Skytale Privacy Notice

This notice explains what data we receive when you use Skytale, what we do with it and how long we keep it. Last updated 19 October 2026.

"We" means Skytale Labs Ltd, a company registered in England and Wales (company number 16964703), registered office 20 Wenlock Road, London N1 7GU, England. We are the controller of the personal data described here. To ask about this notice or to exercise your rights, email [email protected].

What we never receive

Everything Skytale searches for you is encrypted on your machine before anything is sent, with a key that never leaves your machine. We never receive, and cannot read:

what you search for: your search terms, and the names and versions of your packages,
the files, code or diffs your assistant passes to Skytale,
the results.

What we do receive is ciphertext: encrypted data that we cannot read. We do not keep it either. Each encrypted search is held in memory only while our servers compute the answer, is never written to disk or to a log, and is deleted as soon as the answer is sent.

What we do receive, and why

Data	Why	How long
Your email address, if you create an account	To identify your account, send sign-in links and send product updates	Until you ask us to delete the account. You can unsubscribe from product updates at any time
Your API key, stored only as a one-way hash	To check that requests come from a valid key	Until the key is revoked or the account deleted
How many searches each key makes per day, and from which install (a random identifier your copy creates)	To meter and bill usage, apply free allowances and rate limits	As long as needed for billing and accounting records
For each authenticated request: the time, a hash of the key, the endpoint, and the client version and label	To run and debug the service	7 days
The web server's access log: IP address, time, requested path, response status and user agent	To keep the service secure and find faults	The log is rotated by size, so entries last days to weeks depending on traffic
Your public encryption keys and install identifier	So the server can compute on your encrypted searches. Public keys cannot decrypt anything	Deleted 72 hours after their last use

The access log does not record your API key.

What leaves your machine

The same facts in technical terms, as they appear in each client's SECURITY.md (the section "Privacy: what leaves your machine" for Skytale search, "What the server sees" for the Skytale Vulnerability Scanner), which also gives the commands that check each one. Your search terms, the files your assistant passes, and the results never leave in readable form: they pass OpenFHE's Encrypt() before any network function sees them, and the secret key that would decrypt them stays on your machine. What a request does carry, and the server therefore sees:

Your API key, on every request.
Your install ID (?uuid=), a random identifier your copy creates.
A stable hash of your public keys (X-Keys-Hash).
Your IP address, as for any HTTP request.
Request counts and timing: how many requests each session or audit makes and when. One request can serve four separate searches at once, so the count is not a count of your search terms; for a scanner audit it grows with the size of your lockfile and with the number of advisories its packages match, so it does carry a rough measure of how much the audit found. Which package or search term any search is for stays in the ciphertext, and searches for unrelated packages share a request, so no request can be tied to one package.
A device fingerprint at registration only: an HMAC of the machine ID and username under a fixed public key, so a reinstall on the same machine keeps its daily quota.

The updater is the second network path, and the only one outside the egress. It runs curl from a /bin/sh script to download a release tarball from skytalelabs.com, checks it against the release signing key compiled into the binary, and installs it. That download carries no API key, no install ID and no query data (the release host sees the request and your IP address), but it does reach the network on its own schedule rather than yours. Set SKYTALE_NO_UPDATE=1, or auto_update=off in ~/.skytale/config, to turn it off; the client then never contacts anything but your configured server.

What we do not do

We do not sell or rent data, use it for advertising, or build profiles of what you search for. Skytale contains no third-party analytics or tracking.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct it, or to delete your account and the data tied to it. Billing records we are required to keep are retained after deletion for as long as the law requires. You can also complain to your data protection authority; in the UK that is the Information Commissioner's Office (ico.org.uk).

Children

Skytale is not intended for anyone under 18.

Changes

If we change this notice, we will update this page and its date.