Privacy Policy

DReview (dreview.co) is a free directory of open-source MCP (Model Context Protocol) servers and Skills, owned and operated by Yaeris Digital Services (Registration No. 002999014-K), 33-01, 33rd Floor, Menara Keck Seng, 203 Jalan Bukit Bintang, 55100 Kuala Lumpur, Malaysia. This policy explains what personal data we collect when you use the site, why we collect it, who we share it with, and the choices and rights you have over it.

We're based in Malaysia, so Malaysia's Personal Data Protection Act 2010 (PDPA) is our home legal framework. Because DReview has visitors from around the world, we've also written this policy to line up with common international expectations — including the EU/UK GDPR — for anyone browsing from those regions.

Account information. If you create an account to submit a tool or manage a listing, we collect your email address and a password (handled by our authentication provider, Supabase — we never see or store your password in plain text) and, optionally, your name and GitHub username if you provide them.

Submission content. If you submit an MCP server or Skill listing, we store what you enter: the tool's name, description, category, install configuration, and any use cases or FAQs you write. This becomes part of a public listing if approved.

Usage analytics. We log anonymous view and click events against tool listings (for example, "this listing was viewed" or "this listing's install tab was clicked") to power basic analytics on the Creator Dashboard and the homepage's "Trending" section. These logs record the listing and event type only — not who visited, no IP address, no account link.

Security and fraud-prevention data. To stop automated abuse of our sign-in and sign-up forms, we temporarily log the IP address associated with authentication attempts, purely to enforce a rate limit (a cap on how many attempts can be made in a short window). This data isn't accessible through the site itself and is only used for this security purpose.

Cookies and similar technologies. We use cookies and comparable technologies for essential site functionality (keeping you signed in), and — via Google Tag Manager — for analytics and advertising, described in the Cookies & Advertising section below.

To create and manage your account, and to let you submit, edit, and track your own tool listings.

To operate the free directory itself: displaying approved listings, powering search and filtering, and showing aggregate (never individually identifying) usage stats like view counts.

To send you transactional email — account confirmation and similar operational messages — via our email provider, Resend. We don't send marketing email through this system today.

To protect the site from spam, fraudulent submissions, and automated abuse, including through Cloudflare Turnstile (our bot-detection tool on sign-in and sign-up) and the rate-limiting described above.

To understand how the site is used in aggregate, and to run advertising campaigns to grow DReview, as described in the next section.

DReview runs advertising campaigns to reach developers who might use the directory, and we use Google Tag Manager (GTM) to deploy the tracking tags that support this. Through GTM, we currently use or may use, from time to time: Google Analytics (GA4) for site analytics, Google Ads, LinkedIn Ads, and Meta (Facebook/Instagram) Ads for advertising and conversion tracking, and we may add other advertising or analytics platforms as our marketing needs change.

These tools typically use cookies or similar identifiers (like a browser or device ID) to measure ad performance, understand which pages are popular, and show you more relevant ads on other sites after you've visited ours — a practice generally known as retargeting. Each of these providers is a separate company with its own privacy policy governing how they process this data; we encourage you to review Google's, LinkedIn's, and Meta's own privacy policies for details on their specific practices.

We do not sell your personal data to advertisers. Advertising platforms receive aggregated or pseudonymous signals (such as "a visitor from this ad campaign viewed this page") through their own tracking pixels and cookies, not a direct handoff of your name, email, or account details from us.

You can control cookies through your browser settings, including blocking or deleting them, though doing so may affect site functionality like staying signed in. Where legally required (for example, for visitors in the EU/UK), we intend to add a cookie consent mechanism that lets you opt out of non-essential cookies before they're set — if you're visiting from a region with that requirement and don't see a consent prompt yet, please treat non-essential tracking as something you can decline by adjusting your browser's cookie and tracking-protection settings in the meantime.

We rely on a small number of specialist providers to run DReview, each processing data only for the specific purpose described:

Supabase — our database and authentication provider. Stores account credentials (with passwords hashed, never in plain text), creator profile data, and all listing content.

Cloudflare (Turnstile) — bot-detection on our sign-in and sign-up forms, to keep the site free of spam accounts.

Resend — sends transactional email on our behalf, such as account confirmation messages.

Vercel — hosts the website itself and serves every page you view.

Google Tag Manager, and the analytics/advertising platforms deployed through it (Google Analytics, Google Ads, LinkedIn Ads, Meta Ads, and similar) — described in Cookies & Advertising above.

GitHub — when a listing links to a project's GitHub repository, visiting that link takes you to GitHub directly, governed by GitHub's own privacy policy, not ours.

Each provider only receives the data necessary for their specific function, and we choose providers that publish their own security and privacy commitments.

We keep your account and listing data for as long as your account remains active. If you delete a listing, it's removed immediately along with its associated use cases, install configs, and FAQs. If you'd like your account and associated personal data deleted entirely, contact us at the email below and we'll process that request.

Aggregate view/click analytics are not tied to an identifiable person and are retained to power the Creator Dashboard and homepage Trending section for as long as the associated tool listing exists.

Rate-limiting records (IP addresses logged against authentication attempts) are kept only briefly — long enough to enforce the rate-limit window — and aren't retained for any other purpose.

Depending on where you're located, you may have the right to access the personal data we hold about you, correct it, request its deletion, object to certain processing (including for advertising purposes), or request a copy of it in a portable format.

You can update your account name and change your password directly from your Creator Dashboard's Settings tab at any time. For anything else — including a full data-deletion request, or questions about our advertising and analytics practices — email us at support@yaeris.com and we'll respond as promptly as we can.

We use industry-standard practices to protect your data: all traffic to DReview is encrypted in transit (HTTPS), passwords are hashed by our authentication provider rather than stored in plain text, and our database enforces row-level security policies so that, for example, a creator can only read or edit their own account and listings, not anyone else's — enforced by the database itself, not just application code.

No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable, real steps to protect your information rather than relying on trust alone.

DReview is a developer tool directory intended for a professional and technical audience. It isn't directed at children, and we don't knowingly collect personal data from anyone under 13 (or the relevant minimum age in your jurisdiction). If you believe a child has provided us with personal data, contact us and we'll remove it.

Our service providers — Supabase, Vercel, Cloudflare, and others — operate infrastructure in multiple countries, which means your data may be processed outside Malaysia, including in jurisdictions with different data protection laws. Where this happens, we rely on our providers' own compliance frameworks (such as standard contractual clauses or equivalent safeguards) for cross-border transfers.

As DReview grows — new features, new advertising platforms, new service providers — this policy will change to reflect that. We'll update the "Last updated" date at the top of this page whenever we do, and material changes (like a new significant use of your data) will be reflected here directly rather than announced separately, so it's worth checking back periodically.

Questions about this policy, or a request relating to your personal data? Email support@yaeris.com, or write to us at Yaeris Digital Services, 33-01, 33rd Floor, Menara Keck Seng, 203 Jalan Bukit Bintang, 55100 Kuala Lumpur, Malaysia.