Privacy

Last updated 2026-11-13. This page covers the Distill service at data.spencermcw.com: the API, the MCP endpoint and these pages. It says what the code actually does.

In short

• No accounts, no cookies, no scripts, no analytics, no third-party fonts or trackers.
• Our database never stores your IP address, your wallet address, or what you looked up (the codes, ZIP codes, addresses, drugs or crypto addresses in a request).
• We keep one row per call with coarse facts about it, to bill and to see which datasets get used.
• We do not sell data, or share it beyond the services listed below. Through Claude, a tool call sends us that tool’s arguments and ordinary request headers, never your conversation.

What we store for each call

For each call to a data route, over HTTP or as an MCP tool call, one row with:

• the time, the route, the HTTP status, how long it took and the method version of the answer;
• a hash of your IP address (for IPv6, its /64 network), keyed with a random secret that is replaced every UTC day. Once the day’s secret is deleted, nobody, including us, can link the hash to an address or to your calls on other days;
• for a paid call: the amount, asset, network, the transaction hash, and a hash of the paying wallet address keyed with a fixed secret, so repeat payers can be counted. The transaction itself is public on the Base blockchain, where anyone can see the paying address;
• for a call from Claude’s connectors (Anthropic’s published IP ranges): the label “anthropic”, and for an MCP tool call that carries an MCP session id (older MCP clients), a hash of that id keyed with the same daily secret;
• coarse labels: HTTP or MCP; a client type from a fixed list (such as “claude”, “python” or “browser”) picked from your User-Agent; a referrer type (such as “search” or “github”) picked from the Referer’s host; our own ?via= tag if the link had one; whether and how the free tier was used; whether the answer was a web page; and whether the input was one of our published examples.

We do not store the User-Agent, the Referer, the query string, the request body or the answer.

Free-tier counters

To give a few free answers a day, we count free answers per UTC day and per data family, under the day’s IP hash; MCP tool calls from Claude’s connectors are counted in one total per data family for all of them together (and, for older MCP clients that send a session id, also under the day’s session hash). Calls to the free routes are counted the same way, under the day’s IP hash, as an abuse limit. These counters and the day’s secret are deleted when the next UTC day starts (on its first request).

Other counts

• Visits to the home page, /status, llms.txt, openapi.json and a few other fixed pages: a count per day, page and client type. No IP, hash or query string.
• Payments refused because the paying address is on OFAC’s sanctions list: a count per day. The address is checked in memory and not kept.

Logs

The server logs startup messages and errors; an error line carries a request id, the route and the error message. It does not log request bodies, IP addresses, wallet addresses, User-Agents or answers.

Who else sees what

• Railway hosts the service, its database and the storage bucket our datasets are published to. Every request passes through Railway’s network, so Railway sees your IP address and the request, and keeps its own request logs under its own privacy policy.
• Coinbase (the CDP x402 facilitator) receives a paid call’s signed payment, which names the paying address, the amount and the route’s URL path but not your inputs, to verify it and settle it on Base. Coinbase’s x402 Bazaar lists our routes from those settlements.
• Anthropic: when you use Distill in Claude, Claude sends us the tool call. What Claude keeps is covered by Anthropic’s privacy policy.
• Amazon SES sends the operator an email when a dataset is stale. It names only datasets and dates.
• GitHub builds a weekly report of aggregate counts from the database and keeps it, privately, for 90 days.

Nobody else. We use no ad or analytics services and sell no data.

How long we keep it

• Call rows: kept without a set end date, since they are the billing ledger. Their IP and session hashes cannot be linked to anyone once their day is over.
• Free-tier counters and the daily secret: until the next UTC day starts.
• Weekly aggregate reports: 90 days.

Health questions

Medicare and drug lookups take codes, ZIP codes, counties and drug names. We do not store them.

Contact

Questions or requests: bot@spencermcw.com. Changes to this page are listed in the changelog.