Privacy policy
Effective 20 October 2026. This policy covers nopaywall.io, its public API (/offers.json, /feed.xml) and its MCP server (/mcp).
Summary
nopaywall.io is a public, read-only catalog of free AI offers. You can use the website, the JSON and Atom feeds and the MCP server without an account. We do not sell personal data and we do not use it for advertising.
Public API and MCP server
This covers /offers.json, /feed.xml and the MCP server at /mcp, including use through AI assistants such as Claude.
We keep aggregate daily counters only: the endpoint, the category filter or MCP tool name, the response status class (for example 2xx or 4xx), a coarse client family derived from the User-Agent header or the MCP client name (for example "claude", "python" or "browser"), the number of requests and their total response time.
We do not store IP addresses, full User-Agent strings, search text, tool arguments, conversation content or any account identifier for these requests. Your IP address is used in memory for up to one minute to enforce the rate limit and is then discarded.
The MCP server only reads the public catalog. It cannot access your Claude conversations, files or accounts, and it does not write any data on your behalf.
Website analytics
We use self-hosted Umami Analytics to understand visits and which catalog links and features are useful. It records page views, referrers, browser and device details, language, screen size, approximate location and named interactions on the site. Umami uses anonymous sessions without cookies; it uses the visitor IP for session and location calculations but does not store the raw IP.
Data you choose to give us
Update list: if you join it, we store your email address, selected topics, language and the time of consent.
Browser notifications: if you enable them, we store the push subscription your browser creates (an endpoint URL and its encryption keys), your notification topics and language.
Email: if you write to us, we keep the message to answer it.
Service providers and third parties
The site, API, MCP server and database run on Cloudflare (Workers and D1). Cloudflare processes requests, including IP addresses, to deliver and protect the service, under its own privacy policy.
Catalog listings link to third-party websites. Their privacy practices are their own. Some links are referral links; they are marked on the site and as is_referral in the API, and they never decide whether an offer is listed.
We do not share personal data with anyone else except where the law requires it.
Retention
API and MCP usage counters contain no personal data and are kept until we delete them. Update-list and notification data are kept until you unsubscribe or ask us to remove them. Operational error logs at Cloudflare are short-lived and are not used to identify visitors.
Your choices and contact
You can ask us to access, correct or delete data you gave us, or to remove you from the update list, by writing to hello@nopaywall.io. You can turn off browser notifications at any time in your browser settings.