Privacy

Who holds it

The business responsible for the personal information on this site is Jaesung Son, a sole proprietorship in British Columbia, Canada, registered for GST/HST as 823196407-RT0001. Canada’s federal privacy law (PIPEDA) applies to it, alongside the privacy law of the province named above.

What we collect

When you make an account

Your email address, and a handle if you set one. If you sign in with Google we receive the email address on that Google account and nothing else — no contacts, no profile, no Drive.

We record when you signed in and from where, in the ordinary sense that a server logs a request. We do not build a profile of you from it.

When you run a skill

Whatever you type into the brief, and whatever files you attach. That is the work itself, so it has to be sent to the model that does it. If you upload a photograph of a person, that photograph goes to the model provider — please do not put anything in a brief you would not want leaving this site.

We also record what the run produced, how long it took, which model it used and what it cost. Those are needed to show you the result, to bill it correctly, and to tell you why something failed.

When you pay

We never see your card. Stripe collects it, and we receive back a customer reference, the amount, and whether the payment worked. What we store is the receipt, not the instrument.

Who else sees it

Only the processors that make the site work. We do not sell personal information, we do not share it for advertising, and there is no advertising code and nothing that tracks you as a person — no tracking pixels and no cookies. We count, without identifiers, how often each skill is shown, clicked and opened, and Cloudflare counts site visits the same way; the cookies page says exactly what is counted.

• Supabase — the database, sign-in and file storage.
• Stripe — payments. They have their own privacy policy covering the card.
• Anthropic, fal.ai, Replicate, OpenAI and Google — the selected model provider receives the input needed for that run. Only the selected provider receives its execution request; availability and accepted files depend on the integration.
• Cloudflare — serves the pages, counts visits without cookies, and runs isolated execution environments for hosted developer packages.

Some of these store data outside Canada, mostly in the United States. Information held in another country is subject to that country’s laws, including lawful access by its authorities. Using the site means accepting that, because we cannot run it otherwise.

Developer API skills send your submitted input to the developer’s server. Before execution, the input screen identifies the processor, its domain and its privacy policy, and asks you to accept that transfer. That developer controls its own server logs and retention. ESF cannot delete copies held there. Hosted packages run developer-supplied code in an isolated environment; the listing identifies the processor before you run it. ESF does not pass your sign-in token or its shared model keys to that code. A developer’s web interface runs in a restricted frame with a temporary session that expires after at most ten minutes.

ESF does not show your brief or results in another creator’s board. Creators see usage and earnings summaries. If a creator supplies the model API key, that provider account owner may be able to access request history under the provider’s logging policies. Privileged platform access can also read stored execution records. Consider the selected provider and key owner before submitting sensitive information.

How long we keep it

Run briefs, uploads and results expire 30 days after the run and are removed by the retention job. This is done by a scheduled job, not by request — nothing has to be asked for and nobody has to remember. Download anything you want to keep before then.

A creator can deliberately publish their own completed run as a public example. It is not removed when the private run expires. Replacing or clearing it removes the example from the listing; the old file URL may remain accessible until the cleanup job deletes the file. Copies already downloaded by others cannot be recalled.

What survives that is the fact of the run: the date, the listing, the duration and the cost, with the content gone. We keep those because they are the record behind a charge, and a receipt with no transaction behind it is not a record anyone can check.

Payment records are kept as long as Canadian tax law requires, which is six years from the end of the tax year they belong to.

Close your account and we delete the account and its content. The payment records stay for the period above, because we are not allowed to delete them yet.

What you can ask for

You can ask us, at any time, to:

• tell you what we hold about you, and give you a copy;
• correct something that is wrong;
• delete your account and its content, subject to the tax records above;
• explain anything on this page that is not clear.

Email support@everyskillfinder.com. We answer within 30 days, which is what PIPEDA requires, and usually far sooner. If you are not satisfied with how we handled it you can complain to the Office of the Privacy Commissioner of Canada.

Keeping it safe

Access to the database is enforced by row-level security, which means the rules about who may read what are applied by the database itself rather than trusted to the application asking. Run files are private and reached through links that expire.

Model API keys and developer API connection keys are stored in an encrypted vault. The interface shows only the last four characters and does not return the saved key to the browser. The execution server decrypts a key when it needs to call that provider. Privileged server access can therefore read it; encryption does not make it inaccessible to the service. Use a dedicated key with spending limits where the provider supports them, and revoke it at the provider if it is no longer needed.

No system is perfect. If we ever discover a breach that could really hurt you, we will tell you and the Privacy Commissioner, as the law requires.

Children

The site is not for people under 16, and we do not knowingly keep information about them. Tell us if a child has made an account and we will remove it.

Changes

Changes are posted here with a new date. If a change means we would use something we already hold in a way this page did not describe, we will ask first rather than announce it. See also the cookies page, which covers what is stored in your browser.