Privacy note: LimitFacts API and MCP server

Last updated: 18 October 2026

This note covers the LimitFacts REST API (https://api.limitfacts.dev) and the LimitFacts MCP server (https://mcp.limitfacts.dev). It also covers the calls that the npm package limitfacts-mcp sends to the API. The privacy notice for the website is at https://limitfacts.com/privacy/.

This note tells you what the API and the MCP server do with data. It applies from the day they go live. The date at the top shows the last change.

Who runs it

The operator of LimitFacts (limitfacts.com) runs the API and the MCP server.

What we log

For each request, we write one row to a log. The log is a Cloudflare D1 database. Each row has only these fields:

• The time of the request.
• A request ID. We make a new ID for each request. The response also shows it.
• The surface: the API, the remote MCP server, or the API through the npm package limitfacts-mcp.
• The route pattern, or the MCP endpoint, method and tool name, for example GET /v1/tools/{tool_id} or /mcp-clean#tools/call:search_tools. We do not log the full path, the query string or tool arguments.
• The status of the response, for example 200 or 404.
• The time that the response took, in milliseconds.
• The number of results in the response.
• The number of affiliate links in the response. Today this number is always zero.
• Whether affiliate fields were on or off for the response. Today they are always off.
• The client name that your MCP client sends, cut to 40 characters.
• The client version that your MCP client sends, cut to 40 characters.
• A general client type, for example "python-requests". We take this from the user agent. We do not keep the full user agent.
• Your country, as a 2-letter code from Cloudflare.
• A traffic class: real use, our own tests, directory scans, uptime checks or crawlers.

We use these rows to count real use of the API and the MCP server, to find errors and to keep the service working. Our own tests, directory scans, uptime checks and crawlers do not count as use.

Our legal basis is our legitimate interest in running, protecting and measuring a free public service (GDPR Article 6(1)(f)).

What we never log

• IP addresses.
• Full user agents.
• API keys.
• Cookies.
• Request bodies.
• Query strings, search text or tool arguments, of any length.

We do not log your search text. We do not fingerprint clients.

How we use your IP address

Cloudflare must use your IP address to send the response to you. We limit each client to 60 requests in 60 seconds. For this limit, the Cloudflare rate limiting feature holds a hashed form of your address in memory. We do not write it to the log.

Today we find directory scans by their user agent only. If we also compare addresses with the published IP ranges of a directory, we do it in memory and do not store the address.

API keys

The API and the MCP server use no API keys today. You do not need a key or an account.

We update this note before we add API keys.

How long we keep it

We keep each log row for 90 days. A daily job then deletes it, so each row is deleted within one day after it is 90 days old.

We also keep daily totals. A daily total holds only the day, the surface, the route or tool, the traffic class, whether affiliate fields were on or off, and counts. It holds no personal data. Daily totals have no fixed end date.

Cookies

The API and the MCP server set no cookies and read none. The MCP server keeps no session state.

Affiliate links

API and MCP responses contain no affiliate links today. Each response carries a disclosure that says so.

If we add affiliate links later, each response that has one discloses it. The disclosure is in the response, and a label is next to the link. We update this note before the first affiliate link goes into a response.

An affiliate link in a response will be the link that the program gives us. It will not go through a redirect on our side. We do not count clicks on it. A link can carry a sub-ID that names only the surface, for example api or mcp. The sub-ID holds no data about you.

Hosting

Cloudflare hosts the API, the MCP server and the log. To deliver and protect the service, Cloudflare processes each request, including your IP address, under its own privacy policy. Read the Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/

Cloudflare runs a global network, so your request can be processed outside your country. Email us to ask how these transfers are protected.

We do not sell or share personal data

We do not sell or share personal data. We do not put names, email addresses, IP addresses or API keys in the log. The client name and client version come from your MCP client. Do not put personal data in them.

Changes to this note

Before we change the logged fields, how long we keep them, API keys or affiliate links in responses, we update this note first. The date at the top shows the last change.

Your rights

Our log does not tell us who you are, so we usually cannot find your rows. If you send us a request ID from a response, we can find that row. You can ask us for a copy of your data, or ask us to correct it, delete it or limit how we use it.

You have the right to object to our use of your data at any time. To object, email us.

You can complain to the data protection authority where you live or work. In the UK, this is the Information Commissioner's Office (https://ico.org.uk).

Contact

The API and the MCP server are run by the operator of LimitFacts (limitfacts.com).

Email: hello@limitfacts.com. Use this address for any question about this note or your privacy, or to use your rights.