Privacy Policy
Edition 1.4, in force from .
1. Who is responsible
The controller of your personal data is the operator of plug.directory (imprint). Iceland is part of the European Economic Area, so the General Data Protection Regulation (EU) 2016/679 ("GDPR") applies to us directly. Write to [email protected] about anything in this policy.
2. What we process, why, and for how long
| What | Data | Why, and the legal basis | Kept |
|---|---|---|---|
| The directory | Public facts about server publishers: the namespace or account name in a server's registry name, a publisher's display name, links to the repository and website the publisher gave, and the contact channels a project published (section 3). | To run a public directory of MCP servers. Legitimate interest (GDPR Art. 6(1)(f)): people who want to find and install a server need to know who publishes it. See section 3. | While the server is listed. A server removed from the registry is hidden at our next sync, and its data is deleted within 30 days. A contact its source no longer publishes goes after two reads; a contact we keep for ourselves goes at the latest 12 months after we last saw it. |
| Reports | What you write in the report form: the address, your explanation, your name and e-mail address (optional for a report about illegal content), and the time. | To handle the report, tell you the outcome and keep a record of how we handled it. Legal obligation (Art. 6(1)(c)) under Articles 16 and 17 of the Digital Services Act where it applies, and legitimate interest (Art. 6(1)(f)) otherwise. | 3 years after the report is closed. |
| Adding a server | What you give in the Add my server form: the address of your server's repository or website, your e-mail address, and the time. | To send you the widget for your server and to tell you when it is in the directory, as you asked. Steps taken at your request (Art. 6(1)(b)). | Your e-mail address: while the server is in the directory through the form, or 30 days if it never gets there. The record of each mail we sent you: 30 days. |
| Mail to us | Your address, name and what you write. | To answer you. Legitimate interest (Art. 6(1)(f)). | As long as the matter needs, and no longer than 3 years after it is closed. |
| Measurement, only if you accept | Google Analytics cookies, the pages you view, the kind of device and browser, an approximate country, and how you reached us. | To count visits and see which pages and servers people use. Your consent (Art. 6(1)(a), and Art. 5(3) of the ePrivacy Directive 2002/58/EC). See section 5. | 14 months. |
| Your cookie choice | Whether you accepted measurement, when, which version of the cookie list and of this policy you saw, the language of the page, and a random number that ties your choice to our record of it. Not your IP address and not your browser. | To respect your choice and be able to show it was made (Art. 6(1)(c) with Art. 7(1)). It is kept in a cookie in your browser and as a record on our server. | The cookie 6 months, then we ask again; our record 3 years after your last choice. |
| Counts of what people do | A daily total per server and client of a few actions, such as copying an install config or opening a repository. Nothing about who did it: no IP address, browser, cookie or session. | To see which servers people install, whether or not they accept measurement. These totals are not personal data; the request that adds to them is handled like any other request (technical logs). | Kept as totals. |
| Technical logs | The address of each request, its time and result, your IP address and browser type, as our server and Cloudflare receive them. | To deliver the site, keep it secure and find faults. Legitimate interest (Art. 6(1)(f)). | No longer than 14 days. |
We do not ask for and do not need any other personal data. You can read the whole site without giving us any.
3. If you publish an MCP server
This section is the notice Article 14 of the GDPR requires when data is not collected from you.
When you publish a server to the Official MCP Registry (registry.modelcontextprotocol.io), the entry is public. We copy it to list your server: the server's name, which may contain your account name, your display name if you gave one, the description, and the links to your repository and website. To help people who move off Smithery, we also read the public server names on Smithery's list and match them to registry entries; we keep only those names and the match, nothing else Smithery wrote.
To help people reach the people behind a server, its page shows the channels the project published for that: its issue tracker and discussions, its security policy, security contact and vulnerability reporting, its contact links and contact page, its website, the social accounts on its own profile or site, its funding links and its code-host profile, each with the place we read it. An e-mail address is shown only when it is a shared mailbox (such as security@ or support@) that the project published on its own site, in its security.txt or SECURITY.md, or on its organisation's GitHub profile, and it is never written into the page's HTML, our API or our data export. We read these from GitHub, npm, PyPI and the project's own website, slowly, following each site's robots.txt and stopping at any bot check.
We also keep, for ourselves only, the contact details a project or its maintainers made public in those same places: the public e-mail address on a GitHub profile, the author, maintainer and contributor addresses in npm and PyPI package data, the addresses and contact pages on the project's own site and in its security.txt or SECURITY.md, and social accounts. We keep them to be able to reach a project about its listing, for example about a security finding or a correction. They are never shown or published, never sold or given to anyone, and never used to send unsolicited mail. They are encrypted and readable only by our own background jobs. Each one is deleted when its source stops publishing it, when the server leaves the directory, when you object, and in any case 12 months after we last saw it. We never collect an e-mail address from commits, patches, issues or comments, nothing behind a login, and we never guess an address.
Our legitimate interest, and that of the people who use the directory, is to find, compare and install servers, and to know who publishes them. We weighed it against yours: the data is already public by your own choice, it is limited to what identifies the publisher of a server, and it is shown only in that context. You may object at any time (Art. 21) through the report form or by mail; we then hide the field that names you within 72 hours unless we have compelling reasons to keep showing it, and answer within one month. For a contact, "Fix or remove" under a server's contacts opens that form; a report that names the contact hides it, deletes what we keep of it, and keeps us from collecting it again.
4. Who else receives data
| Recipient | What for | Where |
|---|---|---|
| Coolhousing, our hosting provider | The server the site and its database run on. | Prague, Czech Republic (EU). |
| Cloudflare | Delivering the site: DNS, encryption in transit, caching and protection from attacks. | A global network. A transfer outside the EEA is covered by the standard contractual clauses in Cloudflare's data processing terms. |
| Proton | Our mailbox, for mail you send us and our replies. | Switzerland, which the European Commission considers to give adequate protection. |
| Google Ireland Limited (Google Analytics), only if you accept measurement | Counting visits, as our processor. | Google's servers. A transfer to the United States is covered by the EU-US Data Privacy Framework, with the standard contractual clauses in Google's data processing terms as a fallback. |
Each provider acts on our behalf under its data processing terms. We sell no personal data and share none for advertising. We disclose data to an authority only when the law obliges us to.
5. Cookies and measurement
On your first visit a banner offers "Accept all", "Reject all" and "Settings", equal in size and weight. Until you accept, no measurement script loads and no request goes to Google. If you accept, Google Analytics sets its cookies; Google signals and advertising features are off and Google does not log or store IP addresses for this service. You can change your choice at any time from "Cookie settings" at the bottom of every page; withdrawing stops measurement at once and deletes its cookies. The cookies are listed in the Cookie Policy.
6. Your rights
You may ask for access to your data, its correction or erasure, a restriction of processing and a copy in a portable form, and you may object to processing based on legitimate interest (GDPR Arts. 15 to 21). Where we rely on your consent you may withdraw it at any time, as easily as you gave it; this does not affect what was done before. Write to [email protected]; we answer within one month.
You may complain to a supervisory authority, in particular Persónuvernd, the Icelandic Data Protection Authority (Laugavegur 166, 105 Reykjavík, Iceland, [email protected]), or the authority of the country where you live or work.
7. No automated decisions about people
What we show is about software, not about people. We make no decision based solely on automated processing that has legal or similarly significant effects on you (GDPR Art. 22).
8. Security
Data travels encrypted. The site runs in its own isolated containers with its own database, separated from other systems on the same server; only the operator can reach them, and backups are encrypted.
9. Children
The site is not aimed at children, and we do not knowingly collect data about them.
10. Changes
We may change this policy. Each version carries an edition number and a date. If a change affects how we use data we already hold, we will say so on the site before it applies.
11. Edition history
Edition 1.4, 31 October 2026: the contacts on server pages, the contact details we keep for ourselves, and how to have either removed (sections 2 and 3).
Edition 1.0: first edition.