What we can't see.

The extension stores your installed tool packages, the revocation (safety) list, and the known-domains list in on-device browser storage (chrome.storage.local). It never uses chrome.storage.sync, so nothing leaves your device through Chrome sync.

Loading a page with the extension installed makes no network requests. Every URL is matched locally against that on-device storage.

The only contact with webmcp.today is:

• anonymous GET requests when you install a package, to download its definition from the registry, and
• periodic fetches of the global revocation list and the known-domains list, so packages reported as broken or abusive get disabled on your device.

Those requests carry no account, identifier, cookies, or browsing data. The extension has no analytics, telemetry, or error reporting. The one thing the requests can't hide is your IP address, which our hosting provider's servers see, as any web server does (see the processor list below).

When an AI agent runs one of your installed tools on a page, the request goes from the page to that same site, using your own existing session with it. The data goes from the site to itself, never to us. We cannot see which sites you visit or which tools you run.

Sign-in is GitHub OAuth or email and password. The site stores the profile GitHub hands over (name, email, avatar) and your session, kept alive by the only cookie the site sets. If you sign in with GitHub, GitHub handles that sign-in under its own privacy policy. The service isn't directed at children under 13, and GitHub sign-in requires you to be at least 13.

Publishing a package stores the package itself and its association with your account. Published packages are public and offered to everyone under CC0. See the terms for what that means. Installing a package records an install row on your account, which is how the site serves you your pinned versions.

We store all of this to run the service for you, which is the legal basis for processing it. Account data is kept until you ask us to delete it.

The website also uses Vercel Web Analytics to understand aggregate website traffic. It is cookie-free and uses anonymized data. It applies to the website's deployed hosts, including Vercel Preview deployments. The extension does not use it or send analytics, telemetry, error reports, browsing history, page contents, or per-URL activity.

The service uses these processors:

• Vercel (hosting and website-only Web Analytics). Its servers log IP addresses, as any web server does.
• Neon (database).
• Sentry (error monitoring, web app only, not in the extension). An error report can include your IP address, browser, and the page that failed.

All three are US companies, so if you're in the EU or UK your data is processed in the US.

The extension sends us no browsing history, page contents, or per-URL activity. We do not sell or share your personal information. Vercel, Neon, and Sentry process website data as described above. GitHub handles GitHub sign-in under its own privacy policy. The extension sends data only as described in section 1.

You can ask to see, correct, export, or delete the data tied to your account by emailing the address below. Deleting your account removes your profile, sessions, and install pins. Published packages are public under CC0 and stay public (see the terms).

If you're in the EU or UK, you also have the right to object to processing and to complain to your local data protection authority.

The date at the top is the version you're reading, and every edit is visible in the repository's public history. Material changes also get called out at the top of this page. If the extension's behavior ever changes in a way this page doesn't cover, this page changes first.

WebMCP Today is run by one person, the maintainer of the GitHub repository, not a company.

Email privacy@webmcp.today for anything about your data, or open an issue on the repository for anything that isn't personal.