localhost.md

localhost.md

Privacy

Your account, your choices, and the data behind them.

Last updated: October 24, 2026. localhost.md is operated by Nikba Creative Studio.

What happens when you sign in with GitHub

  1. You continue on GitHub. GitHub handles your password, two-factor authentication and authorization. Your GitHub password is never sent to localhost.md.
  2. GitHub confirms your public identity. We request no additional OAuth scopes: no private email access, private repository access or permission to change your code. GitHub describes these permissions in its OAuth scope documentation.
  3. We create or update your local account. We store your stable numeric GitHub ID, username, public display name and a local profile handle. Your username and display name refresh when you sign in again. A public email may appear in GitHub's response, but we do not save it for new GitHub accounts.
  4. A secure session keeps you signed in. Our server exchanges a temporary authorization code with GitHub. The resulting access token is used in memory to read your identity and is not stored in our database or browser. We do not persist refresh tokens. Sign-in requests use state and PKCE checks and expire after ten minutes.

GitHub is the only sign-in provider. New accounts have no local password or stored email address. Signing in does not grant administrator access or verify repository ownership. Browsing skills and copying installation commands do not require an account, and signing in does not enable analytics.

Public and private account data

Your handle, profile name, GitHub profile link/avatar and published submissions, ratings and reviews are public. Saved collections, session records, moderation notes and any legacy email address are not public profile fields. Public profile avatars load from GitHub's avatar service without a referrer. Older accounts may retain a previous email or password hash; these credentials cannot be used to sign in.

Cookies and browser storage

Necessary cookies support secure sessions, form protection and GitHub sign-in. They remain active when you choose Decline. Accept allows the optional categories available for the site. Settings opens individual switches; necessary cookies stay on and optional analytics starts off unless you previously allowed it. Use Save preferences to apply your selection. Optional Google Analytics cookies are used only after you accept them. You can browse and sign in while declining analytics.

Use Cookie preferences in the footer to reopen the panel and change your choice. Choosing Decline or saving Analytics cookies switched off disables analytics, removes accessible first-party analytics cookies and reloads a page that had loaded the Google tag. Other open tabs on the same origin receive the changed choice. Withdrawal stops future collection through this integration; it does not erase information already received by Google. Do Not Track and Global Privacy Control signals keep analytics off even when an earlier choice allowed it.

The panel is available even when analytics is disabled. Admin, sign-in, publishing, profiles, private collections and visits by moderators or administrators are excluded from analytics. Without JavaScript, our analytics module does not run; necessary server cookies can still be used.

GitHub sources and submissions

The repository selector reads your public repositories from GitHub's public API. Selecting or submitting a source does not grant repository permissions. The server reads the selected public SKILL.md and nearby license evidence without executing repository code, then stores metadata, content, source commit and version history. Public API responses are cached. We do not read private repositories or use credentials from your computer.

Ratings, moderation and Telegram

Ratings and review text are public with your handle. You can edit or remove your feedback from the skill page. Removal excludes the rating from public scores and clears its written text; a private moderation record remains to prevent moderation bypass. Moderators retain decision history, identity, source commits and notes. Newly approved skills may be announced in our Telegram channel using public listing metadata and source links. We store delivery status and message IDs. Telegram applies its own retention rules.

Third-party services

GitHub processes sign-in under its privacy statement. Fonts and interface assets are self-hosted. If you accept analytics on an eligible public page, Google receives ordinary analytics request information under its privacy policy. Our integration excludes account IDs and private form content, strips query strings from page locations and sends only the origin of a referring site. No AI provider is included. Source links contact their destination; running an installation command uses the external skills CLI and its own network and privacy settings.

Signing out, revoking GitHub access and requesting deletion

Sign out ends the current localhost.md session. To revoke the OAuth authorization, open GitHub Settings → Applications → Authorized OAuth Apps, find this site's application and revoke it. See GitHub's instructions. Revoking authorization does not automatically end an existing localhost.md session or delete its account and content; sign out here as well. A later sign-in may ask you to authorize again.

Accounts, source snapshots and moderation history remain until removed by an operator. Hosting logs may contain ordinary request information. Account and data deletion currently require operator assistance; there is no self-service deletion button. Contact office@nikba.com for privacy, access or deletion requests. Recover access to your GitHub account through GitHub; localhost.md has no password-reset flow.