Privacy Policy

1. The short version

agent-tools.cloud is a public directory. Browsing it, searching it and calling its API need no account, and there are no tracking cookies. An account exists only for one purpose: letting the operator of a listed service correct their own entry. Everything we store about you comes from that, and it is listed below. We collect only the minimal technical data needed to run the service, measure aggregate traffic, and keep it secure. We do not sell data and we do not run third-party advertising trackers.

2. What we collect

• Server logs — standard web-server records: IP address, timestamp, requested URL, status code, referrer and user-agent. Used for operations, security, abuse prevention and aggregate traffic statistics.
• Page-view counts — when a real browser opens a service detail page, a small script records that the page was viewed (page type, slug, referrer, IP, user-agent). This measures which listings people find useful. Automated agents that don't run scripts are not counted.
• Rate-limit counters — short-lived per-IP counters to prevent abuse of the API.
• Account records, only if you create one — signing in with GitHub stores your GitHub numeric id and login; minting an API key instead stores only a random identifier. Either way we also store the hostnames you have proved you control. A session cookie (atc_session) keeps a browser signed in; it is not used for tracking and is never sent to third parties.
• API keys — we store a SHA-256 hash of the key, never the key itself, alongside a short non-secret prefix and the times it was created and last used.
• Edit history — when you change a listing you control, we record the field, its old and new value, your account and the time. This record is public on the listing page: it is what makes self-service editing safe to offer.
• A contact address, only if you give one — optional when you submit a service or claim a host, and used only to reach you about that listing. We do not verify it and we do not use it for anything else.

3. What we do not collect

No passwords — browser sign-in is delegated to GitHub, and an API key is only ever stored as a hash. No tracking or advertising cookies, no cross-site profiling, no sale of personal data. We don't ask for personal information to use the directory, and an account on its own grants nothing: the right to edit a listing comes only from proving control of the domain that serves it.

4. Cloudflare

The site is served through Cloudflare, which processes requests as a CDN and security layer and may log technical request data on our behalf. See Cloudflare's privacy documentation for details on their edge processing.

5. Retention

Logs and view records are kept only as long as useful for operations, security and trend analysis, then rotated or aggregated. We don't build long-term profiles of individuals. Edit history is different: it is part of a listing's public record and stays for as long as the listing does.

When we approve a privacy erasure request, we remove the listing, its submitted URLs, ownership claim and linked crawl or measurement records. We retain only keyed, non-reversible digests needed to stop automated sources from recreating the erased listing.

6. Third-party services

When you connect to a service listed in the directory, that interaction is governed by that third party's own privacy practices, not ours. We are only the catalogue.

7. Contact

Privacy questions or data requests: [email protected].