Privacy Policy

1. What We Are

UCP Registry ("we", "us", "our") is a canonical registry of merchants, plugins, tools, extensions, vendors, and platforms building on the Universal Commerce Protocol (UCP). We are operated by PactMode.

2. Data We Collect About Websites

We collect publicly available information about websites' UCP implementations through automated crawling. This includes:

• UCP endpoint URLs and manifest data (from /.well-known/ucp)
• HTTP response status codes and response times
• Protocol version and declared capabilities
• Transport types (HTTP, MCP, embedded)
• AI bot access policies (parsed from robots.txt)
• Favicon images and extracted brand colors
• Benchmark scores from UCPChecker Playground

This data is sourced from UCPChecker's runtime verification system and synced daily. All data is derived from publicly accessible endpoints.

3. Data We Collect About Visitors

When you visit UCP Registry, we collect minimal data:

• Server logs: IP address, user agent, pages visited, timestamps. Retained for 30 days for security and abuse prevention.
• API usage: IP address and request counts for rate limiting (100 requests/day). No authentication or personal data required.
• Submissions: If you submit a listing or claim request, we collect the information you provide (name, email, entity details).

We do not use analytics services, tracking pixels, or advertising networks.

4. Cookies

We use only essential cookies:

• Session cookie: Required for authenticated features (account management).
• Appearance preference: Stores your light/dark/system theme choice.

We do not use third-party cookies, tracking cookies, or advertising cookies.

5. Embeddable Badges and Widgets

We provide embeddable SVG badges (/badge/{domain}.svg) and JavaScript widgets (/widget/{domain}.js) that merchants can place on their websites. When these are loaded by a visitor's browser, a standard HTTP request is made to our servers. We do not use these requests for cross-site tracking.

6. Registry IDs and Public Data

Every entity in the registry is assigned a permanent, public registry ID (e.g., UCP-M-000001). Entity data — including domain, status, capabilities, response times, and benchmark scores — is publicly accessible through the website and API. This data is factual information derived from public endpoints and is not considered personal data.

7. Data Sharing

We do not sell, rent, or share personal data with third parties. Registry data (merchant endpoints, capabilities, benchmarks) is publicly available by design — that is the purpose of the registry.

8. Merchant Removal Requests

If you are a merchant and wish to have your domain removed from the registry, contact us via our contact form. We will process removal requests within 7 business days. Note that removal from the registry does not affect your UCP endpoint's public availability.

9. Contact

For privacy inquiries, data removal requests, or questions about this policy, reach out via our contact form.