Privacy notice
Effective October 28, 2026
This notice explains how Sourcefolio collects, uses, discloses, and protects information when you visit our website, use our documentation, connect to the Sourcefolio MCP server, or participate in a Sourcefolio workspace.
1. Information you provide
Workspace owners and users may provide account email addresses, project names, repository links, selected versions, release dates, license identifiers, evaluation notes, and information included in support or sales messages.
Your organization decides what it records in its workspace. Do not submit credentials, sensitive personal information, confidential source code, or regulated data that Sourcefolio did not request.
2. Authentication and usage information
We process authentication state, workspace identifiers, developer-key identifiers and hashes, assigned permissions, revocation status, request timestamps, network metadata, error information, and bounded operational logs. These records help us route requests to the correct workspace and maintain service reliability.
Cloudflare may receive IP addresses, user-agent data, protocol headers, and other network information while delivering our website and MCP service. The public website does not currently use advertising cookies or marketing trackers.
3. Public project information
Sourcefolio organizes publicly available open-source project metadata, including repository URLs, ecosystem names, version information, and license identifiers. Public catalog information is separate from private workspace notes and may remain available after a workspace closes.
4. How we use information
We use information to provide and improve the service, authenticate developers, isolate workspaces, process MCP tool calls, respond to questions, prevent abuse, investigate errors, and understand whether the product is useful to participating teams.
Where applicable, we process information to perform our agreement with your organization, pursue legitimate operational and security interests, comply with law, or act with your consent.
5. How we disclose information
We use infrastructure providers, presently Cloudflare, to deliver and operate Sourcefolio. Providers process information only for services they perform for us and under their own applicable terms.
We may disclose information when required by law, to protect users and the service, in connection with a financing or business transfer, or when you direct us to do so. We do not sell private workspace records or use them for targeted advertising.
6. Retention
We retain account and workspace information while needed to provide the service and for a reasonable period afterward for recovery, security, dispute resolution, and legal obligations. Authentication and operational records may follow shorter or longer schedules depending on their purpose.
Revoking a developer key prevents future use but may not immediately remove its identifier from security logs or backups. Public project metadata is maintained independently.
7. Security
We use HTTPS, scoped developer keys, account-level data separation, revocation controls, and service-provider safeguards designed to protect Sourcefolio information. No service is completely secure, and we cannot guarantee that unauthorized access will never occur.
If you believe a credential or workspace may be compromised, revoke the affected key through your workspace administrator and contact [email protected].
8. Your choices and rights
You may ask your workspace administrator to correct or remove private records and revoke developer access. Depending on where you live, you may also have rights to access, correct, delete, restrict, or object to certain processing of personal information.
Send privacy questions and rights requests to [email protected]. We may need to verify your identity and your relationship to the workspace before acting.
9. International use
Sourcefolio and its providers may process information in the United States and other countries. Those locations may have data-protection rules different from those where you live.
10. Changes to this notice
We may update this notice as the beta, infrastructure, and product change. We will post the revised notice here and update its effective date. Material changes may also be communicated to workspace owners.