Policy

Privacy

Plain-language MVP privacy notes for the Codex Commons website and marketplace submission flow.

TermsSecurity model

Account

What we store

Codex Commons uses GitHub login through Supabase. The app may store your GitHub user ID, username, avatar, display name, submitted public repository metadata, plugin submission metadata, validation reports, and review events.

Limits

What we do not intentionally store

Codex Commons is not intended to store your Codex workspace contents, private repositories, plugin secrets, API keys, or private workspace data.

Services

Third parties

GitHub
Login, repository metadata, Actions, and source hosting.
Supabase
Authentication, database, validation state, and project records.
Vercel
Hosting when the site is deployed there.
Scanners
Validation jobs may use GitHub Actions, Semgrep, npm audit, and OSV Scanner.

Public data

Published listings

Published plugin metadata, pinned source commits, validation context, review events, and publication status may be public.

Requests

Deletion and corrections

Open a GitHub issue or contact maintainers through the documented support channel to request account, submission, or metadata deletion where the project can reasonably process it.

MVP

Policy changes

Codex Commons is a development preview. This policy may evolve as the project adds funding, hosting, contributors, or additional review workflows.