Privacy Policy

You can browse the site without an account. We don't use advertising trackers, and we never sell information.

To understand how the site is used and improve it, we use Microsoft Clarity to collect usage data, including the pages you visit, interactions such as clicks and scrolling, device and browser type, and approximate location. Clarity sets cookies in your browser to tell visits apart and processes this data under the Microsoft Privacy Statement (privacy.microsoft.com). We only look at aggregated statistics and don’t use it to identify individuals.

We also count daily visits ourselves: when you open a page, your browser tells us which page it is and which site you came from. We use this to count page views, visitors, popular pages, referring sites, approximate location (the country or region Cloudflare derives from your IP address) and device type. This does not use cookies and does not store your IP address: to tell the day’s visitors apart, we combine your IP address, browser information and a random value that changes every day into an identifier that cannot be reversed. The random value is deleted after two days, after which the identifier can no longer be linked to an IP address, and the same person cannot be recognised across days. Detailed records are kept for 90 days; after that we keep only daily totals.

When you send feedback from a project page, we store the issue type you choose, the details you write and, if you aren’t signed in, the optional email you leave; if you are signed in, we link it to your account. Only site admins can see feedback. We use it only to check and fix the issue, and to contact you at that email if needed. To prevent repeated submissions we keep only a hash of your IP address, not the address itself.

To keep the site secure and fix problems, Cloudflare (our CDN and security provider) and our servers automatically keep access logs, including IP address, browser type, the pages requested and the time. These logs are used to block attacks, diagnose issues and count how often search engine crawlers visit each day (only crawler requests are counted), and are deleted once they are no longer needed.

The following settings and records stay in your own browser (localStorage / sessionStorage). They aren't sent to us, and clearing your browser data removes them:

• Interface language, light or dark theme, and whether you dismissed the language notice
• Tool lists cached temporarily to make pages load faster
• Your sign-in session, which keeps you signed in and is cleared when you log out

Cloudflare may set cookies that are strictly necessary to block malicious traffic, and Microsoft Clarity sets analytics cookies (see above). We don't use advertising cookies.

Signing in is optional. It’s used for features that need to know who you are, such as bookmarks, comments and submitting projects. You can use any of the following, and your account is created the first time you sign in:

• GitHub: we receive your GitHub user ID, username, display name, avatar and email address. We don't access your repositories or act on your behalf.
• Google: we receive your Google account ID, name, avatar and email address (scopes limited to openid, email and profile). We don't access your Gmail, contacts, Drive or any other Google data.
• Email code: we receive the email address you enter and send a one-time code to it. The code is valid for 10 minutes and works only once.

We never receive your GitHub or Google password. Signing in with the same email address through different methods takes you to the same account.

Your account also records when it was created, when you last signed in, and the IP address and browser used to sign in, to protect your account, for example by spotting unusual sign-ins.

MCP servers and Skills you save on a project page are stored in your account (which items, and when you saved them). Only you can see them, under “Saved” in the console, and removing an item deletes its record. Bookmarks you made earlier, when they were kept only in your browser, are moved into your account when you sign in and then cleared from the browser.

If you create API keys in the console (so agents such as Claude Code can reach your saved items through our MCP server), we store each key’s name, expiry date and a hash of the key (never the key itself), plus when it was last used and by which client, so you can see this in the console. Revoking a key deletes these records.

• To create and maintain your account and keep you signed in
• To show your name and avatar on the site, such as in the navigation bar and next to comments you post
• To send sign-in codes and essential notices about your account security
• To prevent abuse, spam and attacks
• To respond to your questions and requests

We don't use your information for advertising, and we never sell or rent it. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We share information only with service providers that help us run the site, and only what they need to do their job:

• Supabase: sign-in and account data storage, on servers in Mumbai, India
• Cloudflare: content delivery, security and image storage
• Microsoft Clarity: site usage analytics
• An email delivery service: delivers sign-in code emails
• Our server host: runs the website and its API

GitHub and Google process information under their own privacy policies when you sign in with them. Beyond this, we disclose information only when the law requires it or when it's genuinely necessary to protect our users or the site.

MCP Field lists public information about open-source projects, such as project names, descriptions and repository links, and authors' public usernames and avatars, gathered from public pages such as GitHub and MCP directory sites. If you're a project author and want information about you corrected or removed, email [email protected].

We keep account information for as long as your account exists. When you ask us to delete your account, we delete it and its associated data within 30 days, unless the law requires us to keep it.

• Access and correction: contact us at any time to get a copy of, or correct, the information we hold about you.
• Delete your account: email [email protected] from the address you signed up with.
• Revoke access: remove MCP Field's access at any time under GitHub Settings → Applications → Authorized OAuth Apps, or under “Third-party apps & services” in your Google Account.
• Log out: use the avatar menu in the top-right corner. This clears the session from your browser.

We respond to requests within 15 business days.

All traffic to the site is encrypted with HTTPS. Sign-in codes work once and then expire, and only people who need it to maintain the site can access account data. No system is perfectly secure; if an incident affects your information, we'll notify you promptly.

MCP Field is built for developers and isn't directed at children under 14. If we learn we've collected a child's information without a guardian's consent, we'll delete it promptly.

We may update this policy as the site changes. We'll change the effective date at the top of this page, and highlight significant changes that affect your rights on the site.

If you have any questions about this policy or your personal information, email [email protected].