Legal
Privacy notice
Version of 9 November 2026.
This is a good-faith first version written by the operator, not by a lawyer. It will be reviewed by counsel. It is written to describe what the software actually does; if you find a difference between this notice and the behaviour of the service, please tell us.
Who is responsible
Simon-Pierre Boucher, Quebec, Canada, operates skills.spboucher.ai and is the person responsible for the protection of personal information for this service, within the meaning of Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25).
Contact: contact@spboucher.ai
The short version
- You can read, search and download without an account and without being tracked.
- There are no analytics, advertising or third-party trackers on this site, and no third-party scripts or fonts are loaded.
- The only cookie is a session cookie, set when you sign in.
- We keep a security log of actions on accounts and publications. It includes IP addresses.
What we record
If you only browse, search or download
| Data | Purpose | Kept |
|---|---|---|
| A keyed, truncated hash derived from the date, the release, your IP address and your browser's user agent | To count a download at most once per visitor per day | Deleted after two days |
| Daily download totals per release | To show an estimated download count | Indefinitely; contains no personal information |
| Counters per IP address for rate limiting | To protect the service from abuse | In memory only, for minutes to an hour; never written to disk |
Your IP address itself is not stored when you browse or download.
The service is reached through a TLS gateway server operated by the same person, hosted by OVHcloud in Beauharnois, Quebec. Like any web server it may keep standard access logs (IP address, time, requested address) for a limited period for operational and security purposes.
If you file an abuse report
| Data | Purpose | Kept |
|---|---|---|
| The report text, the artifact concerned, and the contact address if you choose to give one | To assess and answer the report | While relevant to moderation history |
| A security-log entry with your IP address and user agent | To detect abusive reporting | See "Security log" below |
Reports are visible only to moderators.
If you have an account
| Data | Purpose |
|---|---|
| Email address, display name | To identify you, sign you in, and show who published an artifact (display name only is shown publicly) |
| Password, stored only as an argon2id hash | To sign you in |
| Sessions: a keyed hash of the session identifier, creation and expiry time, IP address and user agent at sign-in | To keep you signed in and let sessions be revoked |
| API tokens: name, public prefix, a keyed hash of the secret, scopes, namespaces, expiry, time and IP address of last use | To authenticate automated publishing and let you review and revoke tokens |
| What you publish: artifacts, releases, files, release notes | The purpose of the service; public if you made it public |
Security log (audit events)
For security and accountability we record an entry for: sign-ins and failed sign-ins, failed token authentications, token creation, rotation and revocation, creation and changes of artifacts, uploads and publications, rejections, revocations, moderation actions, denied authorization attempts, and abuse reports.
Each entry contains the time, the action, what it concerned, the result, the acting account or token prefix if any, the IP address, the user agent, and a request identifier. Passwords and token secrets are never written to it.
This log cannot be edited or deleted by the application. In this version it is kept indefinitely; a retention period with archival will be defined.
A public history of each artifact (who published or revoked which version, and when) is derived from this log. It shows display names and never IP addresses.
Cookies
One cookie, skills_session, is set only when you sign in. It is necessary for the sign-in to work, is not used for tracking, and expires after 12 hours or when you sign out. No consent banner is shown because no optional cookies or trackers are used.
Who receives your information
- The public: what you choose to publish, your namespace and your display name.
- Hosting: the application and its database run on computers owned by the operator in Quebec. The TLS gateway is hosted by OVHcloud in Quebec. Backups are kept on the operator's own computers.
- Nobody else. We do not sell, rent or share personal information, and we do not use it for advertising or profiling. We may disclose information if the law requires it.
No email is sent by the service in this version.
Where it is stored
In Quebec, Canada. Visitors from elsewhere should be aware that their information is processed in Canada.
Security
Passwords and tokens are stored only as hashes. Connections use TLS. Access to the server is restricted to the operator. Published versions and the security log are protected against modification. No system is perfectly secure; if an incident presents a risk of serious injury, we will notify the people concerned and the Commission d'accès à l'information du Québec as the law requires.
Your rights
You may ask to access the personal information we hold about you, to have it corrected, to withdraw consent, and to have it deleted or to have your account closed. Write to contact@spboucher.ai. We will answer within 30 days.
Two limits you should know about:
- Published versions are permanent by design. Closing your account does not automatically remove artifacts you published, because others may depend on them. You can ask for their removal; we will revoke or take them down where appropriate, and erase content where the law requires it.
- Security-log entries are retained for the integrity of the record. On a valid request we will restrict their use and, where the law requires, anonymise the personal information in them.
If you are not satisfied with our answer you may contact the Commission d'accès à l'information du Québec.
Children
The service is intended for developers and researchers and is not directed at children under 14.
Changes
We will update this notice when the service changes what it records, and change the date at the top.