Privacy Policy

SkillTotal is designed to work without accounts and with minimal data. This page describes what we store and why. The Service is operated by an independent developer, who is the data controller; for any privacy request, contact contact@skilltotal.ai.

What we store

• Scan requests and reports: the source you submit (git URL or package name), the analyzed revision, and the resulting report. Reports are cached and may be served to other users scanning the same component.
• Uploaded files: an upload is scanned on our API server (Fly.io, London), and the uploaded file is deleted when the scan ends. Its report goes back to your browser and is not stored, cached or shown to anyone else. The file name travels in the upload request, so it can appear in request logs.
• Email address: only if you choose to give it to us through the "Get notified" waitlist, the change alerts waitlist on a component page, or the Feedback form. We use it only to contact you about what you signed up for. If you join the change alerts waitlist, we also store which component you want to watch.
• Feedback: messages and per-finding verdicts you submit, used to improve the service and its open-source detection rules.

Analytics & error monitoring

If your browser sends Global Privacy Control or Do Not Track, the site loads neither the Vercel nor the Cloudflare analytics script and records none of our own events.

• Privacy-friendly analytics: we use Vercel Web Analytics and Speed Insights to count page views and measure load performance. It is cookieless, aggregate, and does not track you across other sites or build a profile of you.
• Cloudflare Web Analytics: our pages load Cloudflare's analytics script, which counts page views and measures load performance in aggregate. It is cookieless, stores nothing in your browser, and does not fingerprint you.
• Product usage events: our own API records anonymous interactions — which page you visited, which button or link you clicked, which finding you opened and how a scan turned out — to see what people find useful. No analytics company is involved, and we store no cookies, no IP address, no user agent, and nothing you type. Each event also notes a rough window width (small, medium or large), and the first page view of a visit records the host name of the site that linked you here. Events are grouped by a random id kept in your browser's sessionStorage, which is discarded when you close the tab and cannot link two visits. To count how many visits are return visits, the browser keeps a single "seen before" flag in localStorage — a yes/no, not an identifier. If the link you arrived by carries campaign tags (utm_source, utm_medium), those two values are recorded with the first page view; nothing else from the query string is. Events are deleted after 90 days.
• Error monitoring: when the API fails, our own database keeps the error type, the API route and the line of our code that raised it, and nothing you sent (no IP address, headers, request body, query or path values). These records are deleted after 30 days. The site and the API also report errors to Sentry (EU data region): technical diagnostics such as the error type, stack trace and browser/URL, with its personal-data collection disabled and nothing you sent attached.

What we do NOT do

• No user accounts, no profiles.
• No advertising, no sale of data, no cross-site or ad trackers.
• No tracking cookies — your theme preference is kept in your browser's localStorage and never sent to us.
• Our static analysis does not execute the code you submit. Any future dynamic analysis runs only in an isolated sandbox, on our infrastructure, and only for scans you explicitly opt into.

Technical data & retention

Our infrastructure providers process standard technical logs (IP addresses, request metadata) to operate the service and enforce rate limits. Service providers: Vercel (frontend + analytics), Fly.io (API and database, London), Cloudflare (page-view analytics), and Sentry (error diagnostics, EU data region).

To scan a repository or package, our API downloads it from where it is published: GitHub, GitLab, Bitbucket or Hugging Face for a repository, npm or PyPI for a package. Those services see a request from our server, not from your browser. If what you type is not something we can scan, the API may look the name up on npm and PyPI or search GitHub for it, to suggest a match.

Usage events are deleted after 90 days and API error records after 30 days. Scan reports are cached to serve repeat lookups; emails and feedback are kept until you ask us to remove them.

Your rights & removal requests

You can request access to, or deletion of, any personal data we hold about you (typically just an email you submitted). Email contact@skilltotal.ai (or use the Feedback button in the footer) with the address you want removed, and we will delete it from our database.

Changes

We may update this policy; the "Last updated" date reflects the current version.