Privacy Policy

KDX Labs Corp. ("we", "us") operates SkillCDN (https://skillcdn.ai, the "Service"). This policy explains what personal data the Service processes, why, and for how long. You can use the Service without signing in. To use private repositories you sign in with your GitHub account; even then we never receive your password, your email address or your contact details.

1. What we process, why, and for how long

For everyone who uses the Service:

Data	Items	Purpose	Retention
Access logs (collected automatically with every request)	IP address, browser or client information (User-Agent), requested path (without its query string), time of the request, response status and duration, request identifier	Providing the Service, diagnosing errors, security and abuse prevention	Deleted automatically after 90 days
Usage statistics	Daily counts per public repository. Distinct users are counted by hashing IP addresses with a key for the day; the IP addresses themselves are not stored. Private repositories are not counted.	Showing how repositories are used	Hashes are deleted when the day's count is complete (about one day). The counts contain no personal data.
Enquiries and reports (when you email hi@skillcdn.ai)	Email address, name (if given), message and attachments	Answering you, handling removal requests and reports, dealing with related disputes	3 years after the matter is closed
Analytics (see section 5 for when they run)	Google Analytics cookie identifiers, pages visited and interactions (the pages tell Google only the addresses of public repositories and the kind of page, never a private repository, an account you are signed in as, or anything you typed), browser and device information, approximate location derived from the IP address	Learning which pages help, to improve the Service	Up to 14 months after collection
Personalized advertising (only with your consent, which the Service does not ask for at present)	The same items as analytics, and Google advertising cookie identifiers	Advertising SkillCDN to you through Google's advertising (remarketing), measuring our ads, reports on visitors' interests and demographics	Up to 14 months after collection; what Google uses for its own purposes is governed by Google's privacy policy

Only for people who sign in with a GitHub account:

Data	Items	Purpose	Retention
Account details (received from GitHub when you sign in)	The numeric id of your GitHub account, your login, your display name (if you gave GitHub one), the kind of account, when you first and last signed in	Knowing who you are, providing your account pages	Until you ask us to delete your account
GitHub authorization token	The access token and refresh token GitHub issued for you, and when each expires. Stored encrypted.	Only to ask GitHub which repositories you can see and where the SkillCDN GitHub App is installed. We never read repository content with it, and it cannot change anything at GitHub.	Until you revoke the app at GitHub, the token expires and can no longer be renewed, or you ask us to delete your account
Sign-in sessions	A hash of the session cookie's value, when the session was created, last used and expires	Keeping you signed in	Deleted at once when you sign out; expires and is deleted after 30 days without use
Access check results	Which private repositories GitHub said you can see, and when we asked	Serving private repositories without asking GitHub on every request	Believed for one minute, deleted within a day at the latest
Connected AI apps	The name and address of each app you allowed, the repository address it may read, when you allowed it and when it was last used, hashes of the tokens issued to it	Letting an AI app you allowed read a private repository in your name	Deleted at once when you remove the app; expires and is deleted when the app has not renewed its token for 30 days
Tokens for agents	The label you gave the token, the repository it is for, when it was made, expires and was last used, a hash of the token	Letting an agent that cannot sign in (a scheduled job, a server) read one private repository in your name	Deleted at once when you remove it; expires and is deleted at the end of the lifetime you chose (one day to one year)

When you are signed in, our servers ask GitHub about your access using your GitHub authorization token. GitHub handles those requests under its own privacy statement. We do not receive your email address, your private profile or any permission to write to your repositories.

Repository content. The Service indexes and serves content published in public repositories, which may contain personal data such as authors' names or email addresses. We keep it while the repository is public and served by the Service, and delete it when we receive a removal request or block the repository. We read the content of a private repository only where its owner or an administrator installed the SkillCDN GitHub App on it, and serve it only to people GitHub shows that repository to, and to the AI apps and agents those people allowed. When the app is removed or the repository is deleted, we delete its index and our copies. Deleted content may remain in database backups for up to 14 days.

Account pages. The Service has a page anyone can see for every GitHub account (https://skillcdn.ai/gh/<account>). It shows what GitHub shows everyone (login, display name, profile picture, the list of public repositories), fetched from GitHub as it is, whether or not that account ever signed in to the Service. Private repositories never appear on it. When you change or hide something at GitHub, the page follows.

Legal bases. We process access logs, usage statistics, repository content, account pages, and enquiries and reports on the basis of our legitimate interest in providing and protecting the Service and in answering requests (Article 6(1)(f) GDPR; Article 15(1)(6) of Korea's Personal Information Protection Act). We process the data of people who sign in to provide the sign-in and private repository features they asked for (Article 6(1)(b) GDPR; Article 15(1)(4) of the Personal Information Protection Act). Where you are in the European Economic Area, the United Kingdom or Switzerland, or we could not tell where you are, we process analytics data only on the basis of your consent (Article 6(1)(a) GDPR). Elsewhere we process it on the basis of our legitimate interest in learning how the Service is used (Article 15(1)(6) of the Personal Information Protection Act), and you can turn it off at any time in the footer's "Cookie settings". We process advertising data only on the basis of your consent (Articles 15(1)(1) and 17(1)(1) of the Personal Information Protection Act). Where the law requires us to keep personal data, we keep it for the period it sets.

2. Deletion

We delete personal data without delay when its retention period ends. Access logs are deleted automatically at the end of their retention period, usage statistics hashes are deleted every day, and enquiry emails are deleted from the mailbox when their retention period ends. Expired sessions and tokens and old access check results are deleted automatically every fifteen minutes. When you revoke the app at GitHub, your GitHub authorization token, every session, your connected AI apps, your tokens for agents and your access check results are deleted together. Analytics data are deleted at the end of the retention period set in Google Analytics. Electronic files are deleted so that they cannot be recovered; we do not keep personal data on paper.

3. Sharing

We do not sell personal data or share it with third parties, except:

1. If you consent to personalized advertising, we share the following with Google for advertising. Refusing has no effect on your use of the Service.

Recipient	Purpose	Data	Retention
Google LLC (United States, googlekrsupport@google.com)	Personalized advertising and measuring ads	Pages visited and interactions, cookie identifiers, browser and device information, approximate location	As set out in Google's privacy policy

Google acts as an independent controller for this data and may combine it with what it knows about users signed in to a Google account (Google signals). The data is sent over the network to Google in the United States when you visit a page after consenting.

2. When authorities require it through lawful procedures.

When you allow an AI app to connect, the Service answers that app's requests with the content of the repository you allowed. That happens on your instruction, and we do not give the app your account details or your GitHub authorization token. What the app does with the content it receives is governed by its provider's policies.

4. Service providers and international transfers

We use the service providers below to run the Service. They process personal data on our behalf, outside Korea.

Provider (contact)	What they do for us	Location	Data	When and how	Retention
Amazon Web Services, Inc. (aws-korea-privacy@amazon.com)	Servers and database, storage of access logs	United States	Access logs, usage statistics, repository content, everything listed for people who sign in	Sent over the network when you use the Service	As in section 1
Cloudflare, Inc. (privacyquestions@cloudflare.com)	Delivering and protecting requests (content delivery, security), forwarding enquiry emails	United States and the countries where Cloudflare runs its network	Request data such as IP addresses (including the session cookie and authorization headers when you are signed in), enquiry emails	Sent over the network when you use the Service or send an email	As set out in Cloudflare's privacy policy
Google LLC (googlekrsupport@google.com)	Receiving and storing enquiry emails (Google Workspace), analytics (Google Analytics)	United States and the countries where Google runs data centers	Enquiry emails; analytics data while analytics are on for you (section 5)	Sent over the network when an email arrives, or when you visit a page while analytics are on	As in section 1

Transfers of data about people in the EU, EEA or UK rely on the safeguards in these providers' data processing terms, such as the European Commission's Standard Contractual Clauses. Every request passes through Amazon Web Services and Cloudflare, so you can only avoid transfers to them by not using the Service. You can refuse analytics by declining in the notice or turning cookies off in the footer (section 5), and advertising by not consenting, without any effect on your use of the Service.

5. Cookies and browser storage

1. While you are not signed in, the Service sets no cookies. It stores only your language (skillcdn.lang) and your cookie choice (skillcdn-consent) in your browser's storage (localStorage). These stay on your device and are never sent to us.
2. Signing in uses two cookies that it cannot work without. __Host-skillcdn_login lasts until you come back from signing in at GitHub, ten minutes at most; __Host-skillcdn_session keeps you signed in until you sign out (or for 30 days without use). Both are sent only to this site, cannot be read by scripts, and are not used for analytics or advertising. If your browser blocks them you cannot sign in, and everything that needs no sign-in keeps working.
3. Google Analytics sets its cookies (such as _ga) while analytics are on for you. Whether they are on depends on where you are, which we take from the country your connection comes from. If you are in the European Economic Area, the United Kingdom or Switzerland, or we could not tell where you are, the page asks you first in a notice, and nothing is loaded until you agree. Elsewhere analytics are on when you open a page, and you can turn them off at any time: "Cookie settings" in the footer of every page shows whether they are on and turns them off, or on again. If your browser sends a Global Privacy Control signal, we never ask, never load them and keep them off. Do Not Track is not read.
4. Your choice is kept in your browser (skillcdn-consent) and applies to your next visits; clearing this site's stored data resets it. You can also use the Google Analytics opt-out browser add-on.
5. Google's advertising tags set no cookies: storage and data use for advertising stay denied everywhere, because the Service does not ask for advertising consent at present (section 6).

6. Personalized advertising

We collect information about your use of the Service for personalized advertising only if you consent. At present the Service does not ask for this consent, so it collects nothing for advertising; this section says what would apply if it did.

• What: pages visited, interactions, time of visit, cookie identifiers, browser and device information
• How: collected automatically by Google's tags when you visit a page after consenting
• Why: personalized advertising through Google's advertising, and measuring our ads
• Who collects and processes it: Google LLC
• For how long: up to 14 months after collection; what Google uses for its own purposes is governed by Google's privacy policy
• How to refuse: do not consent, turn off personalized ads in Google's My Ad Center, or block cookies in your browser

We do not collect sensitive information such as health or beliefs for advertising, and we do not direct personalized advertising at children under 14. We do not combine the account details of people who sign in with analytics or advertising data. Questions about advertising can be sent to hi@skillcdn.ai.

7. Your rights

1. You may at any time ask to access, correct or delete your personal data, ask us to restrict or stop processing it, object to its processing, or withdraw your consent. Where the law provides for it, you may also receive your data in a portable format. Write to hi@skillcdn.ai and we will act without delay, within the period the law sets.
2. If you sign in, you can do some of this yourself on your account pages. Signing out deletes that browser's session, and removing a connected AI app or a token for an agent ends its access at once. Revoking SkillCDN in your GitHub settings (Applications → Authorized GitHub Apps) deletes your GitHub authorization token together with every session, connected app and token.
3. To delete your account, write to hi@skillcdn.ai with the GitHub login you signed in with. After confirming that the request is yours, we delete everything listed for people who sign in in section 1 within 10 days. Your display name and login follow what you change at GitHub the next time you sign in.
4. We can only tell access log entries apart by IP address. Please include your IP address and the time you used the Service so we can find the entries.
5. You may also make a request through a legal representative or someone you authorize. A request may be limited where the law requires us to keep the data or where it could harm the rights of others.

8. Security

• All connections are encrypted with TLS.
• The database, its backups and the logs are encrypted at rest, and the database sits in a private network that cannot be reached from the internet.
• GitHub authorization tokens are encrypted once more, under a key that is kept apart from the database. Sessions and the tokens the Service issues are stored only as hashes, so what is stored cannot be used to sign in or to read a repository.
• The only permission the Service has at GitHub is to read the content and basic details of repositories the app is installed on.
• Our systems can be reached only through personal accounts with multi-factor authentication, access is limited to what each task needs, and access is logged.
• Passwords and keys are kept in a dedicated secret store, never in code or logs.

9. Children

The Service is not directed at children under 14, and we do not knowingly collect their personal data. Children under 14 may not sign in.

10. Who is responsible

The controller of your personal data is KDX Labs Corp. Our privacy officer is the Chief Executive Officer, who can be reached at hi@skillcdn.ai.

11. Complaints

You can complain to the data protection authority where you live or work. In Korea, you can contact:

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

12. Changes to this policy

We announce changes to this policy on this page at least 7 days before they take effect, or at least 30 days before for significant changes such as new kinds of data or new purposes. This policy is available in Korean and English; if the two versions differ, the Korean version prevails.

History of changes

• Effective October 13, 2026: analytics (Google Analytics) are in use. Outside the European Economic Area, the United Kingdom and Switzerland they are on when you open a page and can be turned off in the footer's "Cookie settings"; in those regions, and whenever we could not tell where you are, the page still asks first. The pages tell Google only the addresses of public repositories. Global Privacy Control is honored; Do Not Track is no longer read.
• Effective October 5, 2026: added what is processed for people who sign in with a GitHub account and use private repositories, the sign-in cookies, account pages, and how to delete an account.
• Effective September 26, 2026: first version. We send the earlier policy on request to hi@skillcdn.ai.

This policy takes effect on October 13, 2026.