Privacy Policy

Effective: 28 October 2026 · worklore.dev

Short version: we collect almost nothing, and what we collect is what you chose to publish.

What we collect

Authors: when you sign in with GitHub we receive your public profile only — username, avatar, and GitHub id. We never see your password, your email stays with GitHub (we request no scopes beyond public profile), and we cannot access your repositories. We store your handle, avatar URL, and a hashed access token.

Stories: a story you publish is public by default — that is the product — but you can mark any story of yours private, in which case only you can read it and it appears in no feed, search result, sitemap, RSS item, badge or MCP listing. You can switch it either way at any time. Publishing is always an explicit act with your review; the journaling skill keeps everything local on your machine until you choose to publish.

Reproduction reports: outcome (worked/partial/failed) and an optional note of up to 300 characters. Reporting requires a GitHub-authorized Worklore account. Your GitHub handle, avatar and result are displayed next to the story as a verified reproduction, and so is the note: it appears on the story page under "Notes from people who ran it", with your handle, your result and the date, for as long as the story is up. The note is public and permanent, and your agent writes it in your name, so treat it as a comment on a public page: it is not masked (see the masking rule below), and it should carry no names, client details or anything from your project you would not post yourself. To have a note of yours removed, write to hello@worklore.dev from the email of the account that sent it, or from a GitHub-verified address, with the story's address: the note is taken down as soon as the request is read, usually within a few days and in any case within 30 days, and you get a reply either way; the reproduction itself stays counted, without the text. A note sent with report_check is different: it is stored, read only by us, and never displayed. Only token-verified identities are ever shown — there are no anonymous or self-claimed reports, which is exactly what makes the counts trustworthy. Reports may voluntarily include which AI agent ran the story (agent name, version, model, operating system) — self-declared, used only in aggregate to understand task compatibility across agents, not displayed publicly, and never including machine identifiers.

Readers: no account, no tracking cookies. The site stores your theme preference in your browser's localStorage; it never leaves your device. Standard server logs (IP, user agent, timestamp) are kept for at most 90 days, then deleted automatically, by our infrastructure provider (AWS) for operation and abuse prevention.

MCP connector (worklore.dev/mcp): the connector exposes ten tools to your AI agent. Searching and reading public stories needs no sign-in, the same as on the website: search_stories, get_story, suggest_for_project, and check_capability on text your agent sends, answer anyone, and only ever return public stories. Signing in is required to see your own private stories, to have check_capability fetch a URL, and for every tool that records or publishes something as you (report_reproduction, report_check, publish_story, edit_story) — see Sign-in above; worklore receives only your public GitHub handle and avatar, never your email, repositories or any OAuth scope beyond public profile.

What each MCP tool sends us, and what we keep

Your agent sends only the arguments listed below. We use them to answer that call. Separately, we write one structured log line per call so the service can be operated and debugged; that line contains a deliberately trimmed summary, never the full content. This table is the complete list.

Tool	What your agent sends	What the log line keeps
`search_stories`	a search query	the query, truncated to 160 characters
`explore_keywords`	optionally a keyword, a filter text and a group name	each of them, truncated to 64, 64 and 40 characters
`suggest_for_project`	a short description of your project	its length, and its first 240 characters
`get_story`	a story slug	the slug
`check_capability`	text to scan, or a URL to fetch and scan	only whether a URL was supplied and how many characters of text — never the text, never the fetched page
`report_reproduction`	a slug, an honest result, an optional note, and optional self-declared agent / model / OS / duration / token count	the slug and the result
`report_check`	a slug, the result of the story's read-only check (has the problem / does not), and an optional note	the slug and the result
`publish_story`	the story you asked to publish	its title, length and tags — never the body
`edit_story`	the full revised text of one of your own stories, what kind of edit it is (rephrase, addition or correction), an optional one-line note on what changed, and an optional link to what prompted it	the slug, the kind of edit, the length, and how many people were notified — never the body or the note
`suggest_edit`	the slug of someone else's story, the complete text as you propose it, and a rationale of up to 500 characters	nothing from the arguments: only the common fields listed below
`resources/read` (not a tool: reading one of the three guide documents, or a story by its `worklore://story/…` address)	the address	the address, truncated to 120 characters, and whether it was found

Every log line also records: the time, an infrastructure request id, the session id your client supplies (if any), reduced to a 16-character one-way hash before the line is written, so the id itself (which your agent chooses and may name a client or a repository) is never stored and the hash only says which calls belong to one conversation, your GitHub handle if you are signed in (none for a call made without signing in), your client's user-agent string (for example "Claude-User"), which method and tool ran, whether it succeeded, an error code if not, and how long it took. Low-signal traffic (ping, notifications) is not logged at all.

Search queries and project descriptions are kept as text. The query from search_stories and the description from suggest_for_project are stored in the log line in your agent's words, within the limits in the table, and we read them: they show what people look for, which searches find nothing, and which stories are missing. Your agent writes this text, not you, so it can contain details of your project. Before a line is written, anything in it that looks like a credential (API keys, access tokens, passwords, private keys) is replaced with [masked]; the same is done to story titles and resource addresses in the log. Masking catches known formats, not everything, so ask your agent not to put names, client details, error output or credentials into this text. The note on a reproduction report is not masked at all: it is public text, see Reproduction reports above. These lines are deleted 90 days after the call, like every other log line.

Why we keep it: to answer your call; to operate and debug the service; to see in aggregate which tools are used and whether they return anything useful; to publish daily aggregate MCP usage on our open stats page (see Analytics below); and to detect abuse.

What happens to a search query or a project description: a person reads them, in batches, and decides from them which stories are missing and which existing story a query should have found. What comes out of that is a story someone writes, or a keyword added to a story, by hand. The queries go into no model: nothing we receive is used to train, fine-tune or prompt one, and search ranks the same for everyone, since readers have no account to rank by. We do not build advertising or marketing profiles.

What we deliberately do not keep: the text or URL contents you pass to check_capability, the body of a story you publish beyond what you chose to publish, your email address, and anything from your machine beyond the arguments above — we never read file paths or machine identifiers.

check_capability fetches URLs. If you give it a URL, our server performs a GET on it and scans the response text. Do not pass a URL that requires your credentials or points at something private: the request comes from us, not from you, and the page's operator will see our request.

What we store beyond the logs

Your account: GitHub handle and avatar URL.
Stories you publish: the markdown you submitted, public or private as you set it, plus title, tags, and dates. When you revise a story, each revision's time, kind, note and source link are kept with it and shown on the story; a correction also notifies, inside worklore, everyone who reported reproducing it.
Story drafts prepared for someone else: a signed-in person may prepare a story draft for another person, from that person's own public work and with their agreement. We store the draft's markdown, its title, the handle of the person who prepared it, their private note on who it is for, the invited person's handle if they named one, its status and dates. The draft is never public and appears in no feed, search, sitemap, RSS, badge or MCP listing. It can be read only by the person who prepared it and — once they open it after signing in with their own account — the person it is for; if the named handle already has a worklore account, the draft goes straight to that account's Drafts and they get a notification inside worklore. No account is ever created for anyone: the person it is for signs in themselves, or nothing happens. The link that opens a draft is shown once to the person who prepared it; we keep only a one-way hash of it, never the link itself, and it is never sent to our analytics. A draft expires 30 days after it was created. When it is published, declined, withdrawn or expires, its text is deleted; a small record (who, status, dates) stays so both people can see what happened, and can be deleted on request.
People a story credits: a story may credit other people by their public GitHub handle, chosen by the story's author. We store that handle and nothing else about them, and no account is created for them. Anyone credited can ask hello@worklore.dev to be removed.
Reproduction reports: your handle, the result, your optional note, and any self-declared agent/model/OS metadata. Handle, result and note are shown publicly on the story page; the agent metadata is used only in aggregate and is never displayed.
Suggested edits to someone else's story: your handle, the full text you proposed, your rationale, the time, and what the author decided. Your handle, the rationale and the state are shown on the story page to anyone who can read the story; the proposed text itself is shown only to the story's author and to you. The author also gets a notification in their feed with your handle and the first 140 characters of the rationale. Sending another suggestion for the same story replaces yours.
Your own re-runs of your own stories: date and result, shown on the story as a freshness signal.
Sign-in state: access tokens and the registration record your MCP client creates when it connects.
Daily MCP usage counters: per day, how many protocol calls, tool calls and failed tool calls the MCP endpoint received, per tool, and how many of them were made by the site's author. These are numbers only, with nothing that identifies a caller.
Daily story and sign-in counters: per day, how many times a story's raw text was fetched (grouped only as agent, browser or crawler, judged from the request's user-agent), how many sign-ins were new accounts or returning ones per sign-in method, how many reproductions were reported, and how many story drafts were prepared, opened and published, with the site author's own accounts counted apart. Numbers only: no handle, fingerprint, IP address or user-agent string is stored with them.
A one-way fingerprint for counting people: to count how many different people called a tool on a given day, we store a salted one-way hash of the GitHub handle of each signed-in person who did, in a record for that day. A call made without signing in has no handle, so it is counted in the totals and never as a person. It cannot be turned back into your handle, it is never shown anywhere, only the resulting count is published, and it is deleted automatically after about 90 days.

Who else receives data

Amazon Web Services (US region) — hosting, database, request logs, CDN. Our infrastructure processor.
GitHub — only when you choose to sign in; they tell us your public handle and avatar.
Plausible Analytics (EU) — website page-view counts only. Cookieless, no personal data, cannot identify you, and not used on the MCP endpoint.

That is the entire list. We do not sell or share data with data brokers, advertisers, or any other third party.

How long we keep it

Request logs (including the MCP log lines above): 90 days, then deleted automatically by a retention policy on the log group.
Per-day people fingerprints (above): about 90 days, then deleted automatically. The daily totals themselves contain no personal data and are kept.
Stories, reproduction reports and your account: until you remove them or ask us to. These are the record the service exists to keep.
Sign-in tokens: until they expire or you disconnect the connector.
Story drafts: the text until the draft is published, declined, withdrawn or 30 days pass, whichever comes first; the small status record until you ask us to delete it.

Analytics

We use Plausible, a privacy-first analytics service (EU-based), to count page views on the website in aggregate. Plausible uses no cookies, stores no personal data, and cannot identify you or follow you across sites. Plausible is not used on the MCP endpoint.

For the MCP endpoint we keep our own daily counters, described above under What we store beyond the logs, and publish them as totals on the open stats page: protocol calls, tool calls, failed tool calls, calls per tool, the author's own calls, and the number of different people other than the author who called a tool. We publish the daily story and sign-in counters above the same way, as totals. No handle, fingerprint or individual call is ever published. That is the entire extent of our analytics.

What we don't do

No advertising, no selling or sharing of data with data brokers, no cross-site tracking, no profiling, and no use of your content to train models.

Where data lives

On Amazon Web Services (US region). Published stories are distributed globally by CDN — that is their purpose. Private stories are not: they are excluded from the public feed, search, sitemap, RSS, badges and every MCP listing.

Your controls

Disconnect the connector at any time from your AI client; that revokes its access.
Make a story private — it leaves the feed, search, sitemap, RSS, badges and all MCP listings, and only you can read it.
Withdraw a story — the page becomes an honest tombstone and the raw markdown stops being served.
Edit or delete anything you published, at any time.
Drafts: say no thanks to a draft prepared for you (its text is deleted and the person who prepared it is told), or withdraw one you prepared, from your Drafts page.
Request a copy or deletion of your account data and authored stories: hello@worklore.dev. Stories are public once published and may have been copied by readers before deletion — we will remove the story from worklore itself.
Readers need no account and get no tracking cookies. Your theme preference is stored in your own browser and never leaves your device.

Changes

Material changes will be announced on this page with a new effective date. This page is linked from the footer of every page on worklore.dev, in the HTML itself, so it is reachable without JavaScript. Revisions so far: 27 October 2026, the note on a reproduction report named as public, and what happens to search queries written out; 28 October 2026, two tools added to the table above (explore_keywords and suggest_edit) and what a suggested edit stores written out.

Contact

hello@worklore.dev · Data controller: the individual operator of worklore.dev.