date, so different days of one address cannot be linked.
Events from CI do not count. The server deletes events older than 90 days every night. A card shows only the number of distinct devices in 30 days, when there are 10 or more.
To turn telemetry off set DO_NOT_TRACK=1, DISABLE_TELEMETRY=1 or SKILLFOXX_TELEMETRY=0. The CLI then sends nothing. It tells you how to turn it off on the first event.

SkillFoxx MCP server

An agent calls report_install after an install. We store the entry, agent, event and a hash of the IP address with a daily salt. The agent should not call this tool if you opted out of statistics.
recommend_for_project receives a project summary: goal, frameworks, dependency and file names, problems. This text goes to OpenAI for semantic matching and is not stored on our server.

Foxx AI and data sent to OpenAI

Foxx AI on an entry page: your question, earlier messages of the conversation and the card data go to OpenAI to get an answer. We cache the answer with a hash of the question, and the question text is not in the database. Another visitor who asks the same question about the same entry may get the same answer.
Match with Foxx AI: the text you pasted goes to OpenAI (up to 4000 characters for the answer and up to 2000 for semantic search). Short Match with Foxx AI requests are stored with the answer for up to 14 days, not linked to any person, so that repeated requests get a faster answer; for a package.json only the dependency names are stored, and long texts and the file itself are not kept on our server.
Search: a query of several words or longer than five characters may go to OpenAI for semantic search when few entries match the words.
For the Foxx AI daily limit we count requests to the model: by account number for members, by a hash of the IP address with a daily salt for guests. The address itself is not stored, and different days of one address cannot be linked. Cached answers do not count.
Before sending text to the model we remove email addresses, phone numbers and author names from package.json.
OpenAI is based in the USA, so this is a cross-border data transfer. OpenAI processes the data under its own API terms.
Do not put personal data, secrets or code you cannot show to third parties into these fields.

Messages from the contact form

The form on the Contact page sends your name, email, subject and message. We use them only to reply: the email goes to info@skillfoxx.ru, and a copy is kept in the site admin panel. To fight spam we store a hash of the IP address, not the address itself.

Data in your browser

Your theme, preferred agent, pack, recently viewed entries and interests for the personal picks stay in your browser’s localStorage. For the picks the browser sends up to six recently viewed entries to the server, and the server does not store them. The Foxx AI conversation on an entry page stays in sessionStorage until you close the tab. A pack link stores the list of entries on the server only when you create it.

Who receives data

YANDEX LLC (Russia): Yandex ID sign-in, service emails through Yandex 360, Yandex Metrica.
Timeweb Cloud hosting provider: hosting the site and the database.
OpenAI (USA): Foxx AI, matching and semantic search, checking discussion posts.
Telegram (UAE): notifications if you linked Telegram.
Transfers to the USA and the UAE are cross-border. We do not sell data or share it for advertising.

Retention

Account and favorites: while the account exists. After you delete the account, the anonymized record is deleted after 30 days.
Messages from the contact form and submissions: 1 year after the reply or decision.
Problem reports and reports on posts: 1 year.
Published discussion posts: until you delete them. Rejected and deleted posts are erased after 30 days. The IP hash of posts made without signing in is erased after 30 days, of Helpful marks after 90 days.
Cached Foxx AI answers on entry pages: 90 days. They contain no question text.
Saved Foxx AI matches: 14 days.
Foxx AI daily limit counters: 7 days.
Raw view and download counter records: 35 days.
Install events: 90 days.
Server request log: 14 days.
Links to confirm an email, reset a password and link Telegram are deleted as soon as they expire. Session: 30 days.
Yandex keeps Metrica data under its own rules.
When a period ends or you withdraw consent, the data is deleted within 30 days.

Your rights

You can ask what data we hold about you, correct it, delete it and withdraw consent to processing or to making your profile public. Your name, bio, avatar and profile visibility change in settings, where you will also find the button to delete the account. The “Download my data” button in the sign-in and security section downloads all account data as one file. For anything else write to info@skillfoxx.ru, we reply within 10 business days. If you believe we violate your rights, you can contact Roskomnadzor.

Opting out of statistics

A tracker blocker or Yandex’s Metrica opt-out extension turns Metrica off. The site works the same without it.
DO_NOT_TRACK=1, DISABLE_TELEMETRY=1 or SKILLFOXX_TELEMETRY=0 turns off CLI telemetry.
Tell an agent that uses the catalog MCP not to send statistics, and it will not call report_install.

Changes to this policy

We publish each new version on this page and update the date at the top.