Privacy

Short version: we collect the minimum we need to run a directory, ship a newsletter, and keep the comments civil. We do not sell your data and we do not run third-party ad trackers.

What we store

• Email, name and avatar — when you sign in, we keep your verified email address and the name and profile image from your sign-in account, linked to your Cloudsteading account. When you subscribe to the digest we store your email. Stored in our Cloudflare D1 database.
• Listings, votes, and comments — anything you publish on the site is stored against your account.
• Submission drafts — saved server-side so you can resume them.
• Audit log — moderation actions on your listings (approve, feature, delete) are logged for accountability.
• Coarse request metadata — IP address, user-agent, and request timing. Cloudflare retains its own server logs as part of running the edge.

What we do not store

• No third-party ad pixels (no Meta, Google Ads, LinkedIn, TikTok, etc.).
• No cross-site behavioural tracking.
• No passwords — we never see or store a password. Sign-in is handled by Clerk (below).

Why we use what we use

• Clerk — hosts sign-in (social accounts or email). Clerk processes the account details you sign in with, plus session and device information needed to keep you signed in and to protect accounts from abuse.
• Cloudflare (Workers, D1, KV, R2, Workers AI) — the entire platform runs here. Data is stored in Cloudflare's regions.
• Email delivery — the weekly digest is sent through a transactional email provider. They process your email address only to deliver.
• GitHub API — when you submit a listing, we call the public GitHub API to verify the repo exists and is public. We do not import private code.

Cloudsteading plugin and MCP

The free Cloudsteading plugin, operated by Flindev, receives the tool arguments sent by your client: a software search query and pagination settings, or a project identifier. We process these to return public catalog information and setup references. The MCP does not require a Cloudsteading account or your Cloudflare credentials.

The MCP application does not save search queries or setup requests to its databases or deliberately log request bodies. Cloudflare processes request metadata and operational logs to host the service. This is separate from any conversation history or data processing by ChatGPT or another client, which is governed by that provider's policies. Do not include secrets or private account information in search queries.

For privacy questions about plugin requests, contacthello@cloudsteading.com.

Plugin retention and controls

Search queries and project identifiers are processed for the duration of the request; the MCP application does not retain a query history after responding. Our enabled Cloudflare Workers Logs can retain invocation and error logs for up to seven days, as described in Cloudflare's logging documentation. Cloudflare may separately process service and security data under its own policies.

Tool arguments are used only to answer the requested catalog search or project lookup. They are not sold or used by Cloudsteading for advertising or model training. Cloudflare processes requests as our infrastructure provider; the requesting client receives the public result. The MCP does not request your full conversation or access your private accounts. Website sign-in and analytics are separate from MCP requests.

You can stop sending requests or disconnect Cloudsteading in your client's plugin settings at any time. For access, correction or deletion requests concerning data we control, email hello@cloudsteading.com. We do not have a retained MCP query history to export or delete. Manage ChatGPT conversation history separately in ChatGPT.

Cookies

We set a first-party session cookie when you sign in. If you choose to allow analytics, Google Analytics also sets first-party cookies to measure visits to public pages. We store your analytics choice in your browser. Declining analytics does not affect access to the site.

Analytics helps us understand which projects and articles people discover. Google processes usage information, such as public page paths, page titles, browser and device information. Our page-view events exclude query strings, URL fragments and private account routes. We do not send your account email, name, sign-in tokens or user ID, and advertising features are disabled.

See Google's privacy policyfor information about its processing. You can change your choice below.

Your data, your call

• Export — email us and we will send your account contents as JSON.
• Delete — email us and we will remove your account and any listings you authored. Approved listings may be retained in anonymised form (writeup + costs) if they have community engagement attached.
• Unsubscribe — every digest email has a one-click unsubscribe.

Children

Cloudsteading is not directed at children under 16. If you are under 16, please do not submit listings or sign up for the newsletter.

Changes

Material changes to this policy will be announced on theblog.

Contact

Privacy questions, deletion requests, or anything else — emailhello@cloudsteading.com.