spb/skills-spboucher-ai

1---2title: Privacy notice3description: What the registry records, why, for how long, and your rights.4order: 25section: Legal6---78# Privacy notice910Version of 9 November 2026.1112> This is a good-faith first version written by the operator, not by a lawyer. It will be reviewed by counsel. It is written to describe what the software actually does; if you find a difference between this notice and the behaviour of the service, please tell us.1314## Who is responsible1516Simon-Pierre Boucher, Quebec, Canada, operates skills.spboucher.ai and is the person responsible for the protection of personal information for this service, within the meaning of Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25).1718Contact: contact@spboucher.ai1920## The short version2122- You can read, search and download without an account and without being tracked.23- There are no analytics, advertising or third-party trackers on this site, and no third-party scripts or fonts are loaded.24- The only cookie is a session cookie, set when you sign in.25- We keep a security log of actions on accounts and publications. It includes IP addresses.2627## What we record2829### If you only browse, search or download3031| Data | Purpose | Kept |32|---|---|---|33| A keyed, truncated hash derived from the date, the release, your IP address and your browser's user agent | To count a download at most once per visitor per day | Deleted after two days |34| Daily download totals per release | To show an estimated download count | Indefinitely; contains no personal information |35| Counters per IP address for rate limiting | To protect the service from abuse | In memory only, for minutes to an hour; never written to disk |3637Your IP address itself is not stored when you browse or download.3839The service is reached through a TLS gateway server operated by the same person, hosted by OVHcloud in Beauharnois, Quebec. Like any web server it may keep standard access logs (IP address, time, requested address) for a limited period for operational and security purposes.4041### If you file an abuse report4243| Data | Purpose | Kept |44|---|---|---|45| The report text, the artifact concerned, and the contact address if you choose to give one | To assess and answer the report | While relevant to moderation history |46| A security-log entry with your IP address and user agent | To detect abusive reporting | See "Security log" below |4748Reports are visible only to moderators.4950### If you have an account5152| Data | Purpose |53|---|---|54| Email address, display name | To identify you, sign you in, and show who published an artifact (display name only is shown publicly) |55| Password, stored only as an argon2id hash | To sign you in |56| Sessions: a keyed hash of the session identifier, creation and expiry time, IP address and user agent at sign-in | To keep you signed in and let sessions be revoked |57| API tokens: name, public prefix, a keyed hash of the secret, scopes, namespaces, expiry, time and IP address of last use | To authenticate automated publishing and let you review and revoke tokens |58| What you publish: artifacts, releases, files, release notes | The purpose of the service; public if you made it public |5960### Security log (audit events)6162For security and accountability we record an entry for: sign-ins and failed sign-ins, failed token authentications, token creation, rotation and revocation, creation and changes of artifacts, uploads and publications, rejections, revocations, moderation actions, denied authorization attempts, and abuse reports.6364Each entry contains the time, the action, what it concerned, the result, the acting account or token prefix if any, the **IP address**, the **user agent**, and a request identifier. Passwords and token secrets are never written to it.6566This log cannot be edited or deleted by the application. In this version it is kept indefinitely; a retention period with archival will be defined.6768A public history of each artifact (who published or revoked which version, and when) is derived from this log. It shows display names and never IP addresses.6970## Cookies7172One cookie, `skills_session`, is set only when you sign in. It is necessary for the sign-in to work, is not used for tracking, and expires after 12 hours or when you sign out. No consent banner is shown because no optional cookies or trackers are used.7374## Who receives your information7576- **The public:** what you choose to publish, your namespace and your display name.77- **Hosting:** the application and its database run on computers owned by the operator in Quebec. The TLS gateway is hosted by OVHcloud in Quebec. Backups are kept on the operator's own computers.78- Nobody else. We do not sell, rent or share personal information, and we do not use it for advertising or profiling. We may disclose information if the law requires it.7980No email is sent by the service in this version.8182## Where it is stored8384In Quebec, Canada. Visitors from elsewhere should be aware that their information is processed in Canada.8586## Security8788Passwords and tokens are stored only as hashes. Connections use TLS. Access to the server is restricted to the operator. Published versions and the security log are protected against modification. No system is perfectly secure; if an incident presents a risk of serious injury, we will notify the people concerned and the Commission d'accès à l'information du Québec as the law requires.8990## Your rights9192You may ask to access the personal information we hold about you, to have it corrected, to withdraw consent, and to have it deleted or to have your account closed. Write to contact@spboucher.ai. We will answer within 30 days.9394Two limits you should know about:9596- **Published versions are permanent by design.** Closing your account does not automatically remove artifacts you published, because others may depend on them. You can ask for their removal; we will revoke or take them down where appropriate, and erase content where the law requires it.97- **Security-log entries** are retained for the integrity of the record. On a valid request we will restrict their use and, where the law requires, anonymise the personal information in them.9899If you are not satisfied with our answer you may contact the Commission d'accès à l'information du Québec.100101## Children102103The service is intended for developers and researchers and is not directed at children under 14.104105## Changes106107We will update this notice when the service changes what it records, and change the date at the top.108