Privacy policy
Last updated
This policy explains what "Every CVE" (the "Service") collects, at everycve.com and through its API and MCP server.
Using the Service
You don't need an account. Anonymous requests are rate limited by IP address. IP addresses and search queries are never saved.
Accounts
You only need an account to get an API key or connect an MCP client. You can sign in with GitHub or an emailed link. Your account holds your email address, your GitHub user ID if you use GitHub, a randomly generated avatar, and hashes of your API keys and sign-in tokens.
If you connect an MCP client, your account also holds the name that client gave itself, its identifier, when you connected it and hashes of its tokens, so that you can see and disconnect it. Clients that register themselves are kept for up to 30 days even if no one connects them, holding only the name and addresses they sent.
We use your email address to sign you in and to contact you about your account.
Cookies
The Service uses cookies to keep you signed in and to show your avatar, and your theme choice stays in your browser.
Third-party services
The Service relies on these providers, each under its own policy:
- Amazon SES delivers sign-in links.
- Cloudflare is the Service's CDN.
- DuckDuckGo serves link favicons.
- GitHub handles sign-in, if you choose it.
- PlanetScale hosts the Service's database.
- PostHog provides anonymous usage analytics.
Changes and questions
We'll update this policy when things change, and the date above will show when. For questions, email [email protected].