Privacy Policy

Last updated: October 23, 2026 · Effective date: October 23, 2026

Draft: this page is under final review and may change before Skill Forge officially launches. Questions: support@webbox.app

Short version: SkillForge collects very little. We never see the prompts you send Claude, the files on your machine, or the credentials you configure in your skills (those live locally). What we DO collect is the minimum we need to run an account, bill subscriptions, support you when something breaks, and detect abuse. You can export or delete it any time.

1. Who we are

SkillForge is a product of Web Box Apps LLC. For purposes of GDPR and similar laws, Web Box Apps LLC is the data controller for the information you submit to us. Contact: privacy@webbox.app.

2. What we collect

2.1 Account information

When you create an account, we collect your email address, a hashed password, your display name (if you set one), the date you signed up, and your selected subscription tier. That's the minimum to identify you across sessions and route emails to you.

2.2 Billing information

Paid subscriptions go through Stripe. We never see or store your full card number. Stripe handles all card data and sends us back a customer reference (so we can charge renewals) plus the last 4 digits of the card and its expiration date (so we can show you which card is on file). Stripe's own privacy practices apply to your payment information.

2.3 Skill installation and usage

When you install, update, configure, or uninstall a skill via the Desktop app, the app logs the action to our marketplace database. Each entry has the action type, your user ID, the skill slug and version, and a timestamp. We use this to:

  • Show you which skills you have installed and their versions
  • Tell you when a skill has an update available
  • Aggregate anonymized install counts so we can prioritize what to polish
  • Detect abuse (e.g. one account installing a skill 10,000 times in a minute)

2.4 Backchannel (opt-in telemetry)

The SkillForge Desktop app includes an optional telemetry channel called Backchannel that helps us understand how skills are actually used. Backchannel is off by default. You opt in from Settings → Privacy in the Desktop app, and you pick one of three tiers (each a strict superset of the one above):

  1. Anonymous — counts only. "Skill X loaded N times this week, tool Y called M times." No prompts, no arguments, no identifiers.
  2. Identifiable — same counts plus your account ID, so we can give you per-skill dashboards and apply per-account limits. Still no prompt or argument content.
  3. Full — counts + account + tool input/output payloads. Used only when you're actively troubleshooting a skill with us. We recommend you set this back to Identifiable when you're done.

You can change your Backchannel tier at any time from the Desktop app. We drop the higher-tier records when you downgrade.

2.5 Support communications

If you email support@webbox.app or post in our community, we keep the conversation history so we can pick up where we left off the next time you reach out. Support emails are stored on our self-hosted mail server and are not used for marketing.

2.6 Web logs

Our web server keeps standard request logs (IP address, user agent, requested URL, timestamp, response status) for up to 90 days. We use these to debug outages and detect abuse. We don't sell, share, or analyze these logs for advertising.

3. What we DON'T collect

This list matters as much as the one above.

  • Your prompts to Claude. Those go from your Claude client (Claude Code, Claude Desktop, Claude.ai) directly to Anthropic. We never see them. SkillForge skills are tools Claude calls — the prompt doesn't pass through us.
  • Files on your machine. Local skills read your filesystem locally. Nothing crosses the network unless the skill itself explicitly sends data to a third-party service it's connected to (and you'll know which ones do that from the skill's manifest).
  • Credentials you configure in skills. API keys, SSH keys, database passwords, OAuth tokens — those live in config.json files on your disk. We never receive them.
  • The contents of databases you query, servers you SSH into, browsers you drive, etc. Skills do that work locally on your machine.
  • Tracking pixels or third-party analytics. Our site does not load Google Analytics, Facebook Pixel, or any other behavioral tracker.

4. How we use what we collect

  • To run the service — log you in, deliver the skills you've subscribed to, bill renewals, send transactional emails (password resets, receipts, etc.)
  • To support you — answer questions you send, investigate bugs you report
  • To improve skills — Backchannel data, when opted in, tells us which tools are used most so we know where to spend polish budget
  • To detect abuse — accounts that violate our Terms of Service get reviewed using install logs, web logs, and (rarely) Backchannel data

We do not use your data for advertising. We do not sell it. We do not share it with third parties beyond what's listed in Section 6.

5. Cookies and session storage

Our site uses a single session cookie to keep you logged in. We do not use tracking cookies. The session cookie expires when you log out or after a period of inactivity.

The Desktop app stores your auth token in a per-user local file (encrypted on macOS via Keychain and on Windows via the Credentials Manager when available; otherwise in a permission-limited file). It's used to authenticate API calls to our marketplace.

6. Who we share data with

We share the minimum necessary data with the following service providers, each of which has its own privacy practices:

  • Stripe — for payment processing. Stripe sees your name, email, billing address, and card information.
  • Our email provider — for delivering transactional and support emails. The provider sees your email address and the message contents.
  • Our hosting — our application servers and database run on hardware we operate in the United States. Web traffic reaches them through a proxy server we run on Amazon Web Services (AWS) in the United States, which handles the encrypted (HTTPS) connection. AWS provides the machine; we operate it.

We may disclose data when legally compelled to do so (subpoena, court order). When we can, we'll notify you before disclosure.

We will never sell your data to advertisers or data brokers. If we ever change this policy — and we have no plans to — we'll give you 90 days' notice and the option to delete your account first.

7. Data retention

  • Account data — kept while your account is active. After you delete your account, identifiable data is removed within 30 days, except where we are legally required to retain it (e.g. tax records for billing transactions).
  • Backchannel data — kept according to the tier you opted into. Anonymous data is retained indefinitely (it's not tied to you). Identifiable and Full-tier records are removed when you downgrade or delete your account.
  • Web logs — 90 days.
  • Backups — Database backups are kept for 30 days. Deleted records may persist in backups until they age out.

8. Your rights

You can:

  • Access — see what we have on you via your account dashboard, or request a full export by emailing privacy@webbox.app.
  • Correct — update your account profile any time from the dashboard.
  • Delete — close your account from the dashboard, or email privacy@webbox.app. We delete identifiable data within 30 days subject to the retention exceptions above.
  • Object to processing — turn off Backchannel from the Desktop app, or withdraw consent for any specific processing by emailing us.
  • Lodge a complaint — if you're in the EU, the UK, or another jurisdiction with a data protection authority, you have the right to file a complaint with them.

We respond to data rights requests within 30 days.

9. International data transfers

Our servers are located in the United States. If you access SkillForge from outside the US, your data will be transferred to and processed in the US. By using SkillForge, you consent to this transfer. We apply the same standards of protection to all user data regardless of where the user is located.

10. Children

SkillForge is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we've collected data from a child under 16, please email us and we'll delete it.

11. Security

We take reasonable measures to protect your data:

  • All traffic to our site and APIs is HTTPS-encrypted.
  • Passwords are stored hashed (argon2) and never recoverable in plaintext.
  • Payment data is handled by Stripe and never touches our servers.
  • Database backups are encrypted at rest.
  • Access to production data is limited to a small number of administrators and logged.

No security is perfect. If you suspect your account has been compromised, email security@webbox.app immediately.

12. Changes to this Policy

We may update this Privacy Policy as the service evolves. If we make a material change — for example, we add a new category of data or a new third-party processor — we'll email you and post a notice on the site at least 30 days before the change takes effect. Continued use after the effective date means you accept the updated Policy.

13. Contact

Privacy questions: privacy@webbox.app
Security disclosures: security@webbox.app
Everything else: support@webbox.app

We wrote this policy in plain language because privacy is a real concern and obscure language only makes it worse. If anything here is unclear or seems incomplete, please tell us — we'd rather hear it.