Privacy policy

Last updated: October 17, 2026

This policy covers the dailyalpha.xyz website and the free dailyalpha MCP server at mcp.dailyalpha.xyz: what data is processed when you use them, why, for how long, and your rights.

Summary

• dailyalpha has no accounts, no sign-up, and no newsletter yet. The site and the MCP server set no cookies of their own.
• Cloudflare hosts the site and the MCP server. It processes your IP address and request data to deliver and protect them.
• For visitors outside the European Union, Cloudflare Web Analytics counts page views and measures load times, without cookies.
• The MCP server has no storage. Its logs contain no IP addresses and no tool arguments, and its rate limit keeps only a salted hash of your IP address, in memory.
• If you write to the contact address, your message is used only to answer you.
• dailyalpha does not sell your data, does not share it for advertising, does not use it to train AI models, and does not use it to profile you.

Who is responsible

Publisher and controller: dailyalpha. Contact: hello@dailyalpha.xyz.

The website

• The site is a set of static pages on Cloudflare Pages. It has no accounts and no form that sends data: the newsletter form is disabled and sends nothing.
• The pages load only files from dailyalpha.xyz, except the Cloudflare Web Analytics script described below. There are no third-party fonts, ad networks, social media widgets, or tracking pixels.
• The page script reads the time zone and the language of your browser to hide referral links from visitors who seem to be in the United Kingdom. This happens only in your browser: the script sends nothing and stores nothing.
• dailyalpha sets no cookies and uses no local storage in your browser.

Cloudflare: hosting, delivery, and security

Every request to dailyalpha.xyz and mcp.dailyalpha.xyz passes through the network of Cloudflare, Inc. To deliver the pages and the answers, and to protect them from abuse, Cloudflare processes your IP address and request data: for example, the address requested, the time, the user agent of your browser, the referring page, and the country derived from your IP address.

• Cloudflare records these requests, and the requests that its security features block. The publisher can see these records, or samples of them, in the Cloudflare dashboard for up to 31 days, and uses them only to run and protect the site and the server.
• Cloudflare checks requests for signs of abuse, for example with its Browser Integrity Check. If Cloudflare shows your browser a security check, it can set a strictly necessary cookie, cf_clearance (see Cloudflare cookies).
• Cloudflare can ask your browser to report network errors (Network Error Logging). If your browser supports this and cannot load a page, it can send a short error report to Cloudflare.

Cloudflare Web Analytics

Cloudflare Web Analytics is on for dailyalpha.xyz, in the mode that excludes visitors from the European Union. For visitors outside the EU, Cloudflare adds its script (from static.cloudflareinsights.com) to the pages of the site, except the disclaimer page and this page. The script measures page views, load times, and Core Web Vitals, and sends them to dailyalpha.xyz. Cloudflare also records the country (from your IP address), the referring site, and the type of browser, operating system, and device. The publisher sees statistics, for example page views by page, country, or browser. Cloudflare states that Web Analytics uses no cookies or local storage and does not fingerprint visitors. Cloudflare keeps the detailed data for 7 days and a reduced sample after that; the statistics stay available for six months.

The MCP server (mcp.dailyalpha.xyz)

• The server is a Cloudflare Worker. It needs no account or key, and it has no database or other storage: the board data is part of its code.
• Your MCP client sends requests with a tool name and arguments, for example search words, filters, or an id. The server uses them only to build the answer, and it does not keep them.
• Rate limit: to stop abuse, the server keeps a request counter for each client in the memory of the running Worker instance. The key of the counter is a salted SHA-256 hash of your IP address (for IPv6, of its /64 network), never the address itself. The salt is random for each instance. The counters are never written to storage or to logs. They are deleted when the instance stops, or earlier when the table is full (at most 10,000 entries).
• Logs: the server writes one line per request, with technical fields only, for example the route, the HTTP and MCP methods, the protocol version, the tool name, the status code, and the response time. These lines never contain IP addresses, user agents, origins, tool arguments, search words, or ids.
• Workers Logs, the Cloudflare feature that stores the logs and the request details of a Worker, is off for this server, and no logs are exported. The live log view of Cloudflare shows requests only while the publisher has it open, and it is not stored.
• A Cloudflare rate limiting rule also counts the requests to /mcp and /health for each IP address and Cloudflare data center. Above 20 requests in 10 seconds, it blocks the next requests from that IP address to /mcp and /health for 10 seconds, and Cloudflare records the blocked requests as security events (see above).
• The server answers with Cache-Control: no-store and Referrer-Policy: no-referrer, and it creates no sessions.

Email

Messages to hello@dailyalpha.xyz pass through Cloudflare Email Routing, which forwards them to the private mailbox of the publisher at an email provider. Cloudflare records each message (sender, recipient, subject, time, delivery status, and the results of its spam and authentication checks), and the publisher can see this record for 31 days. dailyalpha uses your email address and your message only to answer you, for example to correct an entry or to handle a privacy request. It keeps them only as long as needed for that.

Links to other websites

The board links to third-party projects. When you open one of these links, you leave dailyalpha, and the terms and the privacy policy of that project apply. Your browser can tell the linked site that you came from dailyalpha.xyz. A referral link also contains a code that tells the project that you came from dailyalpha. The project decides what it records about your sign-up and what it reports to dailyalpha as the referrer.

Who receives the data

Cloudflare, Inc. hosts the site and the MCP server and forwards the email. For these services, Cloudflare processes data on behalf of dailyalpha, for example the content that it carries and the records that it shows to the publisher. For other purposes, it acts as an independent controller, as described in the Cloudflare privacy policy. The email provider of the publisher stores the forwarded emails. dailyalpha gives your data to no one else, unless the law requires it.

International transfers

Cloudflare is a U.S. company with a global network. Your data can be processed in a Cloudflare data center near you and in other countries, including the United States. Cloudflare says that it mainly stores personal information in the United States and the European Economic Area. For transfers from the EEA, Switzerland, and the United Kingdom to the United States, it relies on the EU-U.S. Data Privacy Framework and its Swiss and UK versions, with standard contractual clauses as a fallback (section 7 of the Cloudflare privacy policy). The email provider of the publisher can store forwarded emails in another country.

Legal basis

dailyalpha processes these data on the basis of its legitimate interests (GDPR, Article 6(1)(f); LGPD, Article 7, IX): to deliver the site and the MCP server, keep them secure, measure their use in aggregate, and answer your messages.

How long data is kept

• Rate limit counters of the MCP server: only in the memory of the running Worker instance (see above).
• Log lines of the MCP server: not stored.
• Cloudflare records of requests, security events, and emails: kept for the publisher for up to 31 days.
• Cloudflare Web Analytics: detailed data for 7 days, then a reduced sample; statistics for six months.
• Your emails: as long as needed to answer you and to do what you asked.
• Data that Cloudflare keeps for its own purposes: see the Cloudflare privacy policy.

Your rights

Under the GDPR (European Union and European Economic Area), the UK GDPR, and the LGPD (the General Data Protection Law of Brazil), you can ask dailyalpha to confirm whether it processes your personal data, and ask for access, correction, deletion, restriction of processing, and a portable copy. You can also object to processing based on legitimate interests. To use these rights, write to hello@dailyalpha.xyz. dailyalpha has no account data about you: to find Cloudflare records about you, give the IP address and the date and time of your visit.

You can also complain to a supervisory authority: in Brazil, the ANPD (National Data Protection Authority); in the EU or the EEA, the data protection authority of the country where you live or work, or where you think the problem happened; in the United Kingdom, the ICO (Information Commissioner's Office).

Age

dailyalpha is intended for adults aged 18 and over.

Changes to this policy

When this policy changes, the new version replaces this page, with a new “Last updated” date. dailyalpha will update this policy before any new processing starts, for example before the newsletter opens.

Contact

Questions and requests about privacy: hello@dailyalpha.xyz.