What we collect, and why

What we collect

When you create an account

Your work email, your name, your firm, and your role. All four are required, because all four are what a creator receives when you download their work — a lead with no firm on it is not a lead. We do not ask for a password; signing in is a six-digit code sent to your email, and the codes are stored hashed and expire.

When you download a skill

Which skill, when, which route you took (the website, a pasted command, the shell installer, or the MCP server), and — if you chose to answer — the one sentence about what you are working on. That row is the lead. It goes to the author of that skill by email and appears in their dashboard.

Where you came from

On your first visit we store one first-party cookie, ls_attr, for 90 days. It holds the name of the site that referred you (“LinkedIn”, “ChatGPT”, “Google” — the host, not the search you typed), any campaign tag in the link, the first page you landed on, and the referral code if someone shared a skill with you. It is read at signup and at download so a creator can see which channel brought them a lead, and so a person who shares good work gets the credit.

It is not an advertising cookie, it is not read by anyone else, and it is not used to build a profile of you across other websites. Clearing your cookies removes it.

If you publish, rate, request or report

A published skill carries your name and firm publicly, plus any GitHub or LinkedIn link you add. Your email is not shown on the site — it is used to route your leads to you. A rating shows your name and your comment. A skill request shows your name and firm. A report about a published skill is read by an operator; your email is optional and is only used to reply.

Technical records

Your IP address is used to rate-limit sign-ins, uploads and downloads so the site cannot be hammered by a script. Those counters are deleted automatically after two days. We keep a log of which emails we sent you and whether they were delivered, so you do not get the same message twice.

What we do not do

• No analytics. No Google Analytics, no Meta pixel, no session recorder, no heatmaps. There is no third-party script on this site.
• No advertising, and nothing sold. Your details are never sold, rented, or handed to a data broker. The only person who receives them is the author of a skill you chose to download.
• No tracking across other sites. The one cookie we set is first-party and is only read here.
• No fonts phoning home. Typefaces are served from this domain, so loading a page tells Google nothing.
• No training on your data. Your account records, downloads and leads are never sent to an AI model. Skill packages submitted for publication are read by a model during screening — see below.

Screening, and what a model sees

Every submitted package is read by Claude models during screening — one reading it adversarially for security, one checking the claims, the disclaimer and whether anyone’s real deal data is inside. What is sent is the package you uploaded and the listing text you wrote. Nothing else: not your account record, not your leads, not anyone’s downloads.

This is exactly why rule one of publishing here is that a package must be scrubbed — no real borrower names, no live rate sheets, no internal paths. A skill is a template other firms will run. How screening works →

Who else touches it

Five companies, each doing one job. We have no other integrations.

Data is stored in the United States. If you are in the UK or EU and that matters to you, it is the thing to weigh before creating an account.

How long it is kept

• Your account — until you ask us to delete it.
• Downloads and leads — kept, because a creator’s record of who took their work is the thing they were paid in. Deleting your account removes your name, firm and email from those rows.
• Sign-in codes — hashed, and expire in minutes.
• Rate-limit counters — deleted automatically after two days.
• Newsletter — until you unsubscribe. Every issue carries a one-click link.
• Published skills — stay published with their author credited, unless the author asks for a takedown or an operator pulls one.

What you can ask for

Email mila@helveticagroup.com and a person will answer. You can ask for a copy of everything we hold about you, ask us to correct it, ask us to delete your account, or ask us to stop emailing you. No form, no portal, no account required to ask.

One honest limit: a lead already emailed to a creator is in their inbox, and we cannot reach into someone else’s email. We will remove you from our records and tell you which creators received your details so you can contact them directly if you want to.

If you are in the UK or EU, this is your right of access, rectification, erasure and objection under the GDPR, and you may complain to your national data protection authority. If you are in California, this covers your right to know, delete and opt out under the CCPA — and note there is nothing to opt out of, because we do not sell or share personal information for advertising.

Children, and changes

This is a tool for people working in commercial lending. It is not for anyone under 18, and we do not knowingly collect anything about children.

If this policy changes in a way that affects what we collect or who receives it, we will say so on this page and email anyone with an account before it takes effect.