1. Controller
Launify s.r.o., company ID 19380038, Husova 763/30, 737 01 Český Těšín, Czech Republic, Commercial Register kept by the Regional Court in Ostrava, file C 92723. Contact for anything about your data: [email protected]. We have not appointed a data-protection officer; we are not required to.
2. What we process, why, and on what legal basis
| data | purpose | legal basis (GDPR) | kept for |
|---|---|---|---|
| Name, e-mail, avatar and provider ID from Google or GitHub; your handle | creating and running your account, showing you as the author of your skills | Art. 6(1)(b) — contract (the Terms) | life of the account |
| Skills, versions, upvotes, favourites, follows, threads, reports, notifications | the catalog and its social features | Art. 6(1)(b) — contract | life of the account; published skills as described in the Terms §9 |
| Brain files | your private knowledge store; encrypted at rest | Art. 6(1)(b) — contract | until you delete them or the account |
| Terms acceptance (time, version) | proof that you agreed to the Terms | Art. 6(1)(c) and (f) — legal obligation / our legitimate interest in evidencing the contract | life of the account + 3 years |
| Personal MCP tokens, agent tokens, OAuth grants to AI clients (hashed tokens, client name, scopes, timestamps) | letting the clients you authorise act for you; showing you what is connected | Art. 6(1)(b) — contract | until revoked or expired |
| Newsletter e-mail and confirmation time | the “Skill watchdog” digest | Art. 6(1)(a) — consent (double opt-in); withdraw with the link in every mail | until you unsubscribe |
| Notification e-mails (review results, replies, milestones, weekly summary) | keeping you informed about your own content | Art. 6(1)(b) — contract; each type can be switched off in Settings → Notifications | not stored beyond mail logs (14 days) |
| Install counts | popularity of skills | Art. 6(1)(f) — legitimate interest; no IP or identifier is stored with the count | indefinitely, aggregate only |
| Web-server and application logs (IP address, URL, user agent, time) | security, abuse prevention, debugging | Art. 6(1)(f) — legitimate interest | 14 days |
| Contact-form messages | answering you | Art. 6(1)(f) — legitimate interest in replying | 12 months |
| Analytics (Google Analytics 4) | which pages and skills people find useful, in aggregate | Art. 6(1)(a) — consent via the cookie banner | up to 2 years (Google’s default); see §4 |
| Cookieless consent-mode pings (Google) | modelled, aggregate counts of visits and conversions when cookies are declined — no cookie, no identifier, ads data redacted | Art. 6(1)(f) — legitimate interest in measuring the site and our ads in aggregate | not stored per person |
| Ads conversion measurement (Google Ads) | whether a visit from one of our ads led to a sign-up, in aggregate — no ad personalisation | Art. 6(1)(a) — consent via the cookie banner | 90 days (Google’s default); see §4 |
| Company name and logo (if you sign up on behalf of an organisation) | customer references — Terms §8 | Art. 6(1)(f) — legitimate interest; object at any time | until you or the organisation object |
We do not process special categories of personal data and we do not make automated decisions with legal or similarly significant effects about you. The AI safety scan looks at the text of a skill you submit, not at you; a human reviewer makes the publishing decision.
3. Who receives data (processors) and transfers outside the EU
- Hosting — our own server in the EU.
- Google LLC / Google Ireland Ltd. — sign-in (they tell us your name, e-mail and avatar; nothing goes back) and, only after consent, Analytics 4. Transfers to the US rely on the EU–US Data Privacy Framework and Google’s standard contractual clauses.
- GitHub, Inc. — sign-in, and the public ecomdly-stack mirror that contains published skills and author handles. DPF / standard contractual clauses.
- Mailgun Technologies, Inc. (EU region) — transactional mail and the newsletter.
- Safety-scan model provider (currently MiniMax; Anthropic or Google Gemini when configured) — receives only the skill text under review, never your account data.
- Cloudflare, Inc. — DNS and traffic protection in front of the site (sees IP addresses in transit; standard contractual clauses).
We do not sell personal data and we do not share it with anyone else, except where the law requires us to.
4. Cookies and analytics
| cookie | purpose | lifetime | needs consent |
|---|---|---|---|
ecomdly_session | keeps you signed in and protects forms | 2 hours of inactivity | no — strictly necessary |
XSRF-TOKEN | protects forms against cross-site requests | 2 hours | no — strictly necessary |
remember_web_* | “stay signed in” after OAuth login | 5 years | no — functional, set only when you sign in |
ecomdly_consent | remembers your cookie choice | 12 months | no — strictly necessary |
_ga, _ga_* | Google Analytics 4 — which pages and skills are used, in aggregate | up to 2 years | yes — set only after you click Accept |
_gcl_au, _gcl_aw | Google Ads — links a sign-up to the ad click that preceded it | 90 days | yes — set only after you click Accept |
Analytics and ads measurement run in Google’s Consent Mode (advanced) with everything denied by default: until you accept, Google’s tag runs without cookies or identifiers and sends only anonymous, aggregated pings that Google uses to model totals — it cannot recognise you or your device across visits. Cookies are set only after you click Accept. If you decline, we also send no server-side analytics events for your visits. Change your choice at any time with Cookie settings in the footer. Withdrawing consent does not affect processing that happened before.
5. Your rights
Under the GDPR you can ask us for access to your data and a copy of it, rectification, erasure, restriction of processing, portability (your skills and Brain files are already plain Markdown you can download), and you can object to processing based on our legitimate interests — including the use of your organisation’s name or logo as a reference — and withdraw consent at any time. Write to [email protected] from the e-mail on your account; we answer within one month.
Deleting your account removes your Brain, favourites, follows, notifications and tokens. Published skills stay in the catalog under your handle unless you ask us to unpublish them, because others may depend on them (Terms §9). If you think we handle your data unlawfully you can complain to the Czech Office for Personal Data Protection (uoou.gov.cz, Pplk. Sochora 27, 170 00 Praha 7) or to the supervisory authority where you live.
6. Security
Sign-in is delegated to Google and GitHub — we hold no passwords. Tokens are stored hashed, Brain files encrypted, traffic is TLS only, and access to the server is limited to the people who run it. No system is perfectly secure; if you spot a problem, please tell us at [email protected].
7. Children
ecomdly is not intended for people under 16 and we do not knowingly collect their data.
8. Changes
We update this notice when the processing changes; the date below tells you when. Material changes are announced to signed-in users.
9. Contact
Launify s.r.o. · Husova 763/30, 737 01 Český Těšín, Czech Republic · [email protected]. Last updated 30 August 2026.