Privacy Notice

Status of this notice

This notice describes what Fygment does today, checked against the product. It does not claim compliance with any particular privacy law.

Who is responsible and how to contact us

Fygment is operated by its founder, an individual based in Belgium. Fygment is not a registered company; "Fygment Labs" is the name it is presented under, not a legal entity. The founder decides how the data described below is used. Contact [email protected] for any privacy question or request.

• Where Fygment is offered: available worldwide, except where prohibited by law.
• Minimum age: you must be at least 18 to use Fygment.

What we collect

Fygment stores the account and workspace data needed to operate an AI skill registry: email address, workspace membership, skill metadata, package checksums, approvals, audit events, external source references, and connected harness metadata. For MCP requests and authentication failures, Fygment also logs IP addresses, browser or device information from user-agent strings, and per-request diagnostics for security and troubleshooting. Failure logs can also carry the signed-in user id and email address. These runtime logs are retained for 30 days. Fygment does not currently send marketing email, and it uses no third-party analytics or advertising tools.

Runtime privacy boundary

Fygment is designed around metadata-only runtime diagnostics. The CLI receipt and execution-log planning flows avoid capturing stdout, stderr, prompts, local paths, package bodies, secrets, or customer content by default.

Skill packages and what leaves Fygment

Skill package content leaves Fygment in the ways below. Package bodies are visible only to users with workspace access and are not shown in platform-admin aggregate views.

• Storage: package archives and proposal patches are kept in Vercel Blob and handled by Vercel functions during uploads and imports.
• Trust review: imported or changed package archives are sent to NVIDIA SkillSpector running on Microsoft Azure. Static review scans the temporary archive without a language model. Full review places the archive in private Azure Blob Storage, runs the job through Azure Queue Storage, and sends package contents to Azure OpenAI for semantic analysis. Fygment keeps bounded findings and scanner metadata, not the raw report, prompts, source snippets or model responses.
• LLM normalization: only when an owner asks for it, selected text files from the candidate package, source details and bounded metadata are sent through Vercel AI Gateway to an OpenAI model. Secret-like content is blocked before the transfer, and the result always needs human review.
• Connected AI tools: skills that you read through a tool such as Claude or ChatGPT go to that tool and its provider, under your own agreement with them. Fygment does not control that handling.

Providers that process data

These providers handle account, workspace or package data today. This is a plain list of what each one does, not a certified subprocessor register.

• Neon (Auth and Postgres): Neon Auth handles sign-in, passwords, sessions and email sign-in codes. Neon Postgres stores accounts, workspaces, skill records, hashed tokens, audit records and runtime logs.
• Vercel: hosts the website and functions, receives request metadata and platform logs, stores package archives and proposal patches in Blob, runs scheduled jobs, and carries AI Gateway requests.
• Cloudflare: DNS and proxy in front of fygment.dev, so every request passes through it, and Turnstile, which receives the signup check token and the requesting IP address.
• Google and GitHub: optional OAuth sign-in through Neon Auth. They return the account identifiers and profile details needed to sign you in.
• GitHub, GitLab, npm and ZIP sources: for an import, or a daily source-update check, Fygment requests the archive or package from the source you registered and sends the owner, repository, ref and path.
• Resend: delivers invites, sign-in codes, account-security notices and notification digests, so it receives the recipient address and the message text, including the sign-in code.
• Sentry: receives error and performance events and release-health session counts. Fygment removes user identity, request headers, cookies, request bodies, URL query strings, email addresses and credential-shaped text first. Session Replay is off.
• Vercel AI Gateway and OpenAI: LLM normalization, as described above.
• NVIDIA SkillSpector on Microsoft Azure (Container Apps, Blob Storage, Queue Storage, OpenAI): trust review, as described above.
• Stripe: only if a workspace starts a paid plan. Stripe Checkout collects the payment details, and Fygment keeps the customer and subscription identifiers and status.

Sign-in security

These controls were added to protect accounts and are described here because they store or log data.

• Email code per browser: after Neon signs you in, Fygment emails a one-time code through Resend to prove that this browser controls the mailbox. Fygment stores only a keyed hash of the code, allows five attempts, and deletes the record about a day after it expires.
• Thirty-day browser record: once you enter the code, Fygment sets a secure HttpOnly cookie and stores a record in Neon Postgres. The record holds your Neon user id, keyed hashes of the browser token and email address, and timestamps. It is valid for 30 days and is revoked on sign-out, on an administrator action, or when your account security changes. The daily cleanup deletes it about 30 days after it expires or is revoked.
• Security logs: assurance events record the outcome and a reason, such as the purpose or route. They never contain the code or an email address. Other failure logs are covered under What we collect.
• Connected AI tools: when you authorize a tool, Fygment stores its client id and name, the granted scope, who connected and when, and hashes of its access token (valid one hour) and refresh token (valid 30 days). Workspace owners and admins can see these connections and disconnect them on the Connected AI tools page. API keys are stored as hashes.
• Enterprise sign-in: enterprise-managed sign-in is built but switched off, so no data from a company identity provider is processed today.

Automated trust decisions

Trust review outcomes are automated, and no person looks at them before they take effect. An allowed import is published straight away, and a caution import is published with a warning; no person approves either one first. Block stops an import and prevents a proposal from being approved. If the review is unclear or incomplete, an import is not accepted and a proposal stays open for human review. Approving a proposal remains a person's decision. There is no in-app appeal yet. To have a person look at an outcome, email [email protected] with the workspace slug and package name, or fix the package and run the review again. No response time is promised.

Cookies and browser storage

Fygment uses essential Neon Auth session and OAuth-flow cookies to keep you signed in, and the browser-assurance cookie described above. Short-lived, signed, HttpOnly cookies can retain an email address during login, signup, or password recovery for up to ten minutes, and for up to an hour after a first sign-in to show a password notice. The browser stores the light-or-dark theme choice in local storage. Cloudflare Turnstile may set its own cookies on the signup page. Fygment sets no analytics or advertising cookies and does not use Sentry Session Replay.

Retention, archive, and deletion

A scheduled job deletes first-party runtime logs older than 30 days each day. A workspace archive is not account or database deletion. An owner can archive a workspace from settings. That hides it from normal access, revokes its API keys and connected-tool tokens, and tries to delete its package archives and proposal patches from Vercel Blob. That deletion is best effort: a failure is logged. Workspace, membership, governance and audit records in the database remain. There is no self-service account deletion. Account deletion, data export and export help are handled by email to [email protected], with no promised timeline. Backups and records held by Neon Auth, Vercel, Cloudflare, Resend, Sentry, Stripe and Microsoft Azure follow their own retention, and Fygment has not published a schedule for them. Our Azure setup is configured to delete temporary scan archives after a one-day lifecycle rule, keep job metadata for seven days, and keep deleted objects recoverable for seven days.

Your requests

Email [email protected] to make privacy requests: access to, correction of, export of, or deletion of your account or workspace data, or a privacy concern or objection. Include the account email and workspace slug, but do not send passwords, API keys, OAuth tokens, or private package bodies. Requests are handled by hand. We may ask you to confirm from the signed-in account, and no response deadline has been set yet.

International services and legal basis

The named providers can process data outside your country, and Fygment has not published provider-by-provider processing regions or international-transfer safeguards. Fygment has also not yet documented the legal basis for each processing purpose. Do not assume that every provider keeps data in one country or region.

Changes to this notice

The date at the top shows when this notice last changed. Fygment has not yet set a method for notifying users about material changes.