Privacy

Short, because we collect almost nothing. Last changed 24 September 2026.

If you only read and copy

No account needed to read, copy or search. Copying a skill happens entirely in your browser — the text goes to your clipboard and never passes through us a second time. We do count some of this anonymously: which skill got viewed, searched for or copied, and whether it worked — tied to a random cookie in your browser, not to you. That cookie carries no name, no email, nothing that identifies you, and it expires after 90 days.

If you sign in

We store your email address. Sign-in is a link sent to that address — there is no password, so there is no password of yours for us to lose. The session lives in your own browser.

If you fill in the profile on your account page we also store what you typed there — a name, a bio, a website — and which sign-in accounts you linked. All three fields are optional and stay empty until you type in them. You can clear any of them at any time by emptying the field and saving.

If you bought an MCP plan or credits

Personal, Team and Enterprise plans are billed through Lemon Squeezy, our payment processor: they take your card and run the charge for AgentAlley, the seller — we never see or store your card number, CVV or expiry date. What we store on our side is your subscription’s state: plan, billing period, renewal date, status (active, past due, cancelled…), and Lemon Squeezy’s own subscription and customer IDs. No card data, ever.

Ask for an MCP key and we store only its SHA-256 hash — the key itself is shown to you exactly once and cannot be read back from our database, even by us. Creating a new key revokes the old one.

A Team plan also stores who is on the team, their role, and the email address you invite. The invite link itself is a one-time code; only its hash is kept.

Using the MCP connector

When your AI calls a tool through /mcp, we log which tool ran, which item it touched, and — from your key — your account, so a Team owner can see the team’s combined usage and so we can enforce the per-minute and per-day call limits. Browsing and searching the website is logged the same anonymous way described above, signed in or not.

Private skills and your team’s usage data never go into reports for anyone else. Trend reports only use aggregated, anonymous data from the public catalogue.

If you subscribe, vote, review or write to us

• Subscribe — your email, the date, daily or weekly, the categories you picked, and whether you clicked the confirmation link. We also log each email we send you (when, and whether it was delivered or bounced) so we never send the same one twice.
• Vote — which listing, and which account voted. One vote per person.
• Review — what you wrote, and which account wrote it.
• Contact — what you typed, plus your email only if you chose to give one.
• Enterprise contact — your name, email, company, team size and what you need.

What we never collect

No phone, no date of birth, no advertising identifier, no ad scripts. Your card details go straight to Lemon Squeezy — we never see or store the number, the CVV or the expiry date, only their confirmation that you paid. We never ask for your real name — the name on your profile is whatever you chose to type, and leaving it blank costs you nothing.

We run one third-party analytics tool, PostHog, to count visits and page views. Session recording, autocapture and individual profiles are all switched off, every text field is masked, and it does not run at all if your browser sends Do Not Track. The page’s security policy blocks every other outside script, so nothing else can quietly appear later.

Where it lives

Sign-in is handled by Supabase; billing is handled by Lemon Squeezy; everything else sits in a Cloudflare D1 database behind this site. Author avatars on the home page are loaded from GitHub, which means GitHub can see that a browser asked for that image.

Getting it deleted

Ask and it goes — one message, and you do not have to explain why. We remove the row rather than anonymise it. One exception: if you unsubscribe, we keep the address marked as unsubscribed, because deleting it outright would let you be added again as if you were new.

Or do it yourself: the Delete account button at the bottom of your account page removes your sign-in and personal data at once; purchase and payout records stay only as the law and our books require, with your name and email taken off.