Privacy

Effective August 2026. Written in plain language on purpose.

This website

No cookies, no analytics scripts, no trackers. The site is static pages. Standard server logs may record requests briefly for debugging and abuse prevention.

The Discoball API and MCP server

What's collected when your agent uses Discoball:

• Install ID. The npx discoball-mcp client mints a random UUID on first run and stores it on your machine at ~/.discoball/config.json. It's anonymous: no account, no email, no name. It exists so one install's checkout reports can't be counted twice and so report abuse can be rate-limited. Delete the file and you're a brand-new anonymous install.
• Query telemetry. Which merchant, product domain, or category was asked about, and which tool was called. Used to serve the request and to aggregate demand (“lots of agents want eyewear codes”). Queries are not tied to any identity beyond the install ID.
• Checkout reports. When an agent calls report_result: the deal, whether the code worked, an optional failure reason and amount saved. This is the core dataset: success rates are computed from it, so these records are retained.
• Hashed IPs. For rate limiting only, IP addresses are salted and hashed; the raw IP is not stored. Rate-limit records are deleted as their one-minute or one-hour windows expire.

What's never collected

No names, emails, or accounts. No payment details. No browsing history: Discoball only sees the specific query your agent sends it.

Retention and removal

Checkout reports and the aggregate statistics built from them are kept indefinitely, keyed only to anonymous install IDs. Rate-limit records expire within hours. To have everything associated with your install ID deleted, email hello@discoball.dev with the ID from your config.json.

Sharing

Data is not sold or shared with third parties. Aggregate, non-identifying statistics (like a code's overall success rate) are the product and are public by design.