Privacy
The public registry is readable without an account, and we built it to stay quiet: no advertising trackers, no third-party analytics scripts, no fonts loaded from CDNs, and no cookies on public pages.
What the public site collects
- Server logs. Standard web-server request logs (IP address, user agent, requested path) for security and abuse prevention, with a bounded retention period.
- Interaction events. The events marked “sent to us” below are transmitted to our own first-party endpoint on this domain and stored in our server logs, self-hosted, never a third party. The rest go to your own browser console only. If your browser sends the Do Not Track signal, nothing is transmitted or recorded at all. We honor it in the browser and again on the server.
- Security policy violations. If your browser blocks something on this site for violating our Content Security Policy, it sends us a short automatic report: the page it happened on, what was blocked, which rule blocked it, and how the report was delivered: which of the two standard reporting mechanisms was used, and the content type it was labelled with. This is how we find out about attempted script injection. It is not analytics, carries no identifier, and is not covered by the Do Not Track signal above. Turning it off would only hide attacks from us. We rate-limit these reports and never store your IP address with them.
Every analytics event, enumerated
| Event | When | Payload | Sent to us? |
|---|---|---|---|
| ui.page_view | Navigating to any page | the path visited (no query string), per-page-load correlation id | Yes (self-hosted) |
| ui.scanner_toggled | Toggling a scanner chip in “Your view” on a server page | scanner name, on/off, resulting selection, server id, per-page-load correlation id | Yes (self-hosted) |
| ui.registry_filter_changed | Changing a registry filter (keyword, author, badge, min score) | the resulting filter query string, per-page-load correlation id | Yes (self-hosted) |
| tier_upgrade_initiated | Starting a paid-plan upgrade (checkout) | the plan you're moving from and to and the billing cadence (monthly/annual), never an amount or payment id | Yes (self-hosted) |
| tier_upgrade_completed | Returning from a completed upgrade checkout | the plan moved from and to, and the billing cadence | Yes (self-hosted) |
| trial_started | A free trial of a paid plan begins | the plan the trial is for, and the billing cadence | Yes (self-hosted) |
| trial_conversion | Confirming/keeping a plan when a trial ends | the plan moved from and to, and the billing cadence | Yes (self-hosted) |
| trial_expired_no_conversion | A trial ends without being kept | the plan the expired trial was for (no destination plan) | Yes (self-hosted) |
| skill_pack_added | Adding a skill pack to a plan | the plan and the number of skill packs added (never their contents) | Yes (self-hosted) |
| skill_pack_removed | Removing a skill pack from a plan | the plan and the number of skill packs removed (never their contents) | Yes (self-hosted) |
| downgrade_initiated | Starting a move to a lower plan (or cancellation) | the plan you're moving from and to | Yes (self-hosted) |
| downgrade_completed | A move to a lower plan takes effect | the plan moved from and to | Yes (self-hosted) |
| onboarding.completed | Saving the optional first-sign-in demographics step | which optional fields were filled (booleans + a count only, never the values), per-page-load correlation id | No, browser console only |
| onboarding.skipped | Skipping the optional first-sign-in demographics step | per-page-load correlation id only (no field data) | No, browser console only |
The correlation id is a random value generated per page load, never stored, and never linked to an identity. No event contains page content, form input, or anything typed into a filter beyond the filter state itself.
What the command-line tool sends
- Install telemetry. nerlo install reports three things to a first-party endpoint on our own domain: a hashed installer token, which runtime you installed into, and the version of the CLI. The request carries no account credentials, and the tool prints a notice saying so the first time it runs.
- Nothing else does. Searching, inspecting a scorecard, checking a project in CI, submitting a repository, and asking the tool its version all send no telemetry.
- Turning it off. Set NERLO_TELEMETRY=0 in your environment, or put telemetry=false in ~/.nerlo/config. The environment variable is the one to use in CI: it works on the very first run, before any config file exists. Full instructions are on the CLI install and upgrade page.
What we never do
- No third-party trackers, ad pixels, or fingerprinting.
- No selling or sharing of usage data.
- No engagement-derived trust signals: install counts and favourites are display-only and never feed a badge or ranking.
Registry data about MCP servers (names, repositories, scan results) is public information about published software, maintained under our records-of-processing documentation. Account features, when they ship, will get their own section here before launch.