Privacy policy

How the operator named under Operator details below processes personal data on hotskills.dev, account.hotskills.dev, adv.hotskills.dev, the Hot Monday newsletter and the Hot Podcast.

Who is responsible

The data controller is the company named under Operator details below. Write to the privacy contact shown there for any question or request about your data.

Preferences stored in your browser

The main site sets no cookies and contains no advertising trackers or third-party analytics. Fonts, scripts and images are served from hotskills.dev itself. Only after you choose them, the browser keeps in localStorage on your device your color theme, selected stack slugs and agent preference, and the podcast episode and playback position you were listening to. If you close the Hot Monday signup prompt, a local flag remembers that so it is not shown again; it stores no email address or consent. There is no server-side stack storage. Generated sharing links keep the stack selection in a URL fragment; opening a stack reads its chosen public skill pages. These preferences stay on your device and are not sent to an analytics service. Public pages do not expose a data API.

Cookies on the account and advertiser sites

account.hotskills.dev and adv.hotskills.dev use only technical cookies, which are necessary for security and for the service you request, so no consent banner is needed. __Host-hotskills-login protects the GitHub sign-in form against forged requests and expires after one hour; __Host-hotskills keeps you signed in to your account until you sign out, close the browser or stay inactive for 30 minutes; __Host-adv keeps an invited advertiser signed in to the portal. These cookies are secure, HTTP-only, limited to their own site and never used for analytics or advertising.

Operational logs

The production Nginx server records access and error logs, which can include IP addresses, user agents and requested resources, for site operation and security. Access and error logs are retained for 14 days, then deleted. Nightly reports keep aggregate web and MCP counts without IP addresses or user agents. Daily visitor estimates use a random salt that is never saved. Reduced search terms from MCP queries with no results are kept for up to 90 days; detected contact details, URLs, paths and secret-like strings are redacted. Advertising request impressions are estimated from non-bot page requests. Separate first-party browser observations count visible page mounts, control clicks, form submission attempts, scroll milestones, sponsor-link visibility and podcast playback progress. They contain fixed event names and public page, campaign or episode IDs, without cookies, account identifiers, form values, URL queries, IP addresses or user agents. These browser observations respect Do Not Track and Global Privacy Control and are aggregated from the same 14-day log rotation. They are best-effort counts, not unique people or proof of conversion.

Public sources and authors

Repository pages are built from public GitHub information, such as owner names, avatars, descriptions and repository statistics. Source excerpts appear only when a compatible license has been recorded, with links to the original repository. Authors retain their rights. Send corrections, author claims, objections and removal requests to the contact address shown below. Personal data is not sold.

Accounts, newsletter and advertising

Newsletter subscriptions require email confirmation and offer one-click unsubscribe; we record your address together with the date, IP address and wording of your request and of your confirmation, as proof of consent. The same applies to Watch this skill alerts, which also keep the skills you watch. Newsletter editions enter the public archive no earlier than seven days after sending. Signing in to account.hotskills.dev with GitHub gives us your GitHub user ID and login, which we use to manage API and MCP keys, author claims and alerts. The advertising portal at adv.hotskills.dev is invitation-only: it keeps the advertiser’s contact and billing details, bookings, creatives and payment records. Payments are handled by Stripe; the portal and the main site never receive card details. Advertising enquiries submitted through the proposal form are stored privately in the advertising portal with the submitted name, company, email, project URL, placement interest, budget, message and date, solely so the operator can respond. Proposal records contain no IP address, user agent or browsing history; short-lived keyed buckets limit spam. Podcast suggestions are stored privately with their type, message, optional source link and optional email for editorial review and contact about that suggestion. They do not subscribe you to the newsletter. Records older than 90 days are removed when the suggestion service is next used; you may request earlier deletion. Short-lived keyed counters and form tokens limit abuse; submitted content is not included in analytics.

Your My skills list

If you add skills to My skills on account.hotskills.dev, the list is linked to your GitHub account: for each skill we keep the repository, the date you added it, and the commit and security level it was pinned to. We keep it to provide the service you asked for (GDPR article 6(1)(b)). The list is never published: the site shows only totals, as “Saved N times”, counting accounts at least 30 days old and only from 3 saves. You can remove any skill at any time, and the whole list is deleted with your account.

Legal bases and retention

Server logs, abuse limits and aggregate statistics rely on our legitimate interest in running, securing and measuring the service (GDPR article 6(1)(f)); logs are deleted after 14 days and browser observations never build individual profiles. Public repository information relies on our legitimate interest in publishing an independent index of public skills; it follows the public source and is removed or corrected on a justified request. The newsletter and Watch this skill alerts rely on your consent (article 6(1)(a)), which you can withdraw at any time with the one-click unsubscribe. After you leave the newsletter, your address stays marked as unsubscribed with the consent record, so that we never write to you again and can prove the consent you gave. After you stop a Watch this skill alert, the email address is deleted; only a keyed hash of it and the consent record remain, for the same reasons. Accounts, keys and author claims rely on the service you request (article 6(1)(b)) and are kept until you delete the account or ask us to. The advertising portal, proposals and bookings rely on a contract or the steps you request before one (article 6(1)(b)); invoices and accounting records are kept as Italian law requires (article 6(1)(c)), normally for ten years. Podcast suggestions are handled at your request and removed after 90 days. Providing data is optional for the public site; for the newsletter, alerts, account and portal, the data requested by each form is needed to provide that service. No decision with legal or similarly significant effects is taken by automated means.

Service providers and transfers

Personal data is processed by the operator and by providers acting on its instructions: the company that hosts our server; Brevo, based in France, which sends the newsletter and service emails; Stripe, which processes advertising payments; and GitHub, Inc., based in the United States, when you sign in with GitHub. Where a provider transfers data outside the European Economic Area, the transfer relies on an adequacy decision, such as the EU–US Data Privacy Framework, or on the European Commission’s standard contractual clauses. The Hot Podcast is written and voiced with AI services from public sources; in a sponsored episode they also receive the sponsor’s name and approved campaign text, which is read on air. No subscriber or account data is sent to them.

Your rights

Under the GDPR you may ask for access, correction, deletion, restriction, portability or objection, and you may withdraw consent at any time without affecting processing that took place before. Contact the operator using the privacy address below; we answer within one month. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority where you live or work.

European Commission: data protection rights