Privacy Policy

This policy explains how SaaSquatch Lab LLC ("we", "us") handles personal information when you use Squatch MCP, including the website, the REST API and the Squatch MCP server (together, the "Service"). We collect as little as we can, and we do not sell or share personal information for advertising.

Information we collect

When you create an account

• Your email address, and if you sign in with GitHub or Google, your account identifier, username and verified email from that provider.
• If you sign in with GitHub to claim servers, an OAuth access token with read-only scopes (profile, email, organization membership). We encrypt it at rest and use it only to check repository and organization ownership you ask us to verify.
• Your settings, watchlist and notification preferences.

When you verify your identity or organization

Identity verification is performed by our verification provider. We receive the result (verified or not), the date and minimal attributes such as the issuing country. We do not receive or store images of your documents or your date of birth.

When you publish or claim a server

Publisher details, domain and repository verification records, privacy disclosures and responses to findings. These are shown publicly on the server's page, labelled as publisher declared.

When you pay

Payments are processed by Stripe. We receive your billing status and the last digits and brand of your card, never the full number.

Automatically

• Security and operational logs (request time, path, status, and a request identifier) to keep the Service reliable and to investigate abuse.
• Product analytics events such as searches and page views, linked either to your account or to an anonymous identifier derived from a daily-rotating salted hash. We do not store raw IP addresses in analytics.

Cookies and local storage

We use strictly necessary cookies to keep you signed in and to protect sign-in flows, and local storage to remember your color theme. We do not use advertising or cross-site tracking cookies.

How we use information

• To provide the Service: accounts, watchlists, alerts, scans, publisher claims and verification.
• To send service emails you asked for, such as sign-in links and change alerts.
• To secure the Service, prevent abuse and enforce our Terms.
• To understand aggregate usage and improve the product.
• To meet legal obligations.

Information about MCP servers

Server listings come from the Official MCP Registry, from publishers and from our scanner. Scans read metadata that servers publish openly and never send your data to those servers. If a listing contains personal information about you and you want it corrected or removed, contact us.

Service providers

We use providers to run the Service, bound by contracts that limit their use of data: hosting and database (Vercel, Supabase), email delivery (Resend), payments (Stripe) and identity verification (Didit or Stripe Identity). Data may be processed in the United States.

Retention

We keep account data while your account is active and delete or anonymize it within 30 days after you delete your account, except where we must keep records for legal, security or billing reasons. Public change history and audit records about servers are retained because they are part of the public record of a server.

Your choices and rights

You can access, correct, export or delete your personal information, and withdraw consent where we rely on it. Depending on where you live (for example California, Oregon or the EU/UK) you may have additional rights. Email privacy@squatchmcp.com; we will respond within the time the law requires and will not discriminate against you for exercising your rights.

Security

We use encryption in transit and at rest, row-level access controls, a strict Content Security Policy and least-privilege access. See Security for details. No system is perfectly secure; we will notify you of a breach as required by law.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

Changes

We will post updates here and, for material changes, notify account holders by email before they take effect.

Contact

SaaSquatch Lab LLC, Oregon, USA. privacy@squatchmcp.com