PRIVACY

Privacy Policy

Effective date: September 11, 2026

What SkillLock processes

Local-folder scans happen in your browser. SkillLock does not upload selected local files to its server. For a public GitHub scan, SkillLock receives the public GitHub URL you enter and fetches supported text files from that repository to produce a report. For a private GitHub scan, SkillLock uses a GitHub App user access token to read only repositories available to both you and the app installation you selected.

What SkillLock does not do

SkillLock does not execute scanned code, create GitHub repositories, modify repository content, sell scan reports, or use advertising analytics. The product is not designed for entering passwords or API keys. GitHub access tokens are encrypted and authenticated before being kept in a Secure, HTTP-only browser cookie, so browser JavaScript cannot read them.

How GitHub data is used

When you request a GitHub scan, the server sends the applicable GitHub access token only to GitHub services needed to retrieve the selected repository content, including GitHub’s API and raw-content service. It does not send that token to unrelated websites. The scan result is returned to your browser; SkillLock does not execute repository code.

Temporary processing

Public GitHub scan content may be held temporarily in server memory for up to five minutes to reduce repeat requests. Private repository content is processed only for the requested scan and is never placed in the shared scan cache. The short-lived OAuth state cookie expires after ten minutes. The encrypted GitHub connection cookie expires within eight hours or when you disconnect.

Service providers and routine logs

GitHub provides repository content and authentication. Render hosts the application, and Cloudflare provides domain and network services. These providers may process routine technical information such as IP address, request timing, browser information, and security logs to operate and protect their services. SkillLock does not add third-party advertising or analytics scripts to the site.

Your choices

Do not submit a URL containing private credentials. Use local scanning for files you do not want to share with GitHub or the hosting service. You can disconnect GitHub at any time, which removes the SkillLock connection cookie from your browser. You may stop using the service at any time.

Changes

This policy may change as SkillLock develops. The effective date above will be updated when material changes are made.