Privacy policy

Last updated 11 October 2026

This page says what the Claude Skills Library does with personal data. In short: browsing sets no cookies and tracks nothing, and an account keeps only what it needs to sign you in safely.

Who is responsible

Code Art Web Solutions S.R.L. runs this site and decides what happens to the data described here: it is the controller. It is registered in Romania with CUI 50223815 and trade register number J2024001424294, in Iordăcheanu, Prahova county, Romania. For anything on this page, including the requests under “Your rights”, write to contact@basetech.ro.

Browsing the site

• No cookies, analytics, advertising or tracking. Every visitor gets the same prebuilt pages.
• Your browser keeps two notes in its own storage, and they never leave it: your choice of light or dark theme, and, once you have signed in, a note that you have, so the header knows to load your account menu. Clearing this site’s data in your browser removes both.
• Fonts and icons are served from this site, and GitHub statistics are fetched by our servers ahead of time, so viewing a page sends nothing to anyone but our hosting provider.
• Like any web server, our hosting provider receives your IP address and the address of the page you ask for. It needs them to deliver pages and protect the service, which is our legitimate interest (GDPR art. 6(1)(f)). The request logs we can see are kept for one hour.

Your account

Accounts are invite-only for now, and browsing never needs one.

What we keep

• Your profile: your name, your email address, whether you have confirmed it, when the account was created and last changed, and the username and one-line bio you set, if any. None of it is shown to other people yet.
• Your password, if you set one, only as a one-way hash, never the password itself.
• Your GitHub link, if you sign in with GitHub: your GitHub account number, the access token GitHub issues, stored encrypted, and the name, email address and profile picture address GitHub shares. We use them only to sign you in, and never act on GitHub for you.
• Two-factor authentication, if you turn it on: the key your authenticator app shares with us and your backup codes, both encrypted, and a count of wrong codes, which pauses the check for 15 minutes after 10 in a row.
• Your passkeys, if you add any: each one’s public key and identifier, the name you give it, when you added it, whether it syncs between your devices, and which kind of authenticator made it. The private key never leaves your device.
• Your sessions: for each browser you sign in on, a random session token, its expiry, the IP address and the browser’s user agent. The token sits in one cookie, which keeps you signed in. A few steps set a second cookie that expires within 10 minutes: a GitHub sign-in, to check that the sign-in you return from is the one you started, a sign-in that asks for your two-factor code, and signing in with or adding a passkey.
• Sign-in attempts: a counter per IP address and sign-in endpoint, used only to slow down repeated attempts.
• Email links: the links that finish a new account, reset your password, change your email address or delete your account. The links to finish an account, reset a password or delete an account are stored only as a hash; the links for an email change are not stored.

Why, and on what legal basis

• To create your account, sign you in the ways you choose, and send the emails an account needs: finishing your account, resetting your password, confirming a change of address or a deletion, telling you when a passkey is added, and telling you when someone tries to register your address again. This is the service you asked for (performance of a contract, GDPR art. 6(1)(b)).
• To protect accounts from takeover and abuse, through the IP address and user agent on your sessions, the sign-in attempt counters and the count of wrong two-factor codes. This is our legitimate interest in keeping accounts secure (art. 6(1)(f)), and you can object to it.
• Nothing about you is used for advertising, sold, or used to make automated decisions about you.
• An account needs a name and an email address, or a GitHub account. Without an account you can still use the whole catalog.

How long we keep it

• Your profile and sign-in methods (password hash, GitHub link, two-factor settings, passkeys): until your account is deleted. You can delete it yourself in your account settings, or email us and we delete it within one month.
• A session: deleted when you sign out, or sign it out from your account settings. A session you never sign out of stops working after 7 days without use, and is deleted within a day after that.
• Email links stop working after one hour, and a link to delete your account after 24 hours. Stored links are deleted within a day after that, and with your account.
• Sign-in attempt counters: deleted once a counter has gone unused for a day.
• Copies: our email provider keeps each email it sends for 30 days, and our database provider keeps a 6-hour restore history, so deleted data leaves its backups within 6 hours.

Who else handles the data

These companies run parts of the site for us, under their data processing terms:

• Vercel Inc. (United States): hosting. Pages are served from its network, and the code behind accounts runs in the United States.
• Neon (United States, Amazon Web Services region us-east-1): the database that holds accounts, provided through the Vercel Marketplace.
• Resend (United States): sends account emails. Resend also keeps data on how its own service is used, as a controller in its own right.
• GitHub, Inc. (United States), only if you sign in with GitHub. GitHub shares your profile with us when you allow it, and its own privacy statement covers what GitHub does.

Vercel, Neon and Resend process data in the United States. These transfers rely on the European Commission’s Standard Contractual Clauses in each provider’s data processing terms, and on the EU–US Data Privacy Framework where the provider is certified under it.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict its use, or to receive it in a portable format, and you can object to processing based on our legitimate interest. Write to contact@basetech.ro; we answer within one month. Signed in, you can also download a copy of your data and delete your account yourself, in your account settings.

If you think we handle your data unlawfully, you can complain to the Romanian data protection authority, ANSPDCP, at B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest (dataprotection.ro), or to the authority where you live.

Changes to this policy

When what the site does with data changes, this page changes with it, and the date at the top shows when. If a change affects account holders, we email them before it applies. The terms of use cover the rest of the rules for using the site.