Privacy Policy

Who is responsible

Eleni Nigussie is the controller of personal data processed in the web app. We process it to provide your account, Skill Report, and the integrations you choose to connect. We do not sell your data or use it for advertising.

What we collect

• Account. First name, last name, email address, and a hashed password. We do not store your password in plain text.
• Session. A signed session cookie after you log in, plus short-lived cookies for OAuth (state / PKCE). These are required to run the service. We do not use advertising or tracking cookies.
• Connected tools. If you connect a provider (for example Canva, Figma, GitHub, GitLab, or Linear), we store which provider is linked, the OAuth scopes you granted, a provider user id or display name, and encrypted access and refresh tokens (AES-256-GCM). We never store your Canva (or other provider) password.
• Activity and portfolio records. Event type, a name such as a design, project, or repository, timestamps, optional duration, and text used to match an ESCO skill. The Canva, Figma, GitHub, GitLab, and Notion sections list what we read and keep for those tools. We do not store code diffs or binary assets.
• API tokens you create in Settings, stored only as salted hashes. The browser extension, if you pair it, uses such a token to sync learning time.
• Profile visibility. Whether your Skill Report and published claims are private or shareable by link, plus a random report slug.

Canva

Connecting Canva is optional. We use Canva Connect with OAuth 2.0 and PKCE. The scopes we request are design:content:read, design:meta:read, and profile:read. All three are read-only. We do not request write, comment, folder, asset, brand template, or webhook scopes, and we do not create or edit anything in Canva.

• profile:read gives a display name or user id so Sources can show which Canva account is connected. We do not request your email.
• design:meta:read lists designs you own: id, title, page count, and created and updated time.
• design:content:read reads the design type, such as presentation or document. When you add a design to a Portfolio project, we export a PDF of up to 12 pages, read up to 1,500 characters of the words on those pages, and discard the file. We store that text excerpt. We do not store the PDF or page images.
• We do not read comments, folders, assets, or brand templates. We do not subscribe to Canva webhooks or Return Navigation.
• Tokens are encrypted at rest. On disconnect we revoke them with Canva, delete the stored tokens, and delete Canva activity we stored for your account. A portfolio project you already created keeps its text excerpt until you delete that project or your account.

Canva remains the controller of your Canva account. Their processing is described in Canva's own policies. By connecting, you ask Canva to share the data above with us so we can build your Skill Report and, if you choose a design, a Portfolio project. A recruiter you grant sees the project title, the short description, the link, and interview questions written when they open the project from that title and description. They do not see the stored page text.

Figma

Connecting Figma is optional. We use Figma OAuth. The scopes we request are current_user:read, file_metadata:read, file_content:read, file_dev_resources:read, and file_comments:read. We do not request write scopes, image exports, library access, or webhook scopes, and we do not create or edit anything in Figma.

• current_user:read can include name, email, and profile image. We store only the handle or user id so Sources can show which Figma account is connected.
• We do not list your teams or folders. Figma does not allow that for a public app. We do not create Figma webhooks. A file name and time are stored only if Figma delivers a file-update to our webhook endpoint.
• For Portfolio, when you choose a file, we also read its folder, editor type, and URL, plus the document down to four levels: page names, up to 24 frame names, named component and style names, counts of auto layout, components, instances, prototype reactions, and styles, and up to 1,500 characters of text from text layers. We store that summary. We do not store rendered images or the whole file.
• On that same file we read dev-resource names and URLs, and we read comments. We store up to 12 comments, 500 characters each, on the portfolio project, and we count comments whose author matches your Figma account. We do not post comments.
• If the file is a FigJam board, the same connection reads it. The text we keep includes notes, shapes, and table cells.
• Tokens are encrypted at rest. On disconnect we delete the stored tokens and Figma activity events. A portfolio project you already created keeps its file summary until you delete that project or your account.

Figma remains the controller of your Figma account. By connecting, you ask Figma to share the data above with us so we can build your Skill Report and, if you choose a file, a Portfolio project. A recruiter you grant sees the project title, the short description, the Figma link, and three to five questions written when they open the project from that title and description. They do not see the text-layer excerpt, the comment text, the frame list, or the file.

GitHub

Connecting GitHub is optional. We use GitHub's OAuth device flow. The scopes we request are repo and read:user. GitHub shows repo as read and write access to public and private repositories, because classic OAuth has no read-only scope that includes private repositories. This app only sends read requests to the GitHub API, plus a request to revoke our own token when you disconnect. We do not push commits, open or edit issues or pull requests, change repository settings, subscribe to webhooks, or read your email address. We do not request user:email.

• From your profile we read your login, so Sources can show which GitHub account is connected.
• For the Skill Report we read recent repositories you can access (ones you own, collaborate on, or see as an organization member), your recent events, commits you authored, and pull requests, issues, and comments. We store the repository name, event type, time, commit message and id, issue or pull request number and title, the action GitHub reported (for example opened or closed), comment or review text when GitHub includes it, a commit link when we have one, and language names. We do not store code diffs.
• For Portfolio, when you choose a repository, we also read its description, license name, README, nested design or docs files, the git tree (skipping folders such as node_modules), dependency names from manifest files at any depth we listed, recent pull requests, the latest hundred commits, and whether a workflow file runs tests. We read a short excerpt of a few entry-point or recently changed source files to list HTTP routes and names that appear in those files. We store the description and URL, a README excerpt (up to 4,000 characters) and the README's length, excerpts of those nested docs (up to 1,500 characters each), language and dependency names, the file and folder paths we listed, the license name, workflow paths, whether a workflow runs tests, whether a manifest declares a test script, each pull request's number, title, branch, author, URL, update time, and whether it was merged, the first line of recent commit messages with the author login, SHA, and time, links and issue keys found in the README or pull request text, your login, the owner login when the owner is a personal account, whether those commits include commits by you, paths those commits touched, whether GitHub lists you as a collaborator, route strings found in the excerpts, and up to 2,500 characters of each selected source file. We match commits to you by login, GitHub noreply address, or a Co-authored-by line that contains your login. We do not request user:email, do not store other email addresses, and do not keep the manifest or workflow file text, pull request bodies, or code diffs.
• Tokens are encrypted at rest. On disconnect we revoke the token with GitHub, delete the stored tokens, and delete GitHub activity events. A portfolio project you already created keeps its repository summary, including the README excerpt, until you delete that project or your account.

GitHub remains the controller of your GitHub account. By connecting, you ask GitHub to share the data above with us so we can build your Skill Report and, if you choose a repository, a Portfolio project.

GitLab

Connecting GitLab is optional. We use GitLab OAuth. The scopes we request are read_api and read_user. We do not request write scopes. This app only sends read requests to the GitLab API, plus a request to revoke our own token when you disconnect. We do not push commits, open or edit issues or merge requests, change project settings, or store your email address.

• From your profile we read your username, so Sources can show which GitLab account is connected.
• For the Skill Report we read recent events on projects you can access. We store the project name, event type, time, and a commit title when GitLab includes one.
• For Portfolio, when you choose a project, we read the same kind of summary as for GitHub: the description, license name, README and nested docs, the repository tree, dependency names from manifests, merge requests, the latest hundred commits, whether your account is a project member, the file paths your own commits touched, CI configuration, short excerpts of a few source files, and route strings found in those excerpts. We match commits to you by username or a GitLab noreply address that starts with your username. We do not store other email addresses or the text of a diff.
• Tokens are encrypted at rest. On disconnect we revoke the token with GitLab, delete the stored tokens, and delete GitLab activity events. A portfolio project you already created keeps its repository summary until you delete that project or your account.

GitLab remains the controller of your GitLab account. By connecting, you ask GitLab to share the data above with us so we can build your Skill Report and, if you choose a project, a Portfolio project.

Linear

Connecting Linear is optional. We request the read scope. We do not create or edit issues, comments, or projects.

• For Portfolio, when you choose an issue you created or that is assigned to you, we read its title, description, state, project name, labels, parent title, child-issue titles, attachment links, and comments on the issue, including comments other people wrote. We store up to 8 comments, 800 characters each.
• Tokens are encrypted at rest. On disconnect we revoke the token with Linear, delete the stored tokens, and delete Linear activity events. A portfolio project you already created keeps its issue summary until you delete that project or your account.

Linear remains the controller of your Linear account. A recruiter you grant sees the project title, the short description, the link, and interview questions. They do not see the stored issue description or the comment text.

Notion

Connecting Notion is optional. We use a public Notion connection and OAuth. There is no separate scope list: you choose the pages to share in Notion's page picker, and we only see those pages. The connection capability we use is read content. We do not insert or update pages, read comments, read your email, or create pages or databases in your workspace.

• We store the workspace id from the OAuth response so Sources can tell connections apart.
• For the Skill Report we read the title, URL, and last-edited time of pages you shared. We do not store the page body on that path.
• For Portfolio, when you choose a page, we also read its blocks, up to 80 blocks and three levels deep. We store the title, URL, last-edited time, up to 6,000 characters of that text split by heading, the programming languages named on code blocks, titles of child pages, and links found in it. We do not read those child pages. Other page properties are not stored. We do not download images.
• Tokens are encrypted at rest. On disconnect we delete the stored tokens and Notion activity events. A portfolio project you already created keeps its page summary until you delete that project or your account.

Notion remains the controller of your Notion account. By connecting, you ask Notion to share the pages you select so we can build your Skill Report and, if you choose a page, a Portfolio project. A recruiter you grant sees the project title, the short description, the link, and interview questions written when they open the project from that title and description. They do not see the stored page text.

How we use data

We use personal data to:

• create and authenticate your account;
• sync the tools you connect and match activity to ESCO skills;
• show your Skill Report, timeline, and source status;
• honour visibility settings if you share a report or claims link;
• keep the service secure (for example rate limits and abuse prevention).

Matching is done on our servers against the ESCO taxonomy. If an optional language-model step is enabled, text from the stored activity or portfolio record may be sent to that provider solely to pick a skill or draft a portfolio summary. For GitHub or GitLab that text can include a commit message, a pull or merge request title, comment text, a README or nested-doc excerpt, a source-file excerpt, or names and routes taken from those files. For Canva it can include a design title, the design type, and a short excerpt of the words on the pages. For Figma it can include a file name, page and frame names, a short excerpt of text layers, and comment text. On a FigJam board that excerpt includes notes, shapes, and table cells. For Linear it can include the issue description and comments, including comments other people wrote. For Notion it can include a page title and an excerpt of the page text. When a recruiter you have granted opens a project, we send the project title and the short description to that provider to draft three to five questions. Those questions are shown for that view and are not saved. We do not sell personal data or share it with advertisers.

Legal bases

If you are in the UK or EEA, we process this data because it is needed to perform the contract for the service you signed up for (account, Skill Report, integrations you connect). Limited processing for security and preventing abuse is based on legitimate interests. You may disconnect a provider or delete your account at any time.

Where data is stored and who sees it

The app is hosted on Vercel. Application data, including encrypted tokens, is stored in a managed Postgres database. Hosting and the database may process data in the EU and other regions where those providers operate.

We share data with a third party only when needed to run the service: Vercel (hosting and page-view counts, which do not use cookies), our database provider, the provider you chose to connect (for example GitHub or Canva, to complete OAuth and read the data you authorised), and an optional skill-matching API if that feature is on. We do not sell or rent personal data.

If you set visibility to "link", people with the Skill Report link can see your aggregates. People with the claims link can see claims you marked published: the project title, the short description, the skill titles, and evidence links. Interview questions are not on that link. A recruiter sees three to five questions for a project only after you grant their email, they log in, and they open that project. Canva page text, Figma and FigJam contents, Linear issue text, and Notion page text are not published. Evidence is a title and a link.

Retention

We keep account and activity data while your account is active. Canva (and other) tokens are kept only while that source stays connected.

If you disconnect a source from Sources, we revoke its tokens where the provider supports it, delete the stored tokens, and delete activity events from that source. If you delete your account in Settings → Danger zone, we immediately delete connections, tokens, API tokens, and activity history, and we anonymize the account row (a minimal record is kept so the same email cannot be abused). We do not archive Canva data after that.

Your controls

• Disconnect any provider at any time from Sources.
• Export the data we hold about you as JSON from Settings → Export my data (JSON).
• Change your password in Settings.
• Change report visibility on the Visibility page.
• Delete your account from Settings → Danger zone.

You may also email eleni.nigussie04@gmail.com to access, correct, or delete personal data, or to object or restrict processing where the law allows. You may lodge a complaint with your local data protection authority.

Security

Traffic uses HTTPS. Passwords are hashed. Provider tokens are encrypted at rest with AES-256-GCM. Canva client secrets are stored as environment variables on the server, not in the browser or in git. No method of transmission or storage is perfectly secure. Report security issues to eleni.nigussie04@gmail.com.

Children

The service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have, contact us and we will delete it.

Changes

We may update this policy. The "Last updated" date at the top will change. Continued use after an update means you accept the revised policy. Material changes will be reflected on this page before they apply.

Contact

Eleni Nigussie
Track your skills
eleni.nigussie04@gmail.com

See also our Terms of Service.