Privacy policy

What we collect

• Account: your GitHub user id, handle, display name, avatar URL, and primary email from GitHub.
• Content you publish: kits, versions, stacks, builds, and their manifests, plus our scan and test results for them.
• Activity: likes, follows, installs made while signed in, and ideas or suggestions you share.
• Community posts: showcase posts, comments, replies, collections, idea votes, and flags you raise. Posts are public; we scan them for credentials before storing them.
• Security records: sessions, API token names and scopes, OAuth grants to apps you connect, and an audit log of sign-in, publish, and account events. We store only hashes of tokens, never the tokens themselves.
• Anonymous install pings: the CLI sends one ping per installed kit per day with a random install id, the kit version, and the agent. No file paths, file contents, prompts, or identity. Turn it off with one flag.
• Search phrases: we count common search phrases, without any link to who searched, to build pages that answer popular questions. A phrase is kept only after at least five different people searched for it, and never if it looks like an email address, a link, or a number.
• Picks for you. When you are signed in, which kits you view, save, and try, so your own "For you" feed shows kits that fit your work. Only the kit and when, never what you type. It is used for your feed only, never shown to anyone else or sold, and deleted after 90 days. Turn it off or clear it at any time in Settings, Privacy; turning it off clears it.
• Contact messages. If you turn on Contact, people who are signed in can send you a message from your profile. We email it to you with their address so you can reply, and keep only a record that a message was sent, never its text. Your address is not shown to them unless you reply.
• Saved kits. The kits you save to "My kits". Only you can see them.

What we never collect

Your prompts, your files, the output of kits you run, or secret values. Kit manifests name environment variables but never hold their values, and the scanner rejects bundles that contain secrets.

How we use it

To run the service: show your profile and kits, scan and sign versions, count installs, prevent abuse with rate limits, and keep a security trail. We do not sell personal data or use it for advertising. Public kit text is sent to an embedding provider to power search; private kits are not.

Who we share it with

Hosting, database, storage, and AI providers that process data for us under contract. [Lawyer to list subprocessors and transfer mechanisms.] We disclose data when the law requires it.

Exporting your data

From your data settings, or with GET /api/v1/me/export and a token with the account:read scope, you get one JSON file with everything we hold about you: profile, every kit and version (any visibility) with links to download the bundles, stacks, builds, community posts and collections, likes, follows, installs, token and OAuth grant details (never the secrets), sessions, legal requests you filed, and audit events about you.

Deleting your account

Deletion takes effect at once and cannot be undone. When you delete your account:

• Removed: your private and unlisted kits and every version of them, draft versions of public kits, kits that were never published, your builds, private and unlisted stacks, likes, follows, installs, suggestions, ideas, showcase posts, collections, idea votes, flags, and collaborator roles, plus every session, API token, device login, and OAuth grant. Bundles no other kit uses are deleted from storage. The text of your comments and replies is erased; the empty entries stay so other people's replies keep their place.
• Cleared: your name, email, avatar, and GitHub link. Signing in with the same GitHub account later creates a new, separate account.
• Kept, anonymized: your public kits and their published versions, and your public stacks. Others install and depend on them, and versions are signed with the owner handle, so they stay available under a deleted account with no personal details attached.
• Retired handle: your handle stays attached to those kits and can never be claimed by anyone else, so nobody can impersonate you or hijack installs.
• Kept as records: the security audit log, AI cost records, reports you filed about kits, and takedown or name dispute requests, for as long as we need them for security and legal reasons. [Lawyer to set retention periods.]

If you want a public kit removed too, file a takedown request for it before or after deleting your account. Backups roll off within [N] days. [Lawyer to confirm backup retention.]

Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your data and to object to processing. Export and deletion above cover most of these. For anything else, write to privacy@slashclone.dev (placeholder address, not monitored yet).

Cookies

We use only the cookies needed to keep you signed in and protect sign-in. No tracking or advertising cookies.

Site analytics

We count page visits with Vercel Web Analytics, which sets no cookies and does not follow you across sites. It records the page, the referring site, and your country and device type, and identifies a visit only by a short-lived hash that resets daily. We use it to see which pages help people and which do not.