Skip to content
SHPBL

The house · Privacy

Privacy

Plain statement of what this site and the MCP server keep. Last updated 1 September 2026. Operator: Kenneth E. Sweet Jr., Abilene, Texas, United States. Questions and deletion requests: kennethsweet214@gmail.com.

What we store

  • Subscription keys — as a hash only. A key is stored as its SHA-256 digest. The key itself is never written to our database, so we cannot recover it, print it, or hand it to anyone.
  • Call metering. Per key: the tool name, a timestamp, and a running count for the billing period. That is what an allowance is counted from.
  • Repository connections. If you connect a repository through the SHPBL GitHub App, we store the installation id and the account and repository names it covers, bound to your key hash.
  • Orders. Name, email, and the order record for a purchase, plus certificate details when you request one. Card data is handled by the payment processor and never reaches our servers.
  • Aggregate page events. Path, referrer class, and event name. No cross-site advertising identifiers, no third-party ad networks.
  • Email signups. If you join the SHPBL field-note list, we store your email address, the time you consented, and where you joined. It is used only for the occasional updates and offers described beside the signup form, and is never sold.

What we never store

  • Your source code. Repository contents are read to produce an audit and released. We keep the findings and the ledger rows produced for you, not a copy of your repository.
  • A GitHub token you pass on a call. It is used for that call and discarded. It is never logged and never persisted.
  • Your key, in the clear. See above. Request headers are logged by name only, never by value.

Who can see a connected repository

Only the key it is bound to. A repository connection is scoped to one key hash; another subscriber's key cannot list it, read it, or write to it. Writes happen only when you call a writing tool, and they arrive as a pull request on a branch — never a direct push to your default branch.

Processors

We use a managed Postgres and hosting provider to run this site and store the records above, GitHub's API when you connect a repository, and a payment processor for purchases. Nothing described on this page is sold, rented, or used to train a machine learning model.

Abuse control

To keep crawlers off the library and guessers off the key paths, each request is given a short-lived signature: your address as the edge reports it, the class of client (browser, agent tool, crawler), and whether the request declares a language, salted with a value that rotates every day and then hashed. The signature is compared in memory to count requests and is never written to a table, so a signature from today cannot be matched to you tomorrow. It is used for rate limits, crawler refusals, and to keep automated traffic out of our own visit counts — never for advertising, profiling, or following you across sites.

Your requests

Email the address above to see what is held against your key, to disconnect a repository, or to have your record deleted. Deleting a key's record ends its subscription and its repository bindings. Metering rows for a closed billing period may be retained as a financial record.

See also the terms of service, the library license, and agent access.