Privacy policy

Website and hosting

The SmithGuard website uses no analytics, advertising, application trackers, or cookies. Cloudflare, AWS, and related hosting and security systems may process ordinary request metadata, such as IP addresses, user agents, requested URLs, timestamps, and security signals, where applicable, to deliver and protect the service. Those providers apply their own request and security handling. Nginx and Uvicorn request access logging is disabled for the public API; this does not mean hosting and security systems process no request metadata.

Public API and MCP requests

SmithGuard accepts one exact public software artifact coordinate at a time: an ecosystem, public package or artifact name, and exact version or digest, with an optional registry host. The hosted MCP tools use the same public service boundary. Do not submit source code, private repositories, lockfiles, SBOMs, private inventories, credentials, or personal information. SmithGuard does not forward submitted coordinates or tool requests to AI providers. If you use an AI assistant or other MCP client, that client's handling of your conversation and requests is governed by its own policies.

Anonymous quota accounting

To enforce anonymous usage limits and prevent abuse, SmithGuard stores daily keyed digests derived from network identity and normalized assessment requests, together with accounting status and timestamps. The quota database does not store the raw IP address or artifact coordinates. These records expire at the next UTC midnight plus two minutes. While the API is running, a background task attempts bounded cleanup every second; deletion can be delayed if the service is stopped, cleanup fails, or a backlog remains. The expiry time is not a guaranteed deletion deadline.

Caching and sessions

The API caches public assessment responses in memory to serve repeated checks. Hosted MCP is stateless and does not retain chats or client sessions. This describes SmithGuard's service; it does not set a retention policy for your MCP client or hosting and security providers.

Voluntary contact and your choices

If you email contact@smithlabs.ai, Smith Labs receives your email address and the information you include. We use it to respond, provide services, protect our systems, and meet legal obligations. Contact records may remain while needed for those purposes. Email that address to ask about information you provided or request deletion; we will consider the request and any information we need to retain. Do not include secrets or sensitive personal information.