Privacy

What we collect

Only two things ever leave your browser or your terminal to our servers:

• The MCP server URL you ask us to scan. Public endpoints only. We never scan anything behind a login.
• Your email, only if you explicitly click Watch on a report, or submit the early-access form on a blog or docs page (we also store which page the form was on). Nothing on the /scan form is submitted before you press a button.

We do not run analytics, trackers, third-party scripts, or session recorders on this site. No cookies beyond what Vercel serves for routing.

Where it is stored

Both items go into Vercel KV (a hosted Redis). The region is EU-West. We keep scan reports for 90 days and emails on the watch list for 365 days, then both are purged automatically.

Who sees it

Sarah Vogel (the founder). No employees, no shared access, no third-party processors beyond the infrastructure vendors needed to run the site (Vercel for hosting, Upstash for KV storage). We do not share your email with anyone, do not sell it and will not ever.

Unsubscribe

Every email we send carries a one-click unsubscribe link in the footer. After clicking, your address is marked permanently and we cannot re-add you. If you want your record deleted entirely instead of just flagged, email hello@patchbay-mcp.dev and we will purge it within 7 days.

GDPR requests

You have the right to request a copy of what we store about you, correction, or deletion. Email hello@patchbay-mcp.dev. We will respond within 30 days.

The scan itself

Running a scan sends one HTTP request chain to the target MCP endpoint. Patchbay does not attempt to exploit, tool-call, or exfiltrate anything. It reads tools/list, probes for OAuth metadata and inspects headers. Nothing destructive.