Privacy Policy
Last updated: June 11, 2026
Note: This is a plain-language policy for a pre-release service; it will be reviewed by counsel before general availability.
In plain English: We collect the minimum needed to run a registry — your GitHub profile basics when you sign in, the content and metadata you publish (which is public by design), short-lived server logs, and aggregate download counts. The portal uses Vercel Analytics for anonymous page-view metrics; there are no advertising trackers. If you bring your own LLM API key to the compose feature, it is used for that one request and never stored. You can delete your account by emailing privacy@amitte.com.
This Privacy Policy explains what data the Amitte project ("we", "us") collects when you use the registry, portal, CLI, or SDK ("the Service"), and what we do with it.
1. Data we collect
1a. From sign-in (GitHub OAuth)
When you sign in, we receive from GitHub:
- Your GitHub username and numeric ID
- Your public profile name and avatar URL (if set)
- Your verified email address (if you grant the
user:emailscope) - An OAuth access token (kept server-side; never sent to the browser)
We do not receive your GitHub password, your private repos, your followers list, or anything outside the OAuth scopes (read:user, user:email).
1b. From publishing
When you publish to the registry, we store:
- The full manifest (id, version, description, capabilities, domains, etc.)
- The artifact content (typically
skill.md) - Submission metadata: timestamps, pipeline stages run, review scores, your publisher handle
- Sigstore bundle (when supplied) — used to verify provenance
This data is public — distributing it is the point of a registry.
1c. From verifying domains
- The domain name you claim
- A challenge token we generate (server-side only)
- Verification status, timestamps, last DNS lookup result
The verified domain itself is public on your publisher profile.
1d. From browsing and fetching
For HTTP requests to the registry API:
- IP address — used for rate limiting; not retained long-term
- User-agent string — for compatibility metrics
- Request path and response status — for error telemetry
- Aggregate download counts per skill/version — counted as totals, not tied to who downloaded
Server logs are retained for roughly 7 days, then deleted.
1e. Portal analytics
The portal runs Vercel Analytics and Vercel Speed Insights — anonymous, cookie-free page-view and performance metrics. That is the full list. We do not use advertising cookies, tracking pixels, fingerprinting, or any other third-party analytics. The only cookie the portal sets is the Auth.js session cookie required for sign-in.
2. BYOK keys are never stored
The compose feature lets you bring your own LLM provider API key ("BYOK"). When you do:
- In the browser, the key lives in component state only — never written to localStorage, sessionStorage, or cookies.
- On the server, the key is held in memory for the duration of one request, forwarded to your chosen provider, and dropped.
- Logging is configured to redact API-key fields as defence in depth, so keys cannot leak into logs.
We never persist BYOK keys, server-side or client-side. Close the tab and the key is gone.
3. How we use the data
Solely to:
- Operate the Service (auth, publishing, search, fetch, compose).
- Enforce rate limits and abuse policies.
- Compute trust signals (verified domains, review scores, aggregate downloads).
- Communicate critical updates (security, account, takedowns) — by email if we have one.
We do not sell or rent your data, share it with advertisers or brokers, or use your personal data to train language models. (Automated review evaluates your published content — which is public — never your private profile data.)
4. Where data lives
- Database — Neon (Postgres), AWS US East (N. Virginia).
- Object storage — Cloudflare R2 for skill artifacts.
- Logs — application host logs, retained ~7 days.
- Backups — Neon point-in-time restore (7 days).
Data is encrypted in transit (TLS 1.2+) and at rest (provider-managed AES-256).
5. Third-party processors
| Processor | Purpose | Data shared |
|---|---|---|
| GitHub | Authentication | OAuth handshake (no further data sharing) |
| Neon | Database | Manifests, publisher records, verifications |
| Cloudflare R2 | Object storage | Skill artifacts |
| Render | API hosting | Request metadata in logs |
| Vercel | Portal hosting + analytics | Request metadata; anonymous page-view metrics |
| Groq | LLM review of submissions | Skill description + artifact content (public data) |
| Jina AI | Embedding generation | Skill description + artifact content (public data) |
| BYOK provider | Compose runs you opt into | Your prompt + the key you supply, per request only |
None of these receive your password, OAuth token, or anything beyond what's necessary for the listed purpose.
6. Your rights
- Access the data we hold on you — sign in and visit
/me, or email us. - Correct your profile via your GitHub account.
- Delete your account and linked data — see below.
- Export your published content via the public API.
- Object to processing — email us; we respond within 30 days.
- Complain to your local data protection authority.
For EU/UK users, the legal basis for processing is legitimate interest (operating the registry) and consent (when you publish or verify a domain).
7. Deleting your account
Email privacy@amitte.com from the address tied to your GitHub account, or open an issue using the account-deletion template at github.com/amitte-ai/amitte/issues.
Within 30 days we will:
- Delete your publisher record, verified domains, and credentials cache.
- Anonymize submission audit rows (kept for compliance with the publisher ID nulled).
- Leave already-published content in the registry by default — it's public and others may depend on it. If you want it removed too, say so in the request; versions will be revoked and artifacts deleted.
8. Data retention
- Active account data — while your account exists.
- Published content — indefinitely (registries are meant to be durable), unless revoked.
- Server logs — ~7 days.
- Backups — 7 days.
- Deleted-account data — removed within 30 days of the request.
9. Children
The Service is not directed at children under 13 (or the local minimum age). If you believe a child has registered, contact us and we will delete the account.
10. Changes
This policy is versioned in the public repository. The "Last updated" date reflects the most recent change; material changes are announced in the Changelog and, where practical, by email to publishers.
11. Contact
Privacy questions and deletion requests: privacy@amitte.com, or open an issue tagged privacy at github.com/amitte-ai/amitte/issues.