Legal

Privacy Policy

Last updated: August 21, 2026

This policy covers newsmcp.com, the sign-in and API-key platform at platform.newsmcp.com, and the API endpoints they call at api.newsmcp.com. It is published by NewsCatcher, Inc. ("NewsCatcher", "we", "us"). NewsCatcher's other websites, including newscatcherapi.com, are covered by a separate policy.

In short

You can read this site and use the playground without an account and without telling us who you are. If you want an API key you create an account, and then we hold your email address and the keys issued to you — nothing more than is needed to run the account. On the marketing site we set no cookies of our own; analytics scripts do. Our host records ordinary server logs, and a playground search briefly counts your IP address so one visitor cannot exhaust the service for everyone else.

What we collect

Server logs. Our host, Vercel, records the standard information any web server receives: IP address, user-agent string, the page or endpoint requested, referring page, and a timestamp. We do not combine this with anything else to identify you.

Analytics — only if you agree. Google Analytics does not run and sets nothing until you accept it. On your first visit you are asked; decline and the tag is never loaded. You can change your mind at any time with the cookie control in the footer of every page — switching it off also deletes the two cookies below if they were already set. The record of your choice is kept in your browser's own storage, not in a cookie, and is never sent to us.

When you do accept, most pages load Google Tag Manager, which holds exactly one tag: Google Analytics 4, measurement ID G-PEJ40XJLQP, firing when the page initialises. It sets two cookies — _ga and _ga_PEJ40XJLQP — which distinguish one browser from another so that visits can be counted rather than double-counted. The container holds no advertising, social or session-recording tags: nothing from Meta, LinkedIn, Hotjar or anything similar.

Separately, and outside Google Tag Manager, the site runs Vercel Web Analytics, served first-party from /_vercel/insights/. It sets no cookies and does not follow you across other websites; it counts page views and reports aggregate figures such as browser and country.

The playground page currently loads neither.

Rate-limiting counters. When the playground fetches news, the request passes through our own endpoint, which counts requests per IP address so that automated abuse cannot spend the service's capacity. Your IP address is used as a lookup key in a Redis store operated by Upstash and expires automatically after 10 minutes. A second counter records only a total number of requests per calendar day, with no IP address attached, and expires after 48 hours. Neither is used for any other purpose and neither is combined with analytics.

Search terms. Anything you type into the playground search box is sent to our news API in order to return results, and appears in the server logs described above. Do not enter personal or confidential information into it: it is a search box for public news, and there is no reason for it to receive anything sensitive.

No cookies of our own. Our own code sets no cookies. The only cookies this site ever sets are the two Google Analytics cookies named above, and only after you accept them. We do write one thing to your browser's local storage — whether you accepted or declined, and when — because there is no other way to remember not to ask you again. Blocking or clearing it costs you nothing except being asked once more.

Account information. To obtain an API key you create an account at platform.newsmcp.com. Depending on how you sign in, we receive:

Email and a password, if you register directly. The password is stored only as a salted hash by our authentication provider; neither they nor we keep the password itself, and nobody at NewsCatcher can read it.
Email only, if you use a magic link — our authentication provider emails you a single-use sign-in link instead of anyone holding a password at all.
Email, name and profile picture, if you sign in with Google. Google tells us these; we do not receive your Google password, and Google's own privacy policy governs what it does with the fact that you signed in.

API keys and their use. We generate and store the API keys issued to your account, and we record request counts against them so that quotas and rate limits can be applied and so we can investigate abuse.

Staying signed in. Once you sign in, the platform keeps a session token in your browser so you are not asked again on every page. It is strictly necessary to run the account — without it there is no way to know you are signed in — so it is not covered by the analytics choice described above. Signing out discards it.

No payments yet. There is no paid plan on this site at present, so we collect no card or billing information. If that changes, this policy will be updated before the feature ships.

Why we process it

To create and operate your account, issue API keys, and apply the quotas attached to them.
To serve the site and keep it available and secure — including detecting and blocking abuse of the API endpoint.
To understand aggregate usage, so we know which documentation and features are worth improving.
To answer you, if you contact us.

For visitors in the EEA and the UK: our legal basis for account information is the performance of our contract with you — we cannot issue you a key without it. For server logs and rate limiting it is our legitimate interest in operating and protecting the service. For analytics cookies it is your consent, given through the banner and withdrawable at any time from the footer control on every page.

We do not sell personal information, and we do not share it for advertising or cross-context behavioural advertising. We use a small number of service providers that process data on our behalf:

Supabase — authentication and the database behind the platform, hosted in the United States (us-east-1). It holds your account record, the salted hash of your password if you set one, and the API keys issued to you, and it sends the magic-link and account emails.
Vercel — hosting, content delivery, server logs, and Vercel Web Analytics (first-party and cookieless, but processed by Vercel on our behalf).
Upstash — the Redis store holding the short-lived rate-limit counters described above, hosted in the United States (us-east-1).
Google — Tag Manager and Google Analytics 4 on the marketing site, and, if you choose it, Google sign-in.

We run no advertising or cross-site tracking tags of any kind.

We also disclose information where we are legally required to, or to protect our rights, safety, or the integrity of the service.

Where it goes

We are a United States company, and every provider named above processes data in the United States: Vercel, Upstash and Supabase are all in the US East region (us-east-1). Nothing is stored in the EEA or the UK.

So if you are in the EEA or the UK, your information is transferred out of your country. That transfer relies on the mechanisms our providers make available, including the European Commission's Standard Contractual Clauses.

How long we keep it

Account information is kept in our Supabase database for as long as your account exists. Close it, or ask us to close it, and we delete the account record and revoke its keys. Rate-limit counters expire on their own: 10 minutes for the per-IP counter, 48 hours for the daily total. Server logs and analytics data are retained by our providers for a limited period under their own retention policies, and we do not keep separate copies.

Links to news publishers

The playground links out to the publishers that covered a story. Those sites are not operated by us and have their own privacy policies. We send publishers only the fact that a visit came from newsmcp.com, not the page or query you came from, because this site sets a strict-origin-when-cross-origin referrer policy.

Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to object to or restrict our processing, to receive a copy in a portable form, and to opt out of its sale or sharing — we do neither. Exercising these rights will never cause us to treat you worse.

If you have never created an account we hold very little that could be linked to you, and the rate-limit counters expire within minutes, so there may be nothing to retrieve. If you do have an account, write to us and we can give you a copy of what it holds or delete it. To make a request, or to complain about how we have handled your information, write to team@newscatcherapi.com. If you are in the EEA or the UK you may also complain to your local data protection authority.

Children

This site is intended for developers and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

Security

The site is served over HTTPS with HTTP Strict Transport Security. API credentials are held server-side and are never sent to the browser. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes to this policy

We may update this policy. Material changes will be reflected in the "last updated" date above, and we encourage you to check it when you return.

Contact

Questions about this policy, or about the information we hold: team@newscatcherapi.com.

By post: NewsCatcher, Inc., 651 North Broad Street, Middletown, DE 19709, United States.