Privacy

• Account. Your email address, and — when you sign in with Google or LinkedIn — the name and avatar those providers return. We never see your password; there isn't one.
• Organization data. Members' emails and roles, the policy, and the install decisions, approvals, drift actions and audit events your enrolled agents and admins generate. Each decision carries the skill name, version, artifact hash, outcome, the agent type and the machine hostname.
• Skill uploads. Directories you submit with vet-skills detonate are kept to produce and reproduce the verdict. They are not published unless you publish them.
• Public registry data. Skills, publishers and install counts crawled from public registries (skills.sh, ClawHub, Claude Code plugin marketplaces, npm, PyPI, the Docker MCP Catalog, Glama, the official MCP Registry); this is not personal data about you.
• CLI usage telemetry (free tier). A machine running vet-skills that is not enrolled in an organization sends each install decision anonymously: skill name, version, registry, the decision, agent type, hook version and operating system, under a random client id stored in ~/.vet-skills/id. No email, hostname, path, code, prompt or file content is sent. Turn it off with vet-skills telemetry off, VET_SKILLS_TELEMETRY=0 or DO_NOT_TRACK=1. Enrolled machines report to their organization instead (see Organization data).
• Field signals (free tier, vet-skills 0.7.9+). When the hook observes a skill deviating from its sandbox trace or a tool result carrying instructions aimed at the agent, it sends the skill name, version, the kind of deviation, the tool name, agent type, hook version and operating system under the same random client id. Never the detail (host, path, text), prompts, arguments or output. The schema is published on the CLI docs; vet-skills hook install asks once and vet-skills telemetry off turns it off.
• Canary credentials. vet-skills canary install writes decoy credential files on your machine with random values. The values stay in ~/.vet-skills/canaries.json on that machine; when one is seen in a session, only the kind of file (for example "github token canary") is logged, reported to your organization if enrolled, and sent as a field signal. The value is never transmitted.
• Operational logs. Request logs with IP address and user agent, retained 30 days for abuse prevention and debugging.
• Site analytics. The public pages (home, leaderboard, verdicts, pricing, docs) use Google Analytics 4 to count visits and page views. The dashboard, account and sign-in pages are not measured.
• Where you came from. On your first visit we set a first-party cookie (ks_src, 90 days) recording how you arrived: the campaign tag on the link, or the name of the referring site, plus the page you landed on and when. If you create an account, that one record is saved with it so we know which channels bring people. No IP address, device fingerprint or cross-site tracking.

We do not collect prompts, conversation history, source code (outside a deliberate detonate upload), environment variables, or the contents of skills installed on your machines.

• To run the product: verdicts, inventory, approvals, drift alerts and the audit log.
• To email you about your account and trial — sign-in links, invitations, trial milestones, billing. Marketing email is opt-in and separate.
• To bill through Stripe, which processes payment details under its own privacy policy; we hold only customer and subscription identifiers.
• Aggregate, de-identified statistics (how many skills are scored, what share is blocked) appear on the public site.

Service providers that run the product for us: Railway (hosting, US), Cloudflare (edge and DNS), Resend (transactional email), Stripe (billing), Google Analytics (public-page traffic), and Google or LinkedIn when you choose them for sign-in. Each receives only what its function needs. We don't sell personal data or share it with advertisers.

Organization data is kept while the organization exists; audit events are retained for the life of the org because that is their purpose. Email [email protected] from the account address to export or delete your account or your organization; deletion completes within 30 days, with backups aging out after 90.

Material changes are announced by email to organization owners before they take effect. Questions: [email protected]. Security specifics are on the Security page.