Privacy Policy
Effective: October 24, 2026
Last updated: October 26, 2026 (changed: free daily allowance is now 25 checks and 3 reports per client; earlier: directory activity signals are used internally to schedule how often we check a service)
BotsRated (botsrated.com) checks paid AI services and remote MCP servers and publishes signed records of what it saw. This page explains what we collect when you or your agent use the site, the API, the MCP server or the A2A endpoint, why we collect it, how long we keep it and who else handles it.
Short version: we have no accounts, no cookies, no tracking and no ads. We don't store your IP address in our database. Cloudflare, our host, sees it, and our error logs there may include it for a short time. We keep the least we need to run free daily limits, paid plans and corrections.
What We Collect
Requests to the site and API. To give every client a fair free daily allowance (25 checks and 3 reports per UTC day) we turn your IP address into a one-way key. For IPv6 we use only the first 48 bits. The key is an HMAC with a secret value and the current UTC date, so it changes every day and can't be turned back into your address without our secret value, which we keep private. We store that key and how many free answers it got that day. We don't store the IP address itself.
Short-term abuse limits. Rate limits per IP address are counted in the server's memory only, for a short time. They are not written to a database.
Daily usage totals. Once a day we save totals for the previous day: how many different daily keys got free answers, how many free checks and reports were served, how many keys reached their limit, how often the overall free limit was reached, and how many paid calls settled. We also save the ten busiest daily keys, shortened to 8 characters, with their counts. None of this contains an IP address. We also count page views per day, per page and per referring site (the site name only), split into people and automated clients by browser type. We check the browser type when the page loads and don't keep it. We store only the totals, with no IP address, browser details or identifier.
What you look up. When you look up a host with the preflight, check or report tools, remote MCP servers on that host may be checked more often for 7 days. Lookups don't change how often pay-per-call services are checked. We record the host and the time, not who asked.
Paid calls. Payments use x402 in USDC on the Base network. Your x402 client sends a signed payment authorization. A payment facilitator checks and settles it on-chain. We don't store payment authorizations for single calls. We count settled calls per day, with no payer details. Payments on Base are public: the blockchain shows the paying wallet address, the amount and the time for anyone to see.
Alert and data plans. When you create a plan we store:
- the plan, the hosts you chose and your webhook URL (if you gave one);
- start and end dates and the price;
- a SHA-256 hash of your access token (the token itself is shown to you once and never stored);
- for paid plans, the paying wallet address and the transaction ID from settlement;
- for free alert plans only, a one-way key made from your IP address and a secret value (it does not change daily). We use it only to limit how many free alert plans one client can open. We keep it with the plan record until the plan ends or is cancelled; our daily clean-up then deletes it.
We send alerts only to your webhook. We don't ask for an email address.
Corrections and disputes. If you send a correction or dispute, we store the host, your statement, an optional receipt ID, an optional contact you choose to give and the time. If you ask us to publish a reply, the published reply stays public with the record. The rest, including your contact details, is kept for 90 days.
Messages to our email address. If you write to botsrated@gmail.com, we get whatever you put in the email.
What we don't collect. We don't set cookies or use local storage. The site's one script makes same-origin requests only. We use no third-party analytics, tracking pixels, ad networks or fingerprinting. We count page views ourselves, as totals only (see Daily usage totals above). The MCP and A2A endpoints get only the arguments of each call (for example a host name). They never ask for your conversation, files or memory.
Data About Sellers And Servers
Most of what we publish is about services, not people. We find services in public lists (the Coinbase CDP Bazaar, Agentic.Market, 402index, x402-list and the Official MCP Registry). From the Bazaar and Agentic.Market we use only the service address, to decide what to check. We also use directory activity signals (such as a listing's count of recent payers) internally, to schedule how often we check a service; we don't publish them. We then make unpaid test requests and some small paid test purchases, and publish signed receipts of the results. Those receipts can include public details a service publishes about itself, such as its URL, prices and wallet address (payTo). If you run a listed service and think a record is wrong, use the disputes page.
A payment address or service name can belong to an individual. We publish only what the service itself made public. If you are an individual and want something about you removed, write to us; we'll remove what isn't needed to show the measured facts.
How We Use It
We use this data only to:
- run the free daily allowance and rate limits;
- deliver the plans you bought or opened;
- fix errors and handle disputes;
- protect the service from abuse;
- see overall usage trends.
We don't sell data. We don't share it for advertising, and we don't build profiles of users.
Who Else Handles It
- Cloudflare hosts the site, API and databases (Pages, Workers, D1, KV). Cloudflare handles every request, including your IP address, under its own privacy policy. Our error logs are kept in Cloudflare's systems for a short time and can include request details, including your IP address.
- The x402 payment facilitator (Coinbase Developer Platform) verifies and settles paid calls. For each paid call it receives your paying wallet address, the amount and the address of the call (which can include the host you looked up). It screens payments against sanctions and risk lists and may decline them. See Coinbase's privacy policy.
- The Base blockchain records every payment publicly and permanently.
- Your webhook. For plans, we send signed alert messages to the webhook URL you gave us.
- Google runs the botsrated@gmail.com mailbox.
We may disclose data if the law requires it.
How Long We Keep It
| Data | How Long |
|---|---|
| Daily free-allowance counters (one-way keys) | Deleted after 3 days (up to 7 if the daily summary fails) |
| Daily usage totals | Kept, to show trends |
| Daily page-view totals | 400 days |
| In-memory rate-limit counters | A short time (memory only) |
| Disputes and corrections, including any contact you gave | 90 days. A reply we publish at your request stays public with the record |
| Plan records (token hash, hosts, webhook, dates, payer address, transaction ID) | Kept after the plan ends, as a record of the purchase. The free-plan key is deleted after the plan ends or is cancelled |
| Unpaid test receipts about services | x402 checks: raw records for 7 days in our live database, then in our archive for up to 150 days (less if archive storage runs short). MCP checks: 30 days (14 days if database storage runs short). Signed daily summaries are kept |
| Payments on Base | Permanent and public (we can't delete these) |
Your Choices
- You can use the free pages and the free preflight check without sending any personal data.
- You can cancel a plan at any time with
POST /v1/subscription/canceland your token. This stops delivery. To have a plan's webhook URL or dispute contact deleted, write to us. - To ask what we hold about you, or to correct or delete it, write to botsrated@gmail.com. Because we don't store IP addresses or names, tell us the plan ID, dispute ID or wallet address involved.
Legal Bases And Your Rights (EU/UK Visitors)
We process data to provide what you ask for (contract), and to protect the service and handle disputes (legitimate interests). Data is processed in the United States by us and our providers. You can ask to access, correct or delete your data, object to processing, or complain to your local data protection authority.
Do Not Track
We don't track you across sites, so we treat every visit the same whether or not your browser sends a Do Not Track signal.
Children
BotsRated is a tool for developers and their software agents. It is not meant for children, and we don't knowingly collect data from them.
Security
We take reasonable steps to protect what we store. Tokens are stored only as hashes, and IP addresses are reduced to one-way keys. See our security page for how to report a problem.
Changes
If we change this policy, we'll update this page and its date. We'll also keep a dated copy of each earlier version, available on request at botsrated@gmail.com. For significant changes we'll also post a notice on the home page before they take effect.