---
title: "Privacy Policy"
description: "How agentcommunity.org collects, uses, stores, and protects your personal information."
label: "Privacy Policy"
template: "policy"
lastUpdated: "2026-07-22"
noIndex: true
---

# Privacy Policy

*Effective date: March 8, 2026.*

This policy describes what information agentcommunity.org ("we" or "the Service") collects, why we collect it, who we share it with, and what rights you have over it. The Service is operated by Open Agent Registry, Inc., a Delaware corporation.

If something in this policy is unclear, email us at [privacy@agentcommunity.org](mailto:privacy@agentcommunity.org) and we will explain it.

## 01. What we collect and why

### Account and registration data

When you sign up (via Google, GitHub, or email one-time password), we collect:

- Email address (from your OAuth provider or entered directly)
- Name and profile information, if your OAuth provider shares it

During registration, you may also provide:

- Full name, organization name, job title, and organization function
- Country, geographic regions of operation
- Contact phone number
- Organization website, logo URL, description, and legal address
- Company agent description (what agents you are building or plan to build)
- Preferred `.agent` domain name(s)

We use this data to manage your membership, process your `.agent` domain pre-registration, and demonstrate community support in our ICANN application.

### Anonymous A2A, MCP, and ChatGPT pre-registration

You can pre-register an agent through our anonymous A2A endpoint or an MCP client, including ChatGPT, without first signing in to agentcommunity.org. When you explicitly ask it to do so, our hosted A2A or MCP service sends the following to Agent Community's Department of Machine Verification (DMV):

- Requested agent name, email address, operator name, and any optional description
- A registration type of AGENT and a source label of A2A, MCP, or ChatGPT
- A SHA-256 fingerprint derived from the request IP address

We use these fields to record the pre-registration, issue its certificate ID, create or find the associated Agent Community authentication record, send verification and certificate emails, attribute the registration source, and prevent abuse. The DMV hashes the fingerprint again for its cooldown key; the fingerprint is not written to the registration row. The DMV service also processes the IP address that reaches its registration endpoint for rate limiting and records that address in registration metadata.

The stored pre-registration fields and registration metadata have no automatic expiry. If you delete your account or request deletion, we delete or anonymize primary account and registration records according to the account type and applicable obligations. Some audit, suppression, legal, and operational records may remain under the retention rules below; legacy import tables, Resend webhook payloads, and activity-log payload data are not automatically scrubbed by the current account-deletion flow. The DMV fingerprint cooldown key expires 24 hours after the last counted request. See Sections 3, 6, and 7 for service providers, other retention periods, and your controls.

We cache A2A message/send task results in Cloudflare KV for 24 hours so tasks/get can retrieve them. The cache is keyed by an unguessable task ID and contains only task status and result artifacts. It does not include the incoming message history, submitted email, or operator name, and expires automatically after 24 hours.

For MCP register_agent requests that use an Idempotency-Key, we cache an MCP Idempotency-Key result in Cloudflare KV for 24 hours. The cache value contains a normalized-argument hash and the returned tool result, which may include a certificate ID and registration metadata. Its key is a SHA-256 hash scoped to the caller IP and supplied key; this cache does not store the raw request arguments or raw IP address.

### Charter agreement data

When you accept the `.agent` Community Charter, we record which version you agreed to, an identifier that pins the exact text of that version, the time you accepted it, and the IP address recorded at signup. We keep this as a record of what was agreed and when. See Section 6 for retention details.

### IP addresses

We collect your IP address in several contexts:

- Charter agreement signing (stored as raw IP, retained 36 months, then anonymized)
- Authentication requests (hashed with SHA-256, used for rate limiting)
- Newsletter subscription (stored in subscription metadata)
- A2A, MCP, and ChatGPT pre-registration (used as described above for abuse prevention and DMV registration metadata)

For rate limiting, we process hashed IP and email values via Cloudflare Workers. These are ephemeral and expire automatically (within 10 minutes for most limits).

### Human map-search abuse prevention

The same-origin `/api/map/search` endpoint supports the human `/map` interface; it is not a machine or bulk API. To prevent abuse, it uses a SHA-256-derived caller IP hash as its Durable Object name. The Durable Object stores at most ten millisecond timestamps for the rolling 60-second budget and does not store the raw IP address. It does not use Cloudflare KV for map-search counting.

Expired timestamps are transactionally pruned on each request. Cleanup is also ordinarily scheduled within 60 seconds after the last request. That alarm cleanup is best-effort and may be retried during a platform or storage failure; it is not a guaranteed wall-clock deletion deadline.

This limiter state is separate from unrelated short-lived result caches used for A2A task results and MCP idempotency replay. Those caches have their own purposes and expiry periods; they are not map-search counters.

### Email tracking

When we send you an email (welcome messages, endorsement requests, reminders, campaigns), we record the email subject, Resend message ID, delivery status, and timestamps for events like delivery, opens, clicks, bounces, and complaints. We also store a SHA-256 hash of your email address and IP address alongside the tracking record. We do not store the full email body.

If your email hard-bounces or you file a complaint, we add you to a suppression list so we do not email you again.

### Document signing

Organizations that go through the endorsement process sign documents via DocuSeal, a third-party e-signature service. We send DocuSeal your name, email, organization name, and form fields relevant to the endorsement (like year established and professional count). DocuSeal sends us back signing status, timestamps, and document URLs. We store this in our database.

### Cookies

We set the following cookies:

| Cookie | Purpose | Duration |
|--------|---------|----------|
| Supabase auth session | Keeps you logged in | Session |
| reg_intent | Holds registration info during auth flow (httpOnly) | 10 minutes |
| invite_code | Tracks referral source | 7 days |
| _ga, _gid | Google Analytics (see below) | Up to 2 years |

During the OAuth flow, we may also set short-lived cookies for pending registration fields (domain, registration type, name, organization name). These are cleared after registration completes.

## 02. Analytics

We use Google Analytics 4 (measurement ID: G-NM99G6DPGB) to understand how people use the site. GA4 collects page views, referrer URLs, device and browser information, and events we define (like domain searches, join button clicks, and form interactions). This data is processed by Google under their [privacy policy](https://policies.google.com/privacy). We do not send Google your name or email.

We also use Cloudflare Web Analytics for page views, unique visitors, referrer, country, and device class. It does not use cookies, fingerprinting, or cross-site tracking, and we do not send it your name or email.

## 03. Third-party services that receive your data

| Service | What they get | Why |
|---------|--------------|-----|
| Supabase (US) | Account, pre-registration, and registration metadata | Database, authentication, and DMV processing |
| Google OAuth | OAuth handshake data | Login |
| GitHub OAuth | OAuth handshake data | Login |
| Resend (US) | Email address, verification and certificate email content | Email delivery |
| DocuSeal | Name, email, org details | Document signing (endorsements) |
| Cloudflare Workers (global edge) | Request IP, registration fields (agent name, email, operator name, and optional description), hashed email/IP, IP-derived cooldown keys, A2A task status/result artifacts, MCP idempotency hashes/results, and cookie-free page-view/device data | Hosting, task caching, web analytics, and rate limiting |
| Google Analytics | Page views, events, device info | Usage analytics |

We do not sell your personal information. We do not share it for advertising purposes. The services listed above receive data only as needed to operate the Service.

## 04. International data transfers

Our website and APIs run on Cloudflare Workers, which processes requests at its global edge. Our primary database and authentication service, Supabase, is hosted in the United States, and Resend processes email delivery in the United States. As a result, your data may be processed outside your country, including at Cloudflare's global edge and in the United States. We rely on standard contractual protections where applicable.

## 05. How we protect your data

- Supabase Row-Level Security (RLS) policies protect private account and authenticated browser data according to each table's access rules.
- Listed public profiles are intentionally public. PAGE reads them through server-only service-role clients with explicit is_listed = true filters; the service-role key is never exposed to the browser.
- Authentication cookies are httpOnly to prevent client-side script access.
- IP addresses in email tracking logs are hashed with SHA-256, not stored in cleartext.
- Webhook debug logs mask email addresses (e.g., j***@example.com).
- The site enforces HSTS with a two-year max-age and preload.

No system is perfectly secure. We take reasonable measures to protect your information, but we cannot guarantee absolute security.

## 06. Data retention

- Charter agreement IP addresses: retained for 36 months from collection, then anonymized.
- Account data (email, registration details): retained as long as your account is active.
- A2A, MCP, and ChatGPT pre-registration fields and DMV registration metadata: no automatic expiry; a deletion request deletes or anonymizes primary records, while applicable audit, suppression, legal, and operational records may remain.
- A2A, MCP, and ChatGPT IP-derived fingerprint cooldown key: expires 24 hours after the last counted request.
- A2A task status and result artifacts in Cloudflare KV: expire automatically after 24 hours.
- MCP Idempotency-Key argument hashes and result artifacts in Cloudflare KV: expire automatically after 24 hours.
- Email tracking records: retained indefinitely for deliverability management.
- Hard bounce and complaint suppression entries: retained permanently to prevent re-mailing.
- Map-search limiter state: at most ten millisecond timestamps, transactionally pruned on each request; an alarm is ordinarily scheduled within 60 seconds after the last request, with best-effort retry during platform or storage failure.
- Other rate limiting data in Cloudflare Workers: expires automatically within minutes.
- Audit logs (activity_log, registrations_audit): retained indefinitely for compliance.

## 07. Your rights

You can:

- Unsubscribe from emails by clicking the unsubscribe link in any email, or by visiting [/unsubscribe](/unsubscribe).
- Delete your account and request deletion of personal data from your [member dashboard](/members), or by emailing [privacy@agentcommunity.org](mailto:privacy@agentcommunity.org) if you cannot log in. We delete or anonymize primary account and registration records according to the account type. We may retain audit, suppression, legal, and operational records where needed; the current flow does not automatically scrub legacy import tables, Resend webhook payloads, or activity-log payload data. Contact us if you want those records reviewed as part of your request.
- Request a copy of the personal data we hold about you.
- Correct inaccurate information in your profile by logging in, or by emailing us.
- For an A2A, MCP, or ChatGPT pre-registration, use the verification email to access your account when available. Whether or not you can sign in, you can email [privacy@agentcommunity.org](mailto:privacy@agentcommunity.org) from the registration address to request access, correction, or deletion.

If you are a resident of the European Economic Area, you may also have rights under the GDPR including the right to restrict processing and the right to data portability. Contact us to exercise these rights.

## 08. Children

The Service is not directed at anyone under 16. We do not knowingly collect information from children. If you believe a child has provided us with personal data, contact us and we will delete it.

## 09. Changes to this policy

If we make material changes to this policy, we will update the effective date at the top and post the revised version on this page. For significant changes, we may also notify you by email.

## 10. Contact

Open Agent Registry, Inc.

Email: [privacy@agentcommunity.org](mailto:privacy@agentcommunity.org)

Website: [agentcommunity.org](https://agentcommunity.org)