Privacy Policy

Effective: 2026-04-22. Last updated: 2026-11-07 (MCP hosting-log retention and connector metadata).

J.A. Watte ("we," "us," or "our") operates https://jwatte.com (the "Site"). This Privacy Policy explains what we collect, why, how we use it, and your rights.

1. Information we collect

IP address and device identifiers
Analytics cookies and similar technologies
Information you submit through forms (name, email, message content)
The email address and website you give us if you ask for a weekly check email (section 5)
Cookie-consent preferences

We collect this information when you visit the Site, fill in a form, subscribe to communications, or interact with content we publish.

2. How we use information

Operate, maintain, and improve the Site
Communicate with you (including marketing, with your consent where required by law)
Detect, prevent, and respond to fraud, abuse, or security incidents
Comply with legal obligations

3. Cookies and similar technologies

See our Cookie Policy for a full list of cookies we use and how to control them.

4. Third-party services

Agent Endpoint Inspector: each inspection sends the inspected public domain, expressed as a reversed domain namespace, to the official MCP Registry in one GET search. No tool descriptions or report are sent with that lookup. The Inspector stores bounded, redacted tool-definition text, names, hashes and comparison dates only in this browser for word-change review; clearing this site's browser data removes them. Do not publish secrets in tool definitions. Report JSON and print exports can contain quoted public metadata. Links to mcptry are ordinary outbound links; the Inspector does not fetch, embed or send report data to it. Opening a link visits that service under its own policies.

We share information with the following service providers, only to the extent necessary for them to perform services on our behalf:

Google Analytics 4. aggregate pageview and event analytics. policy.
Microsoft Clarity. session replay and heatmap analytics. policy.
Google AdSense. display advertising. policy.
Netlify. hosting, Netlify Forms, and storage for weekly check emails. Tool pages also keep daily totals of opens, runs and results per tool there, with no cookie, IP address or identifier. policy.
Resend. delivery of weekly check emails and their confirmation emails. policy.
Outside cross-checks. only when you press “Run the outside checks” in the Mega Analyzer, our server sends the public web address you audited (or its host name) to the Schema.org Validator, isitagentready.com, the Mozilla HTTP Observatory, the W3C Nu HTML Checker, hstspreload.org, crt.sh, Google Public DNS and Cloudflare DNS, RDAP (rdap.org and the domain’s registry), Wikidata and the Internet Archive’s Wayback Machine, and the business name the report read from the page to the Google Knowledge Graph. Where the site’s type or address calls for it, that business name also goes to the Texas Comptroller, the Colorado Secretary of State or the SEC’s adviser search, and the names of clinicians the page itself lists in its structured data go to the NPPES NPI Registry. Nothing else is sent, and the answers are kept in our server’s memory for up to an hour. Google policy; Cloudflare policy; Mozilla policy; W3C policy; Wikimedia policy; Internet Archive terms.
Google PageSpeed Insights. after a Mega Analyzer run, the page asks our server for the audited page’s speed, and our server asks Google PageSpeed Insights, which sends that public web address to Google. The answer (scores and speed measurements, no personal data) is kept in our server’s storage for up to an hour so a second request for the same page does not test it again. policy.
Amazon Associates. book-purchase affiliate links to Amazon. policy.

We do not sell personal information to third parties. If we ever do, California residents will have the right to opt out via the "Do Not Sell or Share My Personal Information" link in our footer.

5. Weekly check emails ("Watch this for me")

If you ask for a free weekly check email, on /watch/ or under a tool's results, we store:

your email address, the website and the check you chose, the tool page you started from, and when you asked and confirmed;
the results of each weekly check, which are public facts about that website and its DNS, so the next email can show what changed;
daily sign-up counts per connection and per address, kept only as one-way hashes, to stop abuse. Your IP address is not stored with your sign-up.

We use this only to send the emails you asked for. Nothing weekly is sent until you click the confirmation link we email you, and an unconfirmed address is deleted after 7 days. If you sign up before weekly emails have started, we keep the request for up to 60 days and then send one confirmation email. Every email has a link to stop it; a stopped check is deleted 30 days later, or at once if you choose "Delete my data" on that page. If an email bounces or is marked as spam, we stop sending to that address. The records are kept in Netlify Blobs (Netlify) and the emails are sent through Resend.

6. How long we keep information

We retain personal information only as long as necessary for the purposes set out above and to comply with legal, accounting, or reporting requirements. Typical retention: contact/form submissions for the life of the inquiry + 90 days; anonymized analytics for up to 26 months; weekly check emails as described in section 5.

7. How we protect information

We use industry-standard security measures including TLS in transit, encryption at rest where applicable, access controls, and regular audits. No system is perfectly secure; we cannot guarantee absolute security.

8. Your rights

GDPR (EU / UK residents): You have the right to access, rectify, erase, restrict processing, object, port, and withdraw consent. You have the right to lodge a complaint with your supervisory authority. Legal bases: consent (marketing), contract (services), legitimate interests (security, analytics), legal obligation (tax, legal holds).

California (CCPA / CPRA): You have the right to know what we collect, delete it, correct it, limit use of sensitive personal information, opt out of sale or sharing, and not face discrimination for exercising rights.

Canada (PIPEDA / Quebec Law 25): You have the right to access and correct your personal information, withdraw consent, and file a complaint with the Office of the Privacy Commissioner.

To contact us about any of the rights or policies below, use the chat box on this Site. We respond within 30 days.

9. International transfers

If you access the Site from outside the country where we are established, your information may be transferred to, stored in, and processed in countries with different data-protection laws. We use Standard Contractual Clauses (SCCs) or equivalent safeguards where required.

10. Children

The Site is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have, use the chat box on this Site and we will delete it.

11. Contact us

Questions, requests, or complaints: Use the chat box on this Site.
J.A. Watte
Apollo Beach, FL

12. Changes to this policy

We may update this policy. Material changes will be announced on the Site at least 30 days before taking effect; non-material changes may take effect immediately. The "Effective" date above always reflects the current version.

13. Mega Security Analyzer

The scanner sends the public site address and its small, bounded sample of public URLs to our Netlify fetch service. Fixed exposed-file checks require your ownership or permission choice, use the direct route and respect the site’s robots policy. A remembered choice does not start those checks from an automatic link. You must press Run or “Run the owner checks too”. This release keeps alternate Cloudflare and Deno routes disabled for security evidence. A blocked direct request is reported as unavailable, without sending its body through those routes.

The service parses fetched content in memory and returns only limited public evidence, component versions, cookie flags and masked secret indicators. Security evidence responses use no-store. We do not store page bodies, full secret values or site findings in application caches, logs or Netlify Blobs. Your browser holds sanitized results in memory for retry and replay and stores only your permission preference for the site’s origin. Resetting the preference removes it. Downloaded reports and copied prompts remain under your control. Hosting providers may retain ordinary connection metadata under their own policies. This disclosure covers the security evidence feature; it does not change the broader Mega Analyzer’s existing collection.

Our advisory lookup sends only reviewed public package names and versions to OSV.dev. It sends public CVE identifiers to FIRST EPSS for dated exploitation-probability context. It reads CISA’s Known Exploited Vulnerabilities catalog and endoflife.date product lifecycle data. When publication metadata is needed, a public package name is sent to the npm registry. These providers receive no scanned site address, page body, findings, secret value, private package name or private registry address through the advisory lookup. The weekly updater reads the same bounded public sources and the reviewed public package and indicator lists on jwatte.com. A weekly server-side import retrieves WordPress vulnerability data from Wordfence Intelligence (Defiant Inc.). Nothing from visitors is sent to Wordfence: no site addresses, component lookups, page bodies or reports. WordPress matches use our stored public feed, with its retrieval date, vulnerability record links, Defiant copyright notice and license, and the MITRE notice and CVE Terms of Use where a record includes a CVE. NVD, RetireJS, Drupal and Joomla feeds are not enabled in this release.

Normalized public component advisory answers are reused for up to 24 hours. This 24-hour freshness limit is not a deletion guarantee: older normalized public advisory records may remain in storage. Older last-good public feed snapshots may also be retained for fallback and are labeled with their source dates. Neither contains a site report or page body. Reports list the sources actually used, their retrieval dates and missing coverage. The Security data panel identifies automated, scheduled or manual updates and their public changes. A feed at least eight days old is marked stale; failed refreshes keep the last validated data without claiming current coverage.

TLS and certificate probes connect to the public site’s HTTPS service. DNS checks send public domain names and DNS record types to Google Public DNS and Cloudflare DNS. When a referenced external domain has no DNS answer, rdap.org and the responsible domain registry receive that public domain name to check its registration status.

This scan only reads what your site already shows every visitor. Anything beyond that, such as signed-in scans, injection or configuration testing, or load testing, is a separate engagement. It starts only after the site owner approves it in writing and ownership is verified with a DNS record or a file on the site. Ask about a separate engagement

14. MCP connector

Our public, read-only MCP server at https://jwatte.com/mcp receives the tool name and arguments your assistant sends, plus the connection request. It uses those inputs to search our bundled tool, article and book catalogs or create a browser-tool link. It does not request your conversation history, assistant memory or files. Anything included in a tool argument still reaches the server; send only what is needed, without passwords, access tokens, private addresses or personal health information.

The MCP handler processes calls in memory. It does not write calls, inputs or conversations to a database or file, and it keeps no persistent input history. Successful calls do not explicitly write an application log line. Configuration failures, unexpected exceptions, invalid outputs and disconnected requests can produce diagnostic logs with tool or method names, error details and stack traces. Those diagnostics are not guaranteed to exclude every input value. We use diagnostics to maintain the service and investigate faults.

Netlify, our hosting provider, records request metadata such as IP address, user agent, requested URL, timestamp and status, along with function invocation and diagnostic logs. Our current Netlify Pro plan provides up to 7 days of function-log history and 7 days of request history in Observability. These are the hosting logs available to us, not a promise that every provider backup or security record is deleted on that date. We do not keep a separate connector call-history archive. See Netlify's function log documentation and Observability retention table.

The six tool handlers make no outgoing API requests and do not forward inputs to other websites, Amazon or AI providers. They return answers to the assistant that called them; that provider's own policy covers its handling of your conversation and the results. get_audit_link creates a link only: the MCP server never fetches or audits the address. If you open a returned link, your browser contacts its destination. A run link contains the supplied address and starts the selected tool. For page audits such as Mega Analyzer, the opened page sends that address to jwatte.com's fetch function, which fetches the target site and may use configured proxies. Results appear on the tool page. Those separate tool and hosting data practices apply. Book links do not purchase anything.

The MCP endpoint has no accounts, sets no cookies and runs no browser analytics. Ordinary website pages, including the connection guide and linked tool pages, use the cookie and analytics practices described elsewhere in this policy. For setup, limits and all six tools, see the connection guide. For MCP privacy questions or requests, use our contact form or the site's published address, joshua.a.watte@gmail.com.