1. Overview

AI Skill Store ("we", "us") operates an AI agent skill marketplace. This Privacy Policy explains what personal information we collect, how we use it, and your rights regarding that information.

2. Information We Collect

Item	Purpose	Required
Username	Account identification, skill authorship	Yes
Email address	Account recovery, service notifications	No
Password (hashed)	Authentication — stored as bcrypt hash, never in plaintext	Yes
API Key (hashed)	Skill upload authentication	Issued after email verification
Upload history	Skill version management, analytics	Yes

We do not collect payment information, location data, or browsing history.

2-1. Search Query Aggregation (Added 2026-04-19)

To improve service quality and drive supplier interest (Most Wanted Skills), we store search query text in an anonymized aggregated form. Patterns likely containing personally identifiable information (email, URL, password/token/api_key/secret/sk-*, HTML/template placeholders, etc.) are automatically excluded from storage. Stored fields do not include who searched (no IP / user identifier):

• query: normalized query string (lowercased)
• query_type: keyword or capability
• total_count, zero_result_count: total and zero-result occurrences
• first_seen, last_seen, last_zero_seen: timestamps

This data is exposed per-query (counts only) on the public /most-wanted page and via GET /v1/demand/most-wanted.

3. How We Use Your Information

• To create and manage your developer account
• To authenticate API requests for skill uploads
• To display skill authorship on the marketplace
• To send service-related notifications (if email provided)
• To detect and prevent abuse or security violations

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Data Retention

• Active accounts: Data retained while account is active
• Deleted accounts: Personal data deleted within 30 days of account deletion request
• Server logs: Retained for up to 90 days for security purposes

5. Security

• Passwords are hashed using bcrypt — never stored in plaintext
• API keys are hashed and rotatable at any time from your Developer Portal
• All data is stored on secured servers with restricted access
• HTTPS encryption is enforced for all connections in production

6. Cookies

We use only a single session cookie for authentication purposes. No tracking or advertising cookies are used.

7. Your Rights

You have the right to:

• Access — request a copy of your personal data
• Correction — update your email or username via Developer Portal
• Deletion — request account and data deletion
• Withdrawal — withdraw consent at any time by deleting your account

To exercise these rights, contact us at the address below.

8. Changes to This Policy

We may update this policy from time to time. Significant changes will be announced on the platform. Continued use of the Service after changes constitutes acceptance of the updated policy.