Privacy policy

01What this policy covers

This notice covers Humans to Know profiles, Skills and supporting files, collections, articles, comments, votes, follows, saves, Google sign-in, contact requests, and authorized agent access. Humans to Know is operated by Akshay Apsingi. Submit privacy questions using the contact form.

02Information the application handles

• Sign-in details: Google account identifier, email address, email verification status, name and profile image URL. Google credentials and tokens used to complete sign-in may be stored; your Google password is not received.
• Profile and content: your handle, headline, bio, optional excerpt, category, location, links, profile image and pinned Skill, plus Skills, collections and supporting resource links you submit.
• Relationships and engagement: whom you follow, which Skills you save or vote for, and the comments you post.
• Requests: the reply email, request type, subject, and message supplied in the contact/report form. A keyed digest helps prevent duplicate submissions; a keyed digest of the request IP helps apply submission limits.
• Session and security details: session tokens, expiry and activity timestamps, and IP address or browser information where available to the authentication service. Rate-limit records help limit abuse. Operational logs may contain request and error information.

03What other people can see

Your directory profile can show your name and image supplied at sign-in alongside information you add later. Published Skills, published collections and follower/following relationships are public and may be copied or indexed by search engines. Do not include an email address, precise location or other sensitive information in a public field unless you intend to share it.

Your sign-in email, authentication records and sessions are not included in the public directory. Saves are visible only to their owner through the app; other members and CMS editors cannot browse them. Authorised database operators may access stored records when necessary to maintain, secure or support the service. Draft Skills and collections are restricted by ownership checks.

04Why information is used

We use this information to sign you in, maintain your session, display the profile and content you share, organise and find Skills, apply ownership and privacy controls, remember follows and saves, and investigate technical problems or misuse. The current application has no implemented payment, advertising-tracking or marketing-analytics integration. Those features are not covered by an implied consent to future tracking.

05Cookies and sign-in

Authentication uses cookies to maintain sessions and protect the sign-in flow. Member and CMS editor sessions are separate. You can sign out or remove cookies in your browser; blocking essential cookies may prevent sign-in. The current member session is checked against the database rather than treated as a permanent browser credential.

06Providers and external links

Google processes information when you choose Google sign-in under its own privacy policy. Better Auth and Payload are software used by this application; their presence does not mean your account records are sent to a separate hosted identity service operated by either project.

The service uses Cloudflare to host the application, deliver pages and store uploaded media, and Neon PostgreSQL to store account and application records. GitHub is contacted when you scan a repository or retrieve supported repository files. Imported instructions and supporting text may be stored with your Skill; linked images and resources may stay with their original host. These providers may process information outside your country.

Following an external link, loading an externally hosted image or using a linked tool can disclose technical information to that provider. Its policy applies to that interaction. Public directory access also makes the content you publish available to other visitors.

07Connected AI clients

MCP connections use scoped, expiring authorization associated with your member account. The application stores hashes of opaque access credentials and checks scope, resource, expiry, and revocation on each call. For writes it separately checks a browser-approved action or an explicit, bounded delegation. You can revoke connections, approvals, and delegations from connection management. Revocation prevents subsequent authorized calls; it cannot retract content already retrieved by a client.

Agent operations record the actor, client where available, operation, target, outcome, timestamp, and correlation information for security and troubleshooting. These audit entries exclude tokens and content. Pending action input is stored to bind your approval to the exact action, then cleared after completion; a compact result supports safe retries. No fixed audit retention period is promised here. A connected client receives the content you retrieve and results of authorized actions under that client provider’s own data practices. The application does not execute imported Skill instructions to read them.

08Retention and removal

Account and content records are kept to provide the service while they are needed. Session records have expiry times; signing out ends the current session. Expired records, logs and backups may remain until maintenance removes them, so expiry does not promise immediate erasure of every copy. Retention varies with the type of record and the operational purpose; contact us to request removal of your account or information. Information may need to be retained to resolve misuse, disputes or legal obligations. Public copies made by others are outside our direct control.

09Your choices and requests

You can edit available profile fields, remove your saves and follows, and sign out. Account deletion and a dedicated export tool are not yet self-service. Depending on the law that applies, you may have rights to access, correct or delete personal information, restrict or object to processing, obtain a portable copy or complain to a relevant regulator. Use the contact form and choose an account deletion or privacy request. Include your sign-in email and describe the records concerned. Requests are private to site editors; we may ask you to verify ownership before releasing or deleting information. The form does not immediately erase an account.

10Newsletter

The Humans to Know newsletter is coming soon. No Substack publication or subscription form is connected here, and signing in does not automatically enrol you. Any future newsletter will have a separate, clear subscription choice and information about its provider.

11Security and updates

Authentication, database constraints and access controls help protect account information, but no service can guarantee absolute security. Do not submit passwords, secrets or unnecessary sensitive information as content. We will revise this notice as the service changes and publish the updated date here. You can send security concerns or privacy questions through the contact form.