Privacy

The short version

• There are no accounts and no login, so there is nothing to sign in to.
• We set no cookies at all, which is why you never saw a consent banner here.
• Everything you publish is public, including the author name you type — and we do not verify that name.
• The part worth reading closely: text you type into Compose is sent to a third-party AI model provider. See “Compose and AI models” below.

What we collect

That is the complete list. We do not ask for your name or email to browse, publish or compose, and we do not buy or receive personal data about you from anyone else.

Publishing a workflow

When you share a workflow we store exactly the fields the form collects: the title, tagline, description, the apps involved with their roles and full setup steps (including any code snippets you paste), the flow steps, tags, difficulty, setup time, whether you marked it agent-installable, and the author name you typed. We add an id, a slug derived from your title, an upvote count and the time of submission. Nothing else — we do not attach your IP address to the row.

All of it is public immediately: on the workflow page, in the listing, and through our MCP endpoint and /llms.txt, which AI agents read. Two consequences are worth stating plainly:

• Do not paste secrets. API keys, tokens and passwords do not belong in setup steps. Write the step that tells someone where to get their own.
• The author field is free text and we do not verify it. Anyone can type any name, including yours. Treat a byline here as a claim by the submitter, not as something we have checked. Do not put personal information in it that you would not want published.

Compose and AI models

This is the most substantial thing we do with your data, so it gets its own section.

When you use Compose, the task description you write is sent, as you wrote it, to a third-party large language model provider. It travels through the Vercel AI Gateway, which forwards it to whichever model this deployment is configured to use — by default Anthropic’s Claude. Alongside your text we send a digest of the public workflow library (titles, taglines, app names and tags) so the model can match against it.

Nothing identifying is attached. We do not send your IP address, and there is no account or user id to send. Once your text reaches the provider, that provider’s own terms and retention practices govern what happens to it, and we do not control them.

We do not store your Compose input in our database. It is used to produce the response you see and is not written anywhere by us. If the model call fails we record the failure reason — not your task text — in our server logs so we can see what broke, and the site falls back to a plain rule-based match that involves no third party at all.

Practical advice: treat Compose the way you would treat any chat with an AI assistant. Describe the task, not the confidential details around it.

IP addresses and rate limiting

Three endpoints are open to anyone — Compose, publishing, and the MCP endpoint — so each one counts recent requests per IP address to stop runaway scripts. That counter lives in the memory of the server process handling your request. It holds your IP as a key for the length of the rate-limit window, which is one minute for Compose and the MCP endpoint and one hour for publishing, and it is discarded when the window passes or the process restarts.

It is never written to our database and never associated with anything you publish. Separately, and unavoidably for any website, our hosting provider processes your IP address in order to deliver the request and records it in standard server logs.

Cookies

We set no cookies. The site stores nothing in your browser — no cookies, no local storage, no session storage — so there is no consent banner because there is nothing to consent to.

We use Vercel Web Analytics to count page views. Vercel documents it as cookieless: it identifies a visit using a hash derived from the incoming request which resets every day, and it does not store that hash against your IP address, so visits cannot be linked across days or across other sites. We run no advertising, no third-party trackers and no cross-site profiling of any kind.

Who else receives data

NeonDatabase hosting

Stores the workflows table — that is, everything published through this site. Neon runs on third-party cloud infrastructure that may be located outside your country.

VercelApplication hosting and analytics

Serves every request, so it processes request metadata including your IP address as any web host does, and produces standard server logs. Vercel Web Analytics also runs here — see “Cookies” below for what it does and does not do.

An AI model provider, via the Vercel AI GatewayCompose only

Receives the task text you type into Compose. Which provider depends on the model this deployment is configured with; the default is Anthropic’s Claude. See “Compose and AI models” below.

CreemPayments — not live yet

When subscriptions launch, Creem will act as our merchant of record and handle checkout and billing data under its own privacy policy. Nothing is for sale today and no payment data reaches us or Creem at present.

These providers run on their own cloud infrastructure, which may be in a different country from you. We do not sell your data, and we do not share it with anyone beyond the list above.

No accounts, so no account controls

We want to be straight about this rather than promise controls we have not built. There is no login and no user record — our database holds one table, of workflows. So there is no account to delete, no settings page, and no export button, because there is no account behind them.

If you want a workflow you published taken down, or want to ask what we hold, email support@workflowsmcp.com with the workflow’s URL and we will handle it by hand. Because we do not verify who published what, we may need to ask you something that shows the submission was yours before we act on it. Depending on where you live you may have rights over your personal data under laws such as the GDPR or the CCPA; the same address is how you exercise them.

Children

WorkflowsMCP is not directed at children under 13 and we do not knowingly collect information from them. If you believe a child has sent us information — most likely by typing it into a published workflow — email us and we will remove it.

Changes to this policy

When this policy changes we update the date at the top of the page, and for a change that materially affects what we do with your data we will also post a notice on the site. Because we have no accounts we have no way to email you, so this page is the record — please check it rather than expecting a message.

Contact

Questions about this policy, or any request about your data: support@workflowsmcp.com.