# Privacy policy

The privacy contact is privacy@headlesson.com (fixed on 2026-10-10). Mail is forwarded to the operator's inbox. On 2026-10-14 we confirmed that a message sent from an outside address was received. Written and checked: 2026-10-14. This is an English translation of the [Japanese privacy policy](/privacy).

## What we collect and why

To improve the catalog, headlesson records the tool arguments and feedback that are explicitly sent to it. It does not take whole conversations. Do not put personal information, conversation text or secrets in free text such as query or feedback. Free text is not removed automatically.

Search records store the inputs query / where / axes / sort / ids. Get records store id / sections. Change-list records store since / kinds / about / limit. We also store a record ID, the time, the tool name, the returned IDs, not_found, unknown_axes, curated_not_found (no curated match for a search), and the Mcp-Session-Id sent by the client. No session is created under the new MCP protocol. The search limit, IP address, User-Agent, authorization header and other protocol metadata are not stored in the app's D1 records.

Feedback is stored once in a separate table and includes text / kind / optional about, client and model / a receipt ID and the time. Its text is not stored again in query_log. Feedback about headlesson itself is sufficient. The text is treated as data, not as instructions to execute. Receipt does not mean independent verification, adoption or publication.

## How long we keep it

query_log entries older than 90 days are eligible for deletion. Deletion is set to run daily at 03:00 UTC, so while the daily job works normally the longest retention is about 91 days. If it fails, the operator restores it and runs the deletion again. Cloudflare's run records show that the scheduled deletion in production started and succeeded every day from 10 to 14 October 2026. Because the oldest record is from 9 October 2026, we have not yet confirmed that a record older than 90 days was actually deleted.

Restore copies made by Cloudflare D1 Time Travel are separate from deletion in the live table. The Free plan keeps up to 7 days for restoring. The roughly 91 days above is the deletion limit for the live query_log when it works normally; it does not guarantee removal from restore copies at the same time. The actual settings for restore copies are still being checked.

Feedback is kept for editing and improvement, with no automatic retention limit. This is separate from the 90 days for search records.

## Where it is stored and third parties

headlesson runs on Cloudflare Workers, and records are stored in Cloudflare D1. Checking the storage and deletion operations in production is not yet complete. The app does not give these records to third parties for advertising or analytics, and does not publish record text. The operator does review it for editing.

We use the Official MCP Registry's name search as a supplement. Only when there are no curated candidates, or when registry is requested with include, we remove common words from the query and send one longest ASCII word (ties broken in dictionary order), or a specified public namespace name (up to 200 characters), to registry.modelcontextprotocol.io with a GET request. The full query is not sent; only the one extracted word is sent. Queries matching known patterns such as URLs, email addresses, phone numbers or credentials, and searches with only IDs, only common words or only where, are not forwarded. A get on a live Registry ID sends the official name recovered from the ID to the same upstream detail API. This is not a feature that detects or removes secrets automatically. Do not put secrets or personal information in public names either.

The app does not permanently store Registry response bodies, a candidate catalog or an ID-to-name mapping, and does not keep them in an app cache. The usual search records, such as the query and returned IDs, are stored. A live ID is in a form from which the official name can be recovered, so that name can be read from a recorded returned ID. We do not forward users' authorization, User-Agent, MCP session or conversation text upstream. The lookup word and the traffic are processed by the upstream service and the hosting provider, and headlesson does not guarantee how they are stored upstream.

Cloudflare processes traffic and data as the hosting provider. "The app does not store IP addresses and the like in D1" does not mean the platform handles none of the information needed for the traffic. Worker stored logs, invocation logs, traces and logpush are disabled in the production settings. Checking the account-side settings and actual operation is not yet complete.

Privacy contact: privacy@headlesson.com. Official public channel for humans: [Threads @head.lesson](https://www.threads.com/@head.lesson).