Effective date: 14 November 2026
This privacy policy explains how PT Billion Jaya Group ("HostedMCP", "we", "us") collects, uses and protects personal data when you use hostedmcp.org, its API, its MCP endpoint and its README badges (together, the "Service"). We are the controller of the personal data described here, within the meaning of the EU and UK General Data Protection Regulation (GDPR) and Indonesia's Personal Data Protection Law (Law No. 27 of 2022).
In short: you can use the Service without an account, we do not run advertising, we use Google Analytics only if you accept it, and when you sign in we keep only what we need to run your account.
1. Data we collect
When you browse or call the API. You do not need an account to use the directory, search, API, MCP endpoint or badges. Our servers process the technical information needed to deliver each request and protect the Service: your IP address, browser or client type, the address requested and the time. This information is kept in short-lived logs for security and troubleshooting and is deleted automatically after 7 days. Your IP address is also used, without being stored, to apply rate limits.
When you sign in with GitHub. Signing in is only required to submit a repository or claim a listing. GitHub shares the following with us, and we store it:
- your GitHub user ID, username, display name and profile image URL,
- your primary email address, which is never displayed on the Service,
- a GitHub access token, stored encrypted, used only to confirm that you maintain a repository when you claim its listing.
We also keep a record of the repositories you submit, the listings you claim and the evidence of maintainership you provide.
When you contact us. If you email us, we keep your message and address to answer you and to keep a record of takedown and data requests.
Public data about maintainers. Listings show information that project maintainers have already published on GitHub, npm, PyPI and the MCP Registry, such as a GitHub username, profile image and repository details. We process it to describe the projects in the directory. You can ask us to correct or remove it at any time (section 7).
2. How we use data, and why
| Purpose | Data | Legal basis |
|---|---|---|
| Delivering pages, the API and the MCP endpoint, and keeping them secure | Request logs, IP address | Legitimate interest in running a secure service |
| Running your account, submissions and claims | Account data, GitHub token, submissions, claims | Performance of our agreement with you |
| Describing projects in the directory | Public maintainer information | Legitimate interest in an accurate public directory |
| Answering your messages and handling takedowns | Email and its content | Legitimate interest, or a legal obligation where one applies |
| Counting visits and learning which pages are useful, only if you accept analytics | Pseudonymous cookie identifiers, pages viewed, approximate location, device and browser type | Your consent, which you can withdraw at any time |
We do not sell or rent personal data, use it for advertising or profiling, or send marketing email.
3. Cookies and storage on your device
When you sign in, we set one session cookie that keeps you signed in. It is marked HttpOnly and Secure and expires after 30 days. It is strictly necessary. The language of the site follows the address, not a cookie.
Analytics, only with your consent. On your first visit a banner asks whether you accept analytics. Nothing from Google is loaded until you accept. If you accept, Google Analytics sets the _ga cookies, which last up to 13 months, to count visits and show us which pages are used. Google Analytics does not log or store IP addresses, and we have turned off advertising features and data sharing for ads. If you reject, no analytics cookie is set. You can change your choice at any time with "Cookie settings" at the bottom of every page; withdrawing removes the _ga cookies.
Your browser also remembers three things in its local storage, on your device only: your analytics choice, the client you chose for install commands and your last few searches. They are never sent to us, and you can clear them by clearing site data in your browser.
4. Automated processing of listing content
Listing summaries, descriptions, FAQs and translations are written with automated tools, including AI language models, using only public project content such as READMEs, manifests and package metadata. Our automated checks read the same public sources and send one handshake request to the public endpoint of hosted servers. No account data, email address, session, token or visitor information is used for any of this. None of it produces decisions that have legal or similarly significant effects on you.
5. Service providers and transfers
We share personal data only with providers that help us operate the Service, under terms that limit their use of it to providing their service to us:
| Category | Purpose | Data involved |
|---|---|---|
| Hosting and infrastructure | Hosting, databases, storage, security, backups and email routing | Request logs and stored account data |
| GitHub | Sign-in and maintainer verification | Your sign-in, under GitHub's own privacy policy |
| AI service providers | Writing and translating listing text | Public project content only |
| Google (Google Analytics) | Visit statistics, only if you accept analytics | Cookie identifiers and usage data, under Google's data processing terms |
These providers may process data in countries other than yours, including the United States and the European Union. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses. We may also disclose data when the law requires it, or to protect the Service, our users or the public from fraud or abuse.
6. How long we keep data
| Data | Kept for |
|---|---|
| Request logs | 7 days |
| Account data, submissions and claims | Until you delete your account |
| Session cookie | 30 days, or until you sign out |
| Analytics cookies and analytics data | Cookies up to 13 months; visit data in Google Analytics up to 14 months |
| Emails about takedowns and data requests | Up to 3 years, to show how a request was handled |
| Database backups | Up to 30 days |
When you delete your account, your account record, sessions and GitHub token are deleted immediately, your claims are removed and the listings you claimed are released. Repositories you submitted stay in the directory with your account details removed. Deleted data may remain in a backup until the backup expires; deleted accounts are never restored from backups.
7. Your rights
Depending on where you live, you have the right to access your personal data, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw any consent you gave. You can:
- delete your account at any time from your account page, with immediate effect,
- revoke our access to your GitHub account in GitHub under Settings, Applications,
- ask us to correct or remove public information about you in a listing through the takedown process,
- email legal@hostedmcp.org for a copy of your data, a correction or any other request.
We answer within 30 days, and we may ask you to confirm your identity first. You may also lodge a complaint with your local data protection authority; in Indonesia, that is the authority responsible under the Personal Data Protection Law.
8. Security
We protect personal data with encryption in transit, encrypted storage of access tokens, administrative access limited to authorised staff behind single sign-on, and regular backups. No method of transmission or storage is completely secure. If a breach affects your personal data, we will notify you and the competent authorities as the law requires.
9. Children
The Service is meant for software developers and is not directed to children. GitHub requires account holders to be at least 13 years old, and we do not knowingly collect personal data from children below the age of digital consent in their country. If you believe a child has given us personal data, email us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. The effective date at the top shows the current version. If a change materially affects how we use data we already hold, we will announce it on the Service before it takes effect.
11. Contact
For questions about this policy or your personal data, write to us at legal@hostedmcp.org. We answer in English and Indonesian.