Privacy
Privacy
We collect as little as we can. There are no accounts, no advertising and no cross-site tracking.
Last updated 24 September 2026.
This page covers skillspace.sh and the MCP server at mcp.skillspace.sh, operated by XY Space Inc., Ontario, Canada.
What we record, and why
What people look for
Each time a skill page is viewed, or an agent uses the MCP server to search, look up a skill or browse a category, we record one row in Cloudflare's Analytics Engine. It holds only: the time; which of those it was, or a page for a skill we don't list; the skill, the category or the search text; the category, team and department it matched; whether anything matched; for a search, whether the results were ranked by AI or by text match and, if not by AI, why, and how confident the AI ranking was; the rank of the result recorded, which is 1 when a search found a skill and 0 on every other row; and, to index the row, the category, or which of those it was when there is no category. Before we store search text we remove anything that looks like an email address or a secret key, and keep at most 256 characters. A row holds no IP address, account ID, cookie or browser detail, and is kept for three months. It tells us which skills and categories people need. Please still don't put personal information in a search.
Rate limits
To enforce the MCP server's limits we count requests per client using a one-way hash of the IP address, mixed with a secret and the date. We never store the address itself. The hash changes every day, so days can't be linked, and each day's counters are deleted the following day.
AI-assisted ranking
MCP searches are ranked with the help of TypeSafe's Jev model, reached through Cloudflare's AI Gateway. Before the request is sent, we remove anything that looks like an email address or a secret key from the search text and cut it to 300 characters. The model receives that text and the names and short descriptions of the candidate skills. The gateway keeps a log of the most recent 100,000 requests, so we can debug the service and control its cost.
Operational logs
Our Workers keep only the log lines our own code writes, such as a warning when a limit or a service it depends on fails, in Cloudflare's Workers Logs, for 7 days, so we can keep Skillspace working. No line holds an IP address, and we don't keep Cloudflare's per-request logs.
The waiting list
If you join the Skillspace waiting list, we keep the email address you give us and use it only to tell you about Skillspace. We keep it until you ask us to delete it. When you start filling in the form, your browser fetches the form's configuration from CiteMET, which receives your IP address and your browser's user agent, as with any web request, and loads Cloudflare Turnstile to check that you are not a bot.
The bot check
When you start filling in the waiting-list form, on the homepage only, your browser loads Cloudflare Turnstile from challenges.cloudflare.com to check that you are not a bot. Cloudflare runs that check, and reads your IP address and details of your browser to do it, under its privacy policy. We never receive them: the form sends CiteMET your email address and the check's one-time token, nothing else.
What we don't do
- Skillspace sets no cookies of its own. Our network provider may set a strictly necessary security cookie if it has to check that a visitor is not a bot.
- No advertising, no cross-site tracking, no profiles.
- We don't sell personal information or share it for advertising.
- The shopping list on /list is kept only in your browser; we never receive it.
Who processes data for us
- Cloudflare hosts and protects Skillspace, stores the search-demand records, the rate-limit counters and our Workers' log lines, runs the AI Gateway, and runs the Turnstile check on the waiting-list form, under its privacy policy. Its network is global, so data may be processed outside Canada.
- TypeSafe runs the Jev model that ranks MCP search results, reached through Cloudflare's AI Gateway, under its terms.
- CiteMET receives waiting-list sign-ups, and the request for the form's configuration when you start filling it in, under its privacy policy.
Security
Every page is sent with a header that tells your browser to use only encrypted HTTPS connections to skillspace.sh and its subdomains from then on. We keep only what the service needs, for as short a time as it needs it.
Your rights
You can ask what personal information we hold about you, and ask us to correct or delete it, or withdraw your consent to our using it. Email info@xyspace.dev. If you are in Canada and unhappy with our answer, you can complain to the Office of the Privacy Commissioner of Canada. If you are in the EU or the UK, you also have the rights your data-protection law gives you, including to object and to complain to your supervisory authority.
Children
Skillspace is a tool for software developers and is not directed at children. We don't knowingly collect information from anyone under 16.
Changes
If we change what we collect, we'll update this page and the date at the top.
Contact
XY Space Inc., Ontario, Canada · info@xyspace.dev