AgentSpec (“we”, “our”, or “us”) operates the agentspec.sh website, the AgentSpec desktop application, and the agentspec-cli command-line tool (collectively, the “Service”). This policy explains what data we collect, why we collect it, and what choices you have.
1. Information we collect
Account data (when you sign in with GitHub)
When you authenticate via GitHub OAuth, we receive and store the following from your GitHub public profile:
- GitHub numeric user ID
- Username (login handle)
- Display name, avatar URL, and public bio
- Primary email address (used only for account recovery and legal notices)
We request the read:user user:email scope. We do not access your repositories, private profile information, or any other GitHub data.
Content you submit
Configs, skills, rules, plugins, specs, comments, and votes you publish are stored in our database and associated with your account. Publishing is public by design.
Anonymous voting
To prevent vote manipulation from anonymous visitors, we derive a stable anonymous identifier by computing the SHA-256 hash of your IP address concatenated with your User Agent string. We store only the one-way hash — the original IP address and User Agent are never persisted. Anonymous votes are weighted at 0.3 compared to authenticated votes (1.0).
Analytics cookies
We use Google Analytics 4 to understand aggregate traffic patterns. GA4 sets first-party cookies (_ga, _ga_*) to measure unique visitors. Analytics only run after you accept the cookie consent banner.
Technical logs
Cloudflare, our hosting provider, records standard server access logs (IP address, request timestamp, URL, user agent, response code) for security, debugging, and abuse prevention. Logs are retained for up to 30 days.
2. How we use information
- To operate the Service (serve content, authenticate users, prevent abuse)
- To display your public profile, submissions, and vote counts
- To tally installs, votes, and rank content on the homepage
- To communicate account or legal notices by email
- To improve performance and troubleshoot issues via aggregate analytics
We do not sell your data, display third-party ads, or use your content to train machine-learning models.
3. Where data is stored
Application data is stored on Cloudflare D1, a globally distributed SQLite-based database operated by Cloudflare, Inc. Backups and asset storage reside on Cloudflare R2.
4. Retention
- Account data: retained until you delete your account.
- Content submissions: retained until you delete them or your account.
- Anonymous vote hashes: retained for as long as the associated content item exists.
- Server access logs: up to 30 days.
- Analytics data: retained according to Google’s default GA4 retention (14 months).
5. Your rights
You may, at any time, request any of the following by emailing us at the address below:
- Export a copy of the data associated with your account
- Correct or delete your account and all associated content
- Opt out of analytics (decline the cookie banner, or use a browser-level opt-out)
- Request that a third-party submission be removed via the DMCA process (see Terms of Service)
If you are a resident of the European Economic Area, the United Kingdom, or California, you may have additional rights under GDPR or CCPA, including the right to object to processing and lodge a complaint with a supervisory authority.
6. Cookies
- Session cookie (
session) — set after GitHub sign-in to maintain your authenticated state. Strictly necessary; cannot be opted out while signed in. - Analytics cookies (
_ga,_ga_*) — only loaded after you click “Accept” on the cookie banner. - Theme / consent preference (
localStorage) — stores your dark-mode preference and cookie consent choice locally. Never transmitted to us.
7. Third-party services
- Cloudflare — hosting, CDN, database, and object storage (privacy policy)
- GitHub — authentication provider (privacy policy)
- Google Analytics — aggregate analytics (privacy policy)
8. Children
The Service is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has provided us with personal information, please contact us so we can delete it.
9. Changes to this policy
We may update this policy from time to time. Material changes will be announced on the changelog page. The “Last updated” date at the top of this document reflects the latest revision.
10. Contact
For privacy requests, data deletion, or any questions about this policy, email us at support@agentspec.sh.