Privacy notice

Effective date: 4 November 2026

AgentCV (agentcv.ai) is a public registry of AI agent teams. In this notice, "AgentCV", "we" and "us" mean the operator of the site. The notice describes what the site collects and does today, as it is built and set up now. If we change how the site handles personal data, we will update this page first.

Questions, corrections and removal requests: hello@agentcv.ai.

The short version

  • You can read the site without an account.
  • You sign in with Google or GitHub. We keep your name, your verified e-mail address, a link to your profile picture and your account ID at that provider.
  • What you put on your owner profile, teams and agents is public. Your sign-in e-mail address is not.
  • Setup requests, contact messages and claims go to AgentCV. A team's owner sees your name, e-mail address and message only if you tick the box that says so.
  • The site sends no e-mail today.
  • We use Vercel Web Analytics. Our code sets no analytics cookies and passes it no names, e-mail addresses or text you type.
  • The site runs no ads and loads no advertising or third-party tracking scripts.
  • To correct or remove your data, e-mail hello@agentcv.ai.

Signing in

  • How. With Google or GitHub. Signing in with a link sent by e-mail is not available. We may add it later, and we will update this notice before we do.
  • What we receive and keep. Your name, the e-mail address that Google or GitHub says it has verified, a link to your profile picture, that provider's ID for your account, which of the two you last signed in with, and when your account was created. If the provider has not verified your e-mail address, the sign-in is refused and nothing is stored.
  • From GitHub, also your username. We keep it only in your sign-in cookie, not in our database. We use it to suggest your handle when you register a team.
  • What we never get. Your password. We also do not store the access tokens that Google or GitHub issues when you sign in.
  • Why. To run your account: to show which profiles and teams are yours, to attach your claims to you, and to show you your notices.
  • Your picture. While you are signed in, your browser loads your profile picture from Google or GitHub to show it in the menu.

What is public

  • Public: everything shown on team, agent and owner pages. That includes:
    • the owner's display name, handle, bio and website;
    • each team's and agent's name, tagline, roster, roles, models, platform, how it was built, oversight, costs, proof and evidence links, lessons, versions, wiring, and the files the owner makes public;
    • attestations: the author's name, link, relationship and statement;
    • follower counts.
  • Filled in for you, and editable before you submit. Your display name starts as your sign-in name. Your handle becomes your page address (agentcv.ai/owners/your-handle). It starts as your existing owner page's handle or, if you signed in with GitHub and it is free, your GitHub username. We never make a handle from your e-mail address.
  • Not public:
    • your sign-in e-mail address;
    • who you follow;
    • setup requests, contact messages and claim notes;
    • private files. Before a file can be made public, it is checked for secrets and personal details;
    • your confidential terms, which are stored encrypted;
    • your API tokens, which we store only in a one-way scrambled (hashed) form, and the record of which token made which change.
  • The "State of AI Agent Teams" page and its data file show counts and shares across teams only. They name no team, owner or person.

Profiles we write from public sources

  • AgentCV writes some team pages itself, from public sources such as a post in which an operator describes their own team. These pages state only what the source says and link to it. They can name a person or organisation the way the source names them.
  • These pages say "Documented by AgentCV from public sources".
  • If one is about you or your team, use "Claim it" or "Ask us to remove it" on the page, or e-mail hello@agentcv.ai.
  • What removal does. We hide the team and its agents everywhere on the site, including lists, search, comparisons, badges, share images, the site's API and its MCP server. We do not delete the record. We keep it, with a note of who asked for the removal, when and how, so that the page is not added again by mistake.

Requests and messages

  • Setup requests (the "Request a setup" form, and "Request this setup" on team pages): your name, e-mail address and message. Optionally also a budget range, a timeline and up to three teams. If you are signed in, your name and e-mail address are filled in for you. AgentCV reviews every request.
  • Sharing a request with a team's owner. If a team you name has an owner with an AgentCV account, the form shows an unticked box: "Share my name, email and message with this team's owner so they can reply to me directly."
    • If you tick it, that owner can read your name, e-mail address and message on their account page, signed in. This covers only people who already owned the team when you sent the request. Once an owner has read your details, they may keep their own copy.
    • Before we save a shared request, we check your message for things like passwords, API keys and card or bank numbers. If we find one, we refuse the request, so you can remove it or untick the box.
    • If you don't tick it, the owner gets only a notice on the site that a request mentioned their team. The notice does not include your name or details.
    • If no team you name has an owner yet, there is no box, and only AgentCV sees the request.
  • Contact messages (the contact forms on team, agent and owner pages, including removal requests): your name, e-mail address and message. They go to AgentCV. If the page's owner has claimed it, that owner gets a notice on the site that shows your name only, not your e-mail address or message.
  • Who reads them. AgentCV's admins, in the site's admin pages.

Claims

  • When you claim an owner profile, we store the claim, your account, the note you add to help us verify you, the claim's status, and our decision with any note we write about it.
  • We refuse a note that seems to contain a secret, or a card, bank or national ID number. E-mail addresses, phone numbers and links are kept, because they help us verify you.
  • AgentCV's admins see your name, your sign-in e-mail address and your note. You see the claim and its decision on your account page.

Notices on the site

These appear on your account page.

  • If you follow a team or agent, you get notices when it changes, for example new proof, a new attestation or a new version.
  • If you own a team, you also get a notice when:
    • someone follows it (the notice doesn't say who);
    • a setup request mentions it (without the requester's details);
    • someone sends a contact message about your page (with the sender's name only).
  • A claimant gets a notice when their claim is decided.
  • AgentCV's admins get notices with the name of the person who sent a request, a message or a claim. For a claim from an account with no name, the notice shows the account's e-mail address instead.

E-mail

The site sends no e-mail today. Code for a few plain-text notification e-mails exists, but it is switched off. Before we switch it on, we will update this notice to say who gets which e-mail and which provider sends it.

Preventing abuse

  • Public forms. When you send a setup request or a contact message, we record your IP address in a counter in our database. It allows 5 sends per hour from one address.
    • When the same address sends again after that hour, the old counter is deleted.
    • Counters that are not reused stay until we clean them up. That clean-up is a manual step that we have not automated yet.
  • Signed-in actions are counted per account, not per IP address.
  • The MCP server counts requests per IP address for one minute. The count is kept only in the memory of the server answering the request. It is never written to our database, and it is gone when that server stops.
  • The handle check while you register is counted per account, in server memory.

AgentCV's MCP server

  • agentcv.ai/mcp is a read-only server for AI agents. It answers questions about public profiles and can check a team profile that an agent sends it. It stores nothing that is sent to it, and it sets no cookies.
  • Our log line for each request records only the method, the tool name, the response status and how long the answer took. It does not record your IP address, what you sent, or your request headers.
  • Registration links. When an agent asks the server for a link to finish registering a team, it sends the team profile to the server. The server receives the profile so that it can check it, and neither stores nor logs it. The profile goes into the link itself, after the "#" sign. Browsers do not send that part of a link in their requests, but it is not encrypted: anyone who has the link can read the profile. The registration page reads it in your browser and fills in the form for you to review. Before you press submit, the page keeps your unfinished registration in this browser tab (see "Browser storage"), and, if you are signed in, asks our server whether the handle you chose is free, sending only the handle. Pressing submit is the only step that saves the team to our database, and our server checks it again by its own rules.

Analytics

  • We use Vercel Web Analytics. It counts page views and a few named events:
    • which of our buttons and links was clicked;
    • which registration step was reached;
    • why a registration could not be submitted;
    • when a claim was started or sent;
    • when a team was registered: whether it is a portfolio or a work team, its platform group, whether it gave a proof link, and whether its form was filled in by hand, from a pasted or uploaded file, or from an agent's link;
    • which share button a team's owner used, and whether on the team page or on their account page;
    • when an agent's registration link was opened: whether it filled in the form or why not, and whether the page could remove the profile from the address bar.
  • Before the analytics script sends a page view or an event, our code removes the part of the page address after "?" and the part after "#". The only part after "?" it keeps is the campaign source tag (utm_source), and only when its value is one of our fixed campaign names, the same list as the agentcv_utm_source cookie below. For example, a search you type on the search page or in the team list is not sent.
  • For page views and events on the pages only an owner sees, such as a team's files and its edit page, and for events on a team's, an agent's or an owner's page, the address names the kind of page, not which team, agent, owner or file.
  • An address that is not one of our pages, such as a mistyped one or a page that no longer exists, is sent as a fixed placeholder, not as typed.
  • Vercel also records the address of the site that linked to us, as your browser reports it (usually only that site's domain).
  • Besides the page address, cleaned as described above, and the address of the site that linked to us, the events carry only fixed labels: no names, e-mail addresses, handles, other links or text you typed.
  • The analytics requests go to our own site's address, so your browser sends our site's cookies with them, including the sign-in cookies, as it does with every request to agentcv.ai.
  • Our code sets no analytics cookies. The analytics script itself comes from Vercel and runs on our site. Vercel decides what the script records and how long Vercel keeps it.

Cookies and browser storage

Cookies. Sign-in does not work without the sign-in cookies.

  • __Secure-authjs.session-token keeps you signed in. It is encrypted, and it holds your account number, name, e-mail address, picture link and, if you used GitHub, your GitHub username. It expires after 30 days without use and is renewed while you use the site.
  • __Host-authjs.csrf-token and __Secure-authjs.callback-url protect sign-in. The site sets them on most visits, even when you are not signed in. They end when you close your browser. __Secure-authjs.callback-url also holds the address of the page you return to after signing in, which can be one of your own pages, such as your team's edit page, or the registration form's address with its options.
  • __Secure-authjs.state, __Secure-authjs.pkce.code_verifier and __Secure-authjs.nonce: some of these are set while you sign in with Google or GitHub. They last 15 minutes.
  • agentcv_utm_source is set if you arrive through a link tagged with one of our campaign names, for example ?utm_source=hn.
    • It holds only that name, from a fixed list, and lasts 30 days.
    • If you register a team in that time, we save the name with the team, so we can see which channels work.
    • It is never shown on the site.
  • Our badge images, which other sites can embed, set no cookies.

Browser storage. These stay in your browser, and our code does not send what is stored there to us. What you submit, and the handle that the handle check sends, reach us as described above.

  • An unfinished team registration, and which of its steps analytics has already counted, in this browser tab only. It is deleted 2 hours after your last change, when you submit, when you sign out, or when you close the tab.
  • A comparison you choose to save: the addresses of 2 or 3 public teams. It is ignored after 30 days, and "Clear" removes it.

Server logs

  • Vercel, which hosts the site, records the requests it serves in its own logs, for example the address requested, the time and the IP address it came from. Vercel sets how long these logs are kept.
  • Our own log lines leave personal data out where we can:
    • for setup requests and contact messages, they hold only record numbers and error types;
    • for sign-in, an e-mail address appears only masked, like v***@example.com.
  • When something fails unexpectedly elsewhere, the log can hold technical details of the error. In rare cases these can include part of what was submitted.

Service providers

The site uses these providers:

  • Vercel hosts the site and runs Web Analytics. The site's server code runs in Vercel's US West region (Portland, Oregon, USA).
  • Supabase hosts our database, which stores the data described in this notice.
  • Google and GitHub handle sign-in when you choose them, and serve your profile picture.
  • AI tools. We use AI assistants to help run AgentCV: to find and summarise public sources for the profiles we write, to review code, and to count totals for our own reports. We do not give them the contents of setup requests, contact messages or claim notes.

Your data may be stored and processed outside your own country.

How long we keep it

  • Your account: as long as it exists. You can't delete it yourself on the site yet. To delete it, e-mail us.
  • Published content: until you change it or it is removed. Owners can't delete a team themselves on the site yet. To remove one, e-mail us.
  • Requests, contact messages and claim notes:
    • Our rule is to replace the name, e-mail address and message text with a placeholder 180 days after a request arrives. For a claim, it is 180 days after the decision, or after the claim was sent while it is still undecided.
    • We keep only the record itself: its date, status, the teams it named, and any budget or timeline choice.
    • Notices that show a sender's name follow the same rule.
    • This clean-up is not automatic yet. It is a manual step, so details can stay in our database past 180 days until we run it.
    • Shared details leave the team owner's account page after 180 days either way.
  • IP addresses in counters: see "Preventing abuse".
  • Logs: as long as Vercel's service keeps them.
  • Backups: backup copies of our database can hold data for a while after it is removed from the live database.

Your choices

  • Read the site without an account.
  • Edit your own profile and teams at any time while you are signed in.
  • Leave the sharing box unticked, and only AgentCV sees your request.
  • Unfollow at any time.
  • E-mail hello@agentcv.ai to ask for a copy of your data, a correction, the deletion of your account, or the removal of a page. We may ask you to confirm from the account or e-mail address the request is about.
  • Block or clear cookies in your browser. Sign-in won't work without the sign-in cookies.

Children

AgentCV is a professional registry. It is not meant for children, and it does not ask anyone's age.

Changes

When we change this notice, we post the new version here and change the effective date.

Contact

One address for everything below: hello@agentcv.ai

  • Questions about a profile or its content
  • Corrections and removal
  • Partnerships
  • Press