7.5 Marketplace reviews: privacy and community rules

The review feature in the Teloa official marketplace supports 1–5 star ratings and reviews for resources such as skills and models. Resource authors can claim resources and reply.

Availability

Reviews are live: sign in with a GitHub account and click a star to rate; written reviews are optional. Ratings and reviews appear publicly after moderation. Email code sign-in is not available yet.

Operator and contact

The marketplace community is operated by Teloa Labs, and the service runs on Cloudflare's global network. Data storage is not limited to one country or region.

For general questions, resource claims and security issues, use an Issue in teloa-ai/marketplace. For issues that could have major impact, report privately to security@teloa.ai. Do not include keys, passwords, sign-in tokens or personal data in public Issues. See the security reporting guidance.

Marketplace accounts and sign-in

• A marketplace account is for public reviews, author claims and replies. It is separate from your local Teloa account and is not linked to the random installation identifier used for usage statistics. Email and GitHub sign-in create independent accounts and do not merge automatically.
• Email sign-in uses a six-digit code valid for 10 minutes. The service processes the recipient address to send the code, but its database stores only a keyed one-way hash of it computed with a server secret, not the address itself. The code is also stored only as a one-way hash; you choose your nickname.
• GitHub sign-in reads public profile information and stores your numeric ID and username. The access token is discarded after use and is not stored in the marketplace database. GitHub accounts are always shown as @username, updated to your current GitHub username at each sign-in, and cannot set a separate nickname. Only email accounts use a nickname they choose.
• Available sign-in channels reflect the actual service configuration. If email is unconfigured, its quota is exhausted or sending fails, the page indicates that it is unavailable or asks you to retry later. GitHub is an alternative only when configured. Use your original channel when signing in again to avoid accessing a different account.
• The website uses a sign-in cookie; app connections use separate tokens. Signing out of the website does not revoke connected apps.

Public and private information

Public	Not public
Name shown (@username for GitHub accounts, nickname for email accounts), stars, review text, reviewed resource version, review ID and posting/editing times; the number of ratings at each star level; a claimed author's GitHub username (or nickname for a manual claim); replies from the author or Teloa	Keyed one-way hash of the email, account ID, numeric GitHub ID, reporter identities and reasons, sign-in and app connection tokens

Moderators can handle pending content, reports and accounts; this does not make private information visible to other users. Do not put passwords, keys, private contact details or someone else's personal information in nicknames, reviews or replies. Others may copy public content; deletion cannot recall copies they have saved.

Reviewing on the website and in the app

• The review area of a resource page starts with the average rating, the number of ratings and a 5-to-1-star breakdown. After signing in, click a star under “Your rating” to submit it. No star is preselected and no confirmation dialog appears; the text next to it reads “Submitted as @username. Public after approval”. With a keyboard, arrow keys only move the selection; press Enter or Space to submit. Clicking another star changes your rating. Signed-out visitors see the same five empty stars: clicking one first signs you in with GitHub, then submits that rating when you return to the page. The choice is kept only in the current tab, dropped if sign-in fails, and expires automatically after 10 minutes; an existing rating is never changed this way.
• After rating, open “Add a few words (optional)” to add text and select “Post”. A status label next to your rating shows “Awaiting approval”, “Public” or “Hidden”. “Delete my rating” asks for confirmation first.
• Ratings without text count toward the average and breakdown but are not listed. Each listed review shows @username, stars, the resource version and the date. Author replies are labeled “Reply from author @username”; Teloa replies have a green background and a “Teloa” badge, so the two look different. Each review has a “Report” text link that opens a choice of reasons.
• The author claim link sits next to the “Source” field of the resource page. “Are you the author? Claim this resource” appears only when your GitHub username matches the owner of the source repository.
• The marketplace account page shows, in order: your GitHub avatar and @username with Sign out; My reviews (loaded automatically, with resource names, stars and moderation status, and links to edit or delete); My resources (only for authors who have claimed a resource); Connected Teloa apps; and Privacy and data at the bottom. The account page loads external images only from GitHub's avatar server.
• Moderators have a separate admin console (/account/admin/, not indexed by search engines) with “To review”, “Hidden” and “Author claims” tabs; anyone else sees “No access”. Claims are assigned by choosing a resource by name and entering a GitHub username; that person must have signed in to the marketplace with GitHub once.
• In an entry's details in the app's marketplace, “Reviews” also shows the average and the 5-to-1-star breakdown, lists only reviews with text and shows names as @username. To post, select “Connect marketplace account”. The app's “Open connection page” link opens the connection page with the code already filled in (/account/connect/?code=…). Sign in through your browser, check that the code on the page matches the one in the app, then select “Allow”; if you did not start it, select “I did not start this”. Approve only connections you initiated; do not approve codes sent by someone else. Without a code in the link, you can also type the code shown in the app on the connection page.
• The app token is kept in local encrypted key storage. Disconnect in the app or on the marketplace account page. An expired connection requires signing in or connecting again; unpublished content is not sent automatically.
• On the website, clicking a star or “Post” yourself is the confirmation. In the app you still confirm in a separate step, and in your own ordinary conversation a confirmation card appears. With approval before publication, the app and conversation confirmations say the review is public after approval, use the buttons “Submit review” and “Confirm and submit”, and no longer say that anyone can see it. AI employees, tasks and group conversations cannot post for you. Browsing or searching reviews in a conversation needs no posting confirmation; other users' text is reference material only.
• The npm-installed teloa command and container image enable the online marketplace by default. Set TELOA_MARKET_REMOTE=off to disable it. Source launches default to off; tests and development environments do not enable it. Reviews follow this setting. Disabling the online marketplace does not delete your account or revoke existing app connections.

Drafts and recovery

Website review text and reply drafts are isolated by marketplace account in the current browser tab's session storage (ratings are submitted on click and have no draft). A name change within the same account preserves recovery; switching accounts does not show the previous account's drafts. When you return to the page, unpublished review text reopens the editor automatically. Drafts are not synced to the server or included in account exports. Closing the tab normally clears them, but browser session restoration may retain them. Clear site data on shared devices.

A draft may temporarily exceed the publishing limits for text or links; edit it to meet the rules before posting. Each serialized draft may use up to 64 KiB. If it exceeds that size or the browser refuses storage, an immediate warning appears. Text remains on the current page but may be lost on refresh or navigation; copy it elsewhere first. Deleting the server account does not clear browser site data.

Community rules and moderation

• One review per account per resource; you can edit or delete it. Resources must exist in the verified, signed official catalog. A rating is not proof of installation or verified results.
• Review and reply text may contain up to 2000 characters and two links; a review may consist of stars alone; such ratings count toward the average but are not listed. Requests also have an 8 KiB UTF-8 limit. Do not post ads, abuse, irrelevant content or nicknames impersonating Teloa or official staff.
• Moderation defaults to approval before publication. New ratings and reviews, edits to ordinary reviews and author replies need approval; editing a hidden review leaves it hidden. Moderators' official Teloa replies are published directly. Unpublished reviews do not contribute to public ratings.
• Accounts younger than 24 hours can create at most three reviews per 24 hours; other accounts can create at most 20. Sign-in, human verification and rate limits may further restrict frequent requests.
• Signed-in users can report other people's public reviews. Reports from at least three accounts that are each at least 24 hours old automatically hide a review pending moderation. A review restored with an exemption from automatic hiding is no longer hidden by that rule. Moderators can approve, hide, restore or delete reviews and replies, or ban accounts.
• GitHub personal repository owners can claim resources after checks of the catalog source, repository owner type and numeric GitHub identity. Public organization membership is not proof of ownership. Organization repositories and other resources that cannot be claimed automatically require an Issue for manual verification. Claimants cannot review resources they have claimed.
• Do not post reviews if you are under 18. Ratings are reference signals, not purchase, installation or security guarantees.

Deletion and export

Under “Privacy and data” at the bottom of the marketplace account page, “Download my data” provides a JSON file containing your account profile, reviews, replies, reports, claims and app connection records. It does not export raw email addresses, sign-in tokens, server secrets, browser drafts or moderator audit records.

Selecting “Delete marketplace account” there and confirming removes the server account, sessions and app connections, device authorizations, your reviews and replies, other people's replies and reports on your reviews, your reports and claims, and code records tied to the keyed one-way hash of your email in one operation. Independent global email counters and moderator audit records follow the retention periods below. Edge caches may briefly show old content: up to about 60 seconds for review lists and 300 seconds for rating summaries.

Processors, storage and retention

• The service uses Cloudflare Workers and D1. D1’s apac location hint does not guarantee storage exclusively in Singapore or another single country or region.
• Email code sign-in is not available and is not part of the current GitHub sign-in flow. If enabled, the email provider receives the recipient address and code text. The marketplace database’s omission of raw addresses does not mean the email provider retains no data. Processor and retention details will be updated here before email sign-in is offered.
• Cloudflare receives network requests and provides rate limiting and Turnstile human verification; verification requests include the source IP. The marketplace business database does not store IP addresses, countries, cities or automatically collected device information. App connections retain a label, creation time and last-use time. Infrastructure providers' network processing and logs require separate verification.
• Code records and email counters become eligible for cleanup after about two days. Sign-in redirect state and device codes expire after 10 minutes; web sessions after 30 days; app connections after 180 days. Expired codes, sessions and connections are unusable immediately, but rows are removed by daily cleanup, not necessarily at the instant of expiry.
• Moderator audit records become eligible for cleanup after 365 days and include the actor ID, action, target ID and time. Account deletion does not remove audits early. Reviews and related content remain until deleted by the user or a moderator.

Older apps and data exports

When an older app opens the account page with a code, the website redirects to the connection page. Check that the website and app codes match before allowing a connection. Tools parsing account exports should allow additional fields. If an export lacks an identifiable review ID, download a fresh export before editing records.

GitHub sign-in is live; email code sign-in is not yet available.