Privacy note: no cookies, no accounts, no tracking

In short

• No cookies, no fingerprinting, no advertising, no social media embeds.
• No personal information is collected, sold, shared with advertisers or used for profiling.
• Fonts, scripts and styles are served from this site; your browser contacts no third party to render a page.
• The one thing stored in your browser is your colour theme, and only if you choose one. It never leaves your device.
• Nothing is scanned on a visitor's request. Scanning is a scheduled backend job over the public metadata of listed servers; it involves no data about you.

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

Hosting and delivery

The site is a set of static files served by Bunny.net (BunnyWay d.o.o., Ljubljana, Slovenia) from a storage zone in the EU. To deliver a page, its servers necessarily process your IP address, the requested address, the time, and the browser identification your browser sends. Bunny.net processes this on our behalf under a data processing agreement and may keep it in short-lived technical logs for security and operation. We do not use it to identify or profile visitors.

Legal basis: our legitimate interest in delivering the site securely (Art. 6 (1) (f) GDPR).

Analytics

We count visits with Plausible Analytics (Plausible Insights OÜ, Tartu, Estonia), which is built to work without cookies or personal data and stores its data in the EU. It records, per page view:

• Page address, to see which pages are read and how often.
• Referring site, to see where readers come from.
• Browser and operating system, by name only, read from the browser identification, which is then discarded.
• Device type, derived from the window width, which is then discarded.
• Country, looked up from the IP address, which is then discarded.

To count unique visitors per day without a cookie, Plausible combines the IP address and browser identification with a salt that changes every 24 hours and keeps only the resulting hash; the salt is deleted, so a visitor cannot be recognised the next day or across sites. IP addresses are never stored. The statistics are aggregate and nobody can trace them back to you.

Legal basis: our legitimate interest in knowing which pages are useful (Art. 6 (1) (f) GDPR). Because nothing is stored on or read from your device, no consent is needed under § 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG).

What your browser stores

If you use the theme switch, the choice (light or dark) is saved in your browser's local storage under the key theme so the next page opens in the same theme. It is never sent to us or anyone else. You can delete it at any time in your browser's site data settings. Storing it is strictly necessary for a function you asked for (§ 25 (2) no. 2 TDDDG).

Pages read fully without JavaScript; nothing else is stored.

Scanning of MCP servers

letsauth does not scan anything on a visitor's request, and there is no form that triggers a scan. A scheduled job on the project's own backend (Scaleway, EU region) reads, once a night, the public metadata of the MCP servers listed in the atlas (the documents a server publishes for any client to read), with no credentials and without starting any authorization flow. Its findings are published as data in the public repository. This job processes technical data about services, not personal data about visitors. Server maintainers can ask for their server to be withdrawn; see how to contribute.

Contributions and GitHub

Corrections and new data go through issues and pull requests on GitHub (GitHub, Inc., USA). When you contribute there, GitHub's privacy statement applies. The handle you give in an observation (observedBy) becomes part of the public dataset under CC BY 4.0, which requires attribution. If you want it removed, write to us and we will act on your request under Art. 17 GDPR; copies in the public history of the repository or made by others may remain.

Links to GitHub and to specification publishers are plain links; nothing is loaded from them until you follow one.

Email

If you write to us, we use your address and message only to answer you, and delete them when the conversation is over unless the law requires us to keep them. Legal basis: Art. 6 (1) (f) GDPR, or Art. 6 (1) (b) GDPR where your message is about a contract.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have it corrected (Art. 16) or erased (Art. 17);
• restrict its processing (Art. 18) and receive it in a portable format (Art. 20);
• object to processing based on legitimate interest (Art. 21).

Write to letsauth@janbrennenstuhl.eu. You can also complain to a data protection authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

Changes

When the site starts processing data in a new way, this note changes first. Its history is public in the repository.

Last updated 14 October 2026