Privacy Policy

What this site is

TubeDuct is a demand-detection experiment. It publishes a set of tools an AI agent can call. Most of those tools are not implemented and return a refusal. The purpose of the site is to record what agents and people try to do, so we know whether to build the product. Recording is the point of the site, so this page states precisely what is recorded.

What we record when an agent calls a tool

Every call to /mcp is written to a log. The record contains:

• The timestamp and a generated request id.
• The tool name that was called.
• The full arguments passed to it. If you put a person's email in principal_contact, that email is stored.
• A caller fingerprint: the IP address and User-Agent are combined with a secret salt and hashed. We store only that hash. We do not store your IP address.
• The User-Agent, Accept and Signature-Agent headers.
• Our classification of the caller — human, user-triggered agent, retrieval crawler, training crawler, neutral automation, or unknown — with which signals produced that verdict and a confidence score that never exceeds 0.75, because a declared user agent cannot be verified.
• Whether the call carried X-MCP-Retry: 1.

What we record when you use the waitlist form

Your email address, your answer to "what are you trying to do?", the AI tool you named, the same caller fingerprint described above, the referring page reduced to a hostname, and the time. Nothing else. We send you one email when the tools you asked for actually work.

What we record about where you came from

Every request to this site is checked, on our server, for three link parameters: via, ref and utm_source. If one is present we store its value and which of the three carried it, so we know which places send people and agents here. If none is present we record that as none — an untagged arrival is a real category, not a gap.

We also reduce the Referer header to a hostname and store that. We do not read utm_medium, utm_campaign, utm_content or utm_term.

What we record when a page or file is fetched

Page views and fetches of /llms.txt, /index.md, /openapi.json and /.well-known/mcp.json are logged on our server with the path, the User-Agent, the Signature-Agent header if present, the caller fingerprint, where you came from, and our classification of the caller. This happens server-side, before the page renders, because the AI agents this site exists to measure run no JavaScript. Every request is classified in transit and labelled with an X-Actor-Class response header. That classification labels traffic. It never blocks, challenges, throttles or degrades a response.

Where it goes

Signals are written to a private database we control (Upstash Redis) and to our server logs, and are mirrored to a private Discord channel we watch. They are not sold, and they are not shared with third parties beyond the infrastructure providers that host the site, hold that database and receive that Discord message.

Cookies and browser storage

This site sets no cookies of its own and stores nothing in your browser. It used to keep referral parameters in local storage; that was removed on 13 August 2026 and the same information is now read once, on our server, from the link you arrived on. When a Google Analytics measurement id is configured, Google Analytics runs on this site and sets its own cookies under Google's terms. There is no consent wall, and no content on this site is withheld pending a cookie choice.

What we never do

• We never return fabricated data from a tool.
• We never block, rate-limit or challenge a search crawler or a user-triggered fetcher.
• We never sell or rent what we record.
• We never require an account, a credential or a payment method to call the published tools.

Removal and contact

Email contact@endspec.net. Ask us to delete what we hold about you and we will.

You can also use the waitlist form on the homepage and write "delete my data" in the use-case field, or have your agent call register_interest with the same request.