Version française

Skills Outpost Privacy Policy

Version 1.4 — Effective October 9, 2026

1. Who We Are and How to Reach Us

Skills Outpost is operated by Titan Synergy Management Inc. ("Titan Synergy," "Skills Outpost," "we," "us," or "our"), a company incorporated in British Columbia, Canada. We operate the Skills Outpost catalog and community service at https://skillsoutpost.com (the "Service"). Applicable privacy law determines our obligations and your rights; this Policy does not limit a mandatory right or a regulator's jurisdiction.

This Privacy Policy explains what personal information we collect through the Service, why we collect it, who we share it with, and the choices and rights available to you. It applies to everyone who visits or creates an account on Skills Outpost.

Our Privacy Officer is responsible for our handling of personal information under this Policy. For a privacy inquiry, complaint, access request, or correction request described in Section 10, contact our Privacy Officer at legal@skillsoutpost.com.

2. What We Collect and Why

We use personal information to provide account sign-in, listings, package review and delivery, Verification Plans and Verification Reviews, reviews, follows, access requests, and moderation. For each category below, we explain the information collected and its purpose, and, where it is not evident from context, whether it is required or optional. We do not run advertising trackers or third-party analytics scripts of any kind, and we do not sell personal information.

Account information. When you create an account, we collect your email address and a display name you choose. You may optionally add a short bio, a website URL, and a logo image to your profile. We record whether your email has been verified, whether your account has administrator privileges, and your account status (active or disabled — deleting your own account is the self-service route to "disabled" status; we may also disable an account directly, as an administrative action, as described in the Terms of Use).

Listings you create. If you list a skill or agent as a creator, we store the description, category, intended users, example tasks, limitations, interface, access mode, links, compatibility, setup instructions, external costs, permissions, license terms, data-handling notes, and visibility you provide, plus a history of your edits.

Reviews and community content. If you write a review, we store your star rating, review text (up to 4,000 characters), the product version you reviewed, and your confirmation that you have used that version. We keep a version history of edits to reviews, any creator reply, and any report or appeal you submit about a review.

Saved items and follows. Items you bookmark and creators you follow are stored privately to your account.

Access requests. Before you submit an Access Request, the request form explains which information will be sent to the Creator and obtains your agreement. If you request access to a listing that uses the creator-handoff flow, we collect the name, email, organization, intended use, timeline, and message you provide, your consent to share those details with the creator, and whether you later report that a handoff took place. The creator sees these details only after you confirm the request by email and give consent. A request or self-reported handoff is not a purchase, a verified transaction, or a performance guarantee. The private link used to check a request's status is not password protected — anyone who has that link can view the request, so keep it private.

Free Library acquisitions. When you accept a free downloadable version into your Library, we process your acceptance of the Creator's license for that exact version and, where the offer requires it, your follow of the creator, to administer your free acquisition. We record short-lived, single-use download authorizations (each valid for about one minute) used to deliver the file to you.

Connected apps. If you connect an assistant app (Terms of Use Section 9), we record which app you connected and when; when it was last used (updated no more than once every 15 minutes) and when the connection ends or ended; one-way hashes of the credentials we issued to it; the connection request you approved or denied, and your decision; an audit record of each Library listing request, including its page number; for each file-manifest request, the version's checksum; and, for each file it reads, the file path and checksum. These audit records do not contain file contents. These records are linked to your account, and paths and checksums can reveal which packages you use. We use them to show you your connections on the Connected apps page, to let you disconnect, to enforce limits, and to investigate misuse.

Creator package submissions. If you upload a package as a creator, we store the package file, a cryptographic checksum of its contents, the manifest of declarations you provide (permissions, network access, dependencies, third-party licenses, and similar disclosures), your license text, your attestation that you have the right to redistribute the included files, and the record of any automated check or independent human review performed on that submission. See Section 4 for more detail.

Verification Plans and payments. If you buy a Verification Plan (Terms of Use Section 19), Stripe collects your payment card or other payment details through its own payment page; we never receive or store your full card number. Checkout identifies the seller. When Titan Synergy is the seller, Stripe processes the payment for us and may also use information for its own fraud-prevention and legal-compliance purposes. When a Stripe entity is identified as seller of record, it also sells and bills for the plan in its own name, and its privacy notice, linked at checkout, applies to that role. Stripe's payment page may collect additional information and use its own cookies, as described in the notices linked there. We receive and keep your name, email address, billing country and, where needed to calculate tax, your postal code; the plan you chose; your subscription status and billing periods; amounts, taxes, invoices, and refunds; and the identifiers Stripe assigns to you and your subscription. We use this to provide the plan, count your Review Units, meet tax and accounting obligations, and handle payment disputes. Skills Outpost does not process payouts, and apart from Verification Plans it does not process payments or subscriptions.

Verification requests. If you request a Verification Review, we record the Subject you submitted (the exact package version, or the public repository and commit), when you submitted it, the Review Unit it used, the result, and the record of what was checked. A Verified badge, with the Subject and date it applies to, is public.

Technical and security records. We keep hashed (not plaintext) session and sign-in tokens, small audit records of account and moderation events, and rate-limiting records used to slow down abuse. Our application reads the IP address a request comes from only to compute a one-way cryptographic (HMAC) rate-limit identifier: when you request a sign-in link, use Google sign-in, submit a report, or start connecting an assistant app, and on every request to our token endpoint (including token refresh) and our assistant (MCP) endpoint, whether or not the request uses a connection. A connected app sends its token and MCP requests from its provider's servers, so for those requests the address is usually the provider's, not your device's. The identifier is not the raw IP address, and our application does not store the raw address or attach the identifier to your account profile, listings, or reviews. We do not log user-agent strings against your account. Our hosting provider, Cloudflare, necessarily processes standard network request information (such as IP address) to deliver traffic to our servers, as any web host does.

3. Sign-In Data

You can sign in to Skills Outpost in two ways:

Email link. You enter your email address and we send a private, single-use sign-in link. We do not use account passwords. The link expires after 15 minutes and only works in the browser that requested it.

Continue with Google. If you choose to sign in with Google, we request only the openid, email, and profile OAuth scopes. In practice we read and store two things from your Google account: your Google account identifier (the "sub" claim) and the email address associated with it. We do not request or read your Gmail, Google Drive, or any other Google service, and we do not request offline access or store a Google refresh token. We do not read or store your Google profile picture or display name. Linking a Google sign-in to an existing Skills Outpost account requires you to confirm the connection on-screen; we always show you both the Google email and your Skills Outpost account email before linking. You may disconnect Google sign-in later; your account itself is not deleted by doing so.

Skills Outpost's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google account data for advertising, and we do not sell it to any third party.

4. Creator and Package Data

If you submit a listing, you authorize us to display its description with your creator attribution, according to the visibility and moderation status you select. Submitting a listing does not transfer ownership of your underlying work to us.

If package upload is enabled for your listing, the separate package form accepts a ZIP file permitted by the package rules identified in the Terms of Use (the "Package Rules") together with license, permission, network, dependency, and third-party disclosures. We keep that file privately in storage while it is checked and reviewed by a human moderator, and we retain the record of that review. Automated checks assess permitted formats, common secret-key patterns (for example, cloud provider or API key formats) and, for packages with source files, the source patterns and declarations the Package Rules specify; a passing review is a record of what was checked at that time — it provides no warranty or guarantee that a package is safe, malware-free, compatible, or fit for any purpose.

Do not include secrets, private prompts, API keys, credentials, personal information, or confidential material in a listing field or package submission. Our package checks are limited to those described above and do not establish that all sensitive information has been identified.

Verification Reviews. If you request a Verification Review, we process the exact package version, or the public repository at the commit you identify, together with its declarations, and the resulting assessment. Service providers acting on our behalf help us perform the review. They receive the files, declarations, and repository and commit identifiers the review needs, not your sign-in credentials, payment details, or account profile; those files and repository details may still identify you or other contributors, for example through copyright or license notices. We keep the result and the record of what was checked.

If a package is withdrawn by its creator or safety-blocked by a moderator, the underlying files and review records are retained even though the package is no longer available for new acquisitions. A creator's withdrawal preserves existing Library access; a moderator's safety block denies delivery to every account, including existing Library holders. Retention or continued delivery of a Package does not authorize removal of a copyright, license, or attribution notice required by applicable licenses or law.

5. Reviews, Comments, and Public Profile Data

Your display name, profile bio, website and logo (if you add them), and any listing you publish are visible to anyone who visits the Service. Published reviews — including your display name, star rating, review text, and declared product version — and published comments, with your display name, are also public. Do not include personal data, credentials, or confidential content in a review or comment; anything you write there is treated as public. Before we store a logo, we remove embedded metadata such as camera, location, or editing details. Removing embedded metadata does not remove names, faces, or other identifying details visible in the image itself, so do not upload a logo containing sensitive or confidential content. Visitors can copy public logos, reviews, and comments; hiding them or deleting your account does not remove copies others have already made outside the Service.

Your likes are stored with your account and the listing. A listing's public like total counts the current likes of active accounts, so removing a like or deleting your account removes it from the total. Each package download from your Library is recorded with the listing, the version, and the single-use download authorization it used, which is linked to your Library access; we use these records to keep the public download total (repeat downloads included) accurate. When your account is deleted, your Library access is deleted with it, so those download records no longer link to your account; they, and the download total, remain. Public like and download totals do not show the names or account identifiers of the people who liked a listing or downloaded its packages.

We use reports to investigate and respond to the issue raised. Where reasonably necessary, we may share the relevant allegation or evidence with the affected content's owner, while limiting unnecessary disclosure of the reporter's identity and contact details; a report and any moderation notes about it are never published as public review content. Where copyright law requires forwarding a compliant notice, the notice may include the claimant's identifying information, as described in Terms of Use Section 12. Our service providers and other disclosures permitted or required by law are described in Section 8.

6. Logs, Sessions, and Cookies

Skills Outpost uses two cookies, both essential to the Service and both set with the HttpOnly, Secure, and SameSite=Lax attributes: HttpOnly restricts page-script access to the cookie value, Secure limits its transmission to HTTPS, and SameSite=Lax restricts when the cookie accompanies a cross-site-initiated request. These controls reduce, but do not eliminate, the risk of unauthorized session use.

• Session cookie. Set only when you successfully sign in, and used to keep you signed in. A new sign-in stays active for up to 14 days from authentication; your activity level does not extend that period on its own. (Sessions created before our September 2026 session-policy update may instead follow a shorter 12-hour absolute / 30-minute inactivity limit until you sign in again under the new policy.) Signing in on one browser does not sign out any other browser you are already signed into. You can end other sign-ins from the "Sign-ins and security" page in your account, and you can sign out of the current browser at any time.
• Anonymous form-protection cookie. Set on your first visit to the site, before you sign in, to protect forms against cross-site request forgery and, for email sign-in links, to confirm the link is being used in the same browser that requested it. It currently carries the same 14-day lifetime as the session cookie, whether or not you ever sign in. We treat it as strictly necessary to the Service's sign-in and form-security functions.

Certain sensitive actions — deleting your account, signing out your other sessions, and linking a Google account — additionally require that you signed in within the previous 15 minutes; simply being active on the site does not refresh that window.

We do not use advertising cookies, tracking pixels, or third-party analytics scripts. This section describes our cookie purposes and lifetimes; we obtain consent for an optional use where applicable law requires it. We treat a hashed or otherwise derived identifier, such as the HMAC rate-limiting key described in Section 2, as personal information where it can reasonably be linked to an individual. Beyond the two cookies above, we do not attach your IP address or browser/device fingerprint to your session records.

7. AI Assistants and Connected Apps

In your browser. An AI assistant that uses Skills Outpost through your own signed-in browser session can read a small set of endpoints scoped to your own account (your published listings and your free Library) and can act only through the same web forms and CSRF protections a human user would use. No assistant can follow a Creator, accept a license, submit a review, or take any other action on your behalf without your own account session and your authorization of that specific action. Never share or export your session cookie to any assistant or third party; doing so gives it the same access you have.

Connected apps. When you connect an assistant app, you choose to send to that app's provider (for example, Anthropic for Claude or OpenAI for ChatGPT) the information the app requests while the connection is active: your Library entries (item names, versions, file names, and checksums) and the contents of the files it reads from versions you have acquired. The consent page names the app and its provider before you decide, and connecting is optional; declining changes nothing else in your account. The provider receives this information at your direction and handles it under its own terms and privacy policy, and it may process it outside Canada. We remain responsible for our own collection, use, and disclosure of personal information under applicable law. Disconnecting stops further access but does not delete what the provider already received. We do not provide your account email or profile fields as separate fields in these responses, and we never share your browser session cookie or a sign-in link; we issue the app its own access and refresh credentials. Library details and package files may themselves contain names, email addresses, attribution, or other identifying information. Before connecting, consider how your chosen assistant provider handles the information it receives.

We treat all creator-submitted text and package content as untrusted; it cannot instruct an assistant (or a human moderator) to grant additional access, but an assistant that reads it may still be misled into acting through other tools you have given it.

8. Service Providers, Data Location, and International Transfers

We use a small number of service providers to operate the Service, and we do not sell or rent your personal information to anyone:

• Cloudflare hosts the Skills Outpost application, our database, and the private storage bucket that holds package files; it also handles inbound and outbound email delivery and routes traffic to our servers. Cloudflare processes standard network request information as part of that hosting.
• Google LLC acts as an identity provider only if you choose "Continue with Google" (see Section 3). We do not send Google any information beyond what is needed to complete that sign-in.
• Stripe provides the payment page and processes payments for Verification Plans, and is the seller of record where checkout says so (see Section 2). Stripe may process payment information in the United States and other countries where it operates.
• Review service providers help us perform Verification Reviews under confidentiality obligations. They receive the files, declarations, and repository details being reviewed, which may contain identifying information, and may process them outside Canada, including in the United States. We remain accountable for the processing they perform on our behalf and limit it to performing the review and keeping the service secure.
• Microsoft 365 hosts the mailbox that our internal team-facing email aliases forward to; this supports our own operational mail, not storage of your account data. Operational and support email may nonetheless contain personal information, including email addresses and the contents of an inquiry or request.

When you connect an assistant app (Section 7), information requested through that connection is sent to its provider at your direction, for use in the assistant service you have chosen. Section 7 describes the information disclosed and our responsibility for that disclosure.

International transfers. Titan Synergy is a British Columbia, Canada company, and Canada is our business operating jurisdiction, but we have not restricted our hosting or database region — Cloudflare's global infrastructure may process or store data outside Canada. By using the Service, you understand your information may be processed in a country other than the one where you live, and that its legal protections may differ from your home jurisdiction's; information processed outside Canada may be accessible to a court, law enforcement, or other authority under the law of that jurisdiction. We remain accountable for personal information a service provider processes on our behalf, and we require our service providers to protect personal information consistently with this Policy and applicable law.

9. Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal requirements. Where BC's Personal Information Protection Act requires it, information used to make a decision that directly affects an individual is retained for at least one year after that use. A legal hold, an outstanding access request, or another applicable retention duty may require longer retention. When retention is no longer reasonably necessary or legally required, we destroy the information or remove the means of associating it with an identifiable individual.

Automatic cleanup. The following records become eligible for automatic deletion on the schedule below (deletion runs in batches, so these are eligibility windows, not guaranteed same-moment deletions):

Billing records. We keep records of Verification Plan purchases, invoices, taxes, and refunds for as long as tax and accounting law requires — generally six years after the end of the taxation year they relate to, which for Titan Synergy may be its fiscal year rather than a calendar year — even if you cancel your plan or delete your account. A late filing, audit, dispute, legal hold, or other legal requirement may require us to keep them longer.

No automatic schedule today. Package files and their review records, Verification Review records, listing edit history, review edit history, comment edit history (including the text of comments you deleted), access requests, listing, review, and comment reports, and our security audit log do not currently have an automatic age-based deletion schedule. If you would like any of this information about you corrected or deleted outside of the account-deletion process below, contact us at legal@skillsoutpost.com and we will review your request manually. Records of assistant app access (each Library listing and file read) are part of that security audit log; we review them for disposal when their purpose ends and do not keep them indefinitely by default.

Deleting your account. You can permanently delete your account from your account settings after signing in again to confirm it is you. This removes your profile (including any logo), listings, reviews, comments (together with replies other people posted under your comments), likes, saved items, follows, free Library access, connected sign-in identities, and any access requests or reports tied to your account email, ends every sign-in to your account, and clears the session cookie in the browser you used to delete it. It also cancels any Verification Plan. If you replied beneath another person's comment, your reply is deleted if that person deletes their account. Account deletion does not delete the billing records described above or other information whose retention remains justified under this Section, and we limit retained information to the purposes that justify keeping it. Account deletion does not remove a copy another person already downloaded, or by itself terminate a right under their Creator license. A package you previously released as a creator may remain available to people who already acquired it, but your creator name is replaced with "Former creator" and no longer links to your profile; this does not authorize removal of a copyright, license, or attribution notice required by applicable licenses or law, and does not necessarily remove identifying information from the package's files, metadata, or required notices. We do not currently offer a self-service tool to export a copy of your data before deletion; if you would like a copy, contact us at legal@skillsoutpost.com before you delete your account.

Deleting your account also ends all connected assistant apps and revokes their credentials, and it deletes their connection records and credential hashes together with the account. Related audit information remains subject to this Section's retention limits and applicable legal requirements. Deletion does not remove copies an app or its provider already received.

Backups. Our production backup-retention practices are still under internal review; we do not yet publish a fixed backup-retention period. We do not use backup copies to restore or make visible again information you have asked us to delete, except as necessary to recover the Service from a significant incident; backup copies are not searchable or accessible in the ordinary course.

10. Your Rights

Depending on where you live, you may have rights under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA), including the right to:

• Access the personal information we hold about you, and information about its use and disclosure;
• Correct inaccurate or incomplete information (you can update your display name, bio, and website directly in your profile at any time);
• Withdraw consent for a specific use, where our processing depends on your consent, on reasonable notice and subject to legal restrictions — for example, you can unfollow a creator, delete a review you wrote, or delete your account entirely; we will explain the consequences and any processing that may lawfully continue; and
• Ask questions or raise a concern about how we handle your personal information.

Subject to applicable legal exceptions, we verify your identity only to the extent reasonably necessary, make corrections you request, record an unresolved disagreement, and notify a recipient of a correction where required by law. To exercise any of these rights, contact us at legal@skillsoutpost.com. We will respond to your request within the time PIPEDA and BC's Personal Information Protection Act require — generally no later than 30 days (30 business days under BC PIPA) — unless we notify you of a permitted extension, and we will explain the reason for any extension, fee, or refusal, and any available review right.

If you are not satisfied with our response, you may complain to:

• Office of the Information and Privacy Commissioner for British Columbia — oipc.bc.ca
• Office of the Privacy Commissioner of Canada — priv.gc.ca

If you are in the European Economic Area or the United Kingdom. Titan Synergy is the controller of the personal information described in this Policy, and you can reach us at legal@skillsoutpost.com. We rely on these legal bases: performance of our contract with you, for your account, listings, Library, reviews, and Verification Plans and Verification Reviews; legal obligations, for tax and accounting records and copyright notices; our legitimate interests, for security, abuse and fraud prevention, moderation, and establishing or defending legal claims, balanced against your rights; and your consent, where we ask for it, such as before sharing Access Request details with a Creator — you may withdraw consent at any time without affecting earlier processing. You have the right to access, correct, and erase your personal information, to restrict or object to processing based on our legitimate interests, and to receive information you gave us in a portable format; we respond within one month, which the law allows us to extend in some cases. You may also complain to your local data protection authority, or in the United Kingdom to the Information Commissioner's Office. Canada is recognized by the European Commission and the United Kingdom as providing adequate protection for personal information handled by commercial organizations subject to PIPEDA. Where applicable law requires a transfer safeguard, we use an applicable adequacy decision, approved standard contractual clauses, or another lawful transfer mechanism before making the transfer. You may contact us for information about the safeguard for a particular transfer.

11. Security Measures

We maintain organizational, physical, and technical safeguards appropriate to the sensitivity of the information we handle and the risks to it, including: storing session and sign-in tokens only as one-way cryptographic hashes (never in plain text); marking our cookies HttpOnly, Secure, and SameSite=Lax; enforcing cross-site request forgery protection and origin checks on form submissions; and rate-limiting sign-in and reporting endpoints to slow down abuse. We do not store account passwords, because Skills Outpost does not use passwords at all. We investigate a suspected breach of these safeguards and notify an affected individual and the applicable authority, and retain a record of the breach, where applicable law requires it.

No method of storing or transmitting information is completely secure, and we cannot guarantee absolute security. The purposes and limits described in Section 4 apply to uploaded packages; no check or review provides a warranty or guarantee that any listing, package, or agent outcome is safe, or an endorsement of it; a Verified badge means only what Terms of Use Section 19 describes.

12. Children

The Service is intended for people who meet the age and capacity requirement in Terms of Use Section 2. If you believe we have collected personal information from someone who does not meet that requirement, contact our Privacy Officer at legal@skillsoutpost.com. We will assess the information and address account access and retention or deletion under applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will identify a material change and provide notice before it takes effect, following the notice process described in Terms of Use Section 21. Where a new purpose or other change requires fresh consent, we will obtain it before the affected collection, use, or disclosure begins; posting a revised Policy does not itself provide that consent. We email required material-change notices to people with an active Verification Plan. We do not currently email other users about Policy changes unless applicable law requires it, so please also check this page periodically.

14. Language

This Privacy Policy is available in English and in French.

15. Effective Date

This Privacy Policy, version 1.4, is effective as of October 9, 2026.

TITAN SYNERGY MANAGEMENT INC.. Also read our Terms of Use.