Privacy Policy

Last updated 30 August 2026

This policy covers datakoot.com, the keyless data servers at *.datakoot.com and their MCP endpoints, and billing. The Datakoot browser extensions have their own policy at privacy.datakoot.com; section 7 below summarises how they relate.

The short version: there are no accounts, no cookies, no advertising, and nothing to sell. To keep the free tier fair we count calls against a one-way hash of your network address — the address itself is never written down. That is the whole of it, and the rest of this page is the detail.

1. The website

datakoot.com is a static site. It sets no cookies and stores nothing in your browser.

We use Cloudflare Web Analytics to see which pages get read. In Cloudflare's own words it "does not use any client-side state, such as cookies or localStorage, to collect usage metrics," and does not "‘fingerprint’ individuals via their IP address, User Agent string, or any other data for the purpose of displaying analytics." What we see is aggregate: page paths, referrers, country, browser and device class, and load-performance numbers. We cannot pick you out of it, and we do not try.

Cloudflare also hosts and serves the site, and keeps its own short-lived operational logs of requests as any web host does. That processing is covered by Cloudflare's privacy policy.

There are no third-party trackers, ad pixels, session recorders, heatmaps, or social widgets anywhere on this site.

2. The API — what we store

The servers need to count calls to enforce the free allowance and to meter paid plans. That is the only reason anything is stored, and it is deliberately as little as will do the job.

  • Free tier. We take the network address your request arrives from, prepend a fixed secret string, run it through SHA-256, and keep the first 12 bytes. That short hash, the UTC date, and a running count are what we store. The address itself is never written to the database and never leaves the running request. The hash is one-way: it cannot be turned back into an address.
  • Paid plans. Instead of the address we hash your licence key the same way, and store that hash with the calendar month and a count. This is how the 10,000 included calls and any overage are measured.
  • What is counted. Only tool calls. Connecting to a server, listing its tools, and health checks are never counted and never billed.

We do not store the arguments you send — the CVE ID, package name, domain, ticker, address, company or coordinates. They exist only for the moment it takes to answer, and are then gone.

Our application logs record the JSON-RPC method and the tool name (for example tools/call cve_lookup) so we can see which tools are used. They contain no arguments and no network addresses.

3. Where your lookups go

This one matters, so it gets its own section. Datakoot is an access layer, not a copy of the world's data. When you ask a question, the thing you asked about is forwarded to the official source that can answer it:

  • NVD / NIST and OSV.dev — vulnerability and package-advisory lookups
  • npm, PyPI, crates.io and deps.dev — package metadata
  • SEC EDGAR — company filings and financials
  • The World Bank and U.S. Bureau of Labor Statistics — economic series
  • The European Central Bank — foreign-exchange rates
  • NOAA / National Weather Service and USGS — weather, alerts, earthquakes, elevation
  • RDAP registries and public DNS — domain and DNS lookups
  • The U.S. Federal Register — rules, notices and executive orders
  • Public Base network RPC nodes — on-chain reads

Those requests come from Datakoot's servers, not from you, so the upstream source does not see your network address. It does see the thing you looked up. Each source has its own privacy practices, which we do not control. Do not send anything through Datakoot that you would not be willing to send to the underlying public source.

4. Payment

Polar is our merchant of record. When you subscribe, Polar collects and holds your name, email address, billing location and payment details, and handles tax. Datakoot never sees or stores your card number. What we receive is a licence key and the fact that it is valid. Polar's handling of your data is governed by Polar's privacy policy.

Email us at [email protected] and we will of course have your email address, and whatever you put in the message. We use it to answer you.

5. How long it is kept

  • Call counters. Deleted no later than 90 days after your last call. A counter row is reused rather than added to, so an active caller has exactly one row and an inactive one is removed.
  • Licence-key validation cache. Held for at most one hour, then expires on its own.
  • Application logs. Retained by Cloudflare on its own schedule, currently no more than 7 days.
  • Analytics. Aggregate only, retained by Cloudflare; there is nothing personal in it to delete.
  • Billing records. Held by Polar for as long as tax and accounting law requires.

6. What we never do

  • We do not sell your data, and we never will. There is no "sale" or "sharing" of personal information as those terms are defined under the California Consumer Privacy Act.
  • We do not use your data for advertising, and we run no ad technology.
  • We do not track you across sites or build a profile of you.
  • We do not require an account, a name, or an email address to use the free tier.
  • We do not train models on your queries.

7. The browser extensions

The nine Datakoot extensions store your display preferences and, if you have one, your Pro licence key in your browser's local storage. That never leaves your device. When you look something up, the extension sends that lookup to the Datakoot API — at which point sections 2 and 3 of this policy apply, exactly as they would for any other caller. The full extension policy is at privacy.datakoot.com.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict its processing, and to be free from discrimination for exercising those rights. To make a request, email [email protected].

One honest limitation. Free-tier data is a one-way hash with no name, email, or account attached to it. If you ask us for a copy of it, or ask us to delete it, we usually cannot find it — there is nothing to match you against. That is a consequence of collecting so little, not an evasion. If you hold a licence key, tell us and we can act on the records tied to it. For billing data, contact Polar, who hold it as merchant of record.

If you are in the EU or UK: our lawful bases are legitimate interest (keeping a free service available and preventing abuse, and understanding aggregate site usage) and performance of a contract (metering and billing a paid plan). You may lodge a complaint with your local supervisory authority.

9. Where data is processed

Datakoot runs on Cloudflare's global network; requests are handled at the location nearest you. The call-counter database is a single Cloudflare D1 database placed in North America. Cloudflare and Polar are both United States companies. If you are outside the United States, using Datakoot means your data is processed there.

10. Children

Datakoot is a developer tool and is not directed at children. We do not knowingly collect personal information from anyone under 13, and the free tier is designed so that we collect no personal information from anyone at all.

11. Security

Everything is served over HTTPS with HSTS. The site sets a Content Security Policy and related headers. Network addresses and licence keys are hashed before storage, so a copy of our database would not reveal either. We do not hold card data at any point.

12. Changes

If this policy changes we will update the date at the top. If a change is significant — if we start collecting something new, or use something for a new purpose — we will say so plainly here rather than quietly editing a line.

13. Contact

Datakoot — [email protected]. See also our Terms of Service.