Privacy & Security
The architecture in one picture
Local-first. No cloud. No server.
The Sales Agent Pack runs entirely on your machine. The Express server binds to 127.0.0.1(localhost only) — it is not accessible from the network, the internet, or any other device. Your conversations exist in your browser's memory and nowhere else.
Your API key never leaves your browser.
When you enter your Anthropic API key in Settings, it is stored in your browser's localStorage. The key is sent directly from your browser to the local Express server (on localhost), which forwards it to Anthropic's API. At no point does the key touch our servers, our database, or any third-party service. We cannot see it, read it, or log it.
Zero telemetry. Zero analytics. Zero tracking.
The desktop app does not collect usage data, error reports, crash logs, conversation content, or any other telemetry. The only outbound network call the app makes is a version check to clskillshub.com/api/updates/checkevery 6 hours, which sends your app version and platform (e.g. "0.1.0, win") and receives a JSON response with the latest version number. No user data, no conversation data, no API key — just a version string.
Conversations are not stored or transmitted.
Your chat history exists in your browser's session memory while the tab is open. When you close the browser tab, the conversation is gone. We do not persist conversations to disk, to a database, or to any external service. If you want to save a conversation, you copy-paste it yourself. This is a deliberate design choice for your privacy.
The content files are readable markdown.
The 10 council voice files, 12 sales skill files, 4 workflows, and 4 playbooks are all plain-text .md files. You can open any of them in a text editor and read exactly what the AI is being instructed to do. There is no obfuscated code, no binary blobs, no encrypted instructions. If you download the Mode B skills zip, you can inspect every file before installing.
Verify the installer yourself.
The Windows installer is built with Electron + electron-builder and packaged as an NSIS installer. The installer is not code-signed in v0.1.0 (code signing certificate is coming in v0.2.0), which is why Windows SmartScreen shows a warning on first run.
You can verify the integrity of the download by checking the SHA-256 hash:
To verify on your machine after downloading:
Get-FileHash "Sales Agent Pack Setup 0.1.0.exe" -Algorithm SHA256
shasum -a 256 "Sales Agent Pack Setup 0.1.0.exe"
If the hash matches, the file you downloaded is identical to the file we built. If it doesn't match, do not install — the file may have been tampered with in transit.
What data we DO collect
Honest list — this is everything, with no exceptions:
- 1.Your email address — collected at purchase time. Used to send you the unlock link and purchase confirmation. Stored in our Redis database. Not shared with third parties. Not used for marketing unless you also subscribed to the newsletter.
- 2.Your payment ID — the Razorpay or PayPal transaction ID. Stored alongside your email for refund processing and purchase verification. Not shared.
- 3.Version + platform on update check— when the desktop app checks for updates, it sends your app version (e.g. "0.1.0") and platform (e.g. "win"). No user-identifiable information. No IP logging on our end (Vercel may log IPs in its CDN layer per their privacy policy).
That's it. Three data points. No conversation content, no usage analytics, no behavioral tracking, no cookies in the desktop app, no fingerprinting.
What about Anthropic?
When you ask the Sales Agent Pack a question, your message is sent to Anthropic's API using YOUR API key. Anthropic's data handling is governed by their privacy policy and API terms of service:
- Anthropic does not use API inputs/outputs for training (per their API terms, as of 2026).
- Anthropic may retain API logs for up to 30 days for abuse monitoring.
- Your conversations with the Sales Agent Pack are between you and Anthropic's API. We are not a party to that exchange.
For full details, see Anthropic's Privacy Policy and API Terms of Service.
A note about code signing (v0.1.0)
The v0.1.0 Windows installer is not code-signed. This means Windows SmartScreen will show a warning ("Windows protected your PC" / "Unknown publisher") when you run the installer.
This does notmean the software is malware. It means we haven't purchased a code-signing certificate yet ($200-400/year from DigiCert or Sectigo). This is common for v1 releases from indie developers.
To verify the installer is safe:
- Check the SHA-256 hash (listed above) matches the file you downloaded
- View our VirusTotal scan — 0 detections across 70+ antivirus engines
- Use Mode B instead (the skills .zip is just plain markdown files — no executable code)
Code signing is planned for v0.2.0. Once signed, the SmartScreen warning will no longer appear.