Privacy
Last updated: 14 October 2026
Known Good operates knowngood.sh, a search index of publicly available agent-readiness signals. This page explains what we collect, why, and what you can ask us to do about it.
What we do not do
We set no cookies. We run no analytics scripts and no third-party trackers. We do not sell data, we do not serve advertising, and we do not accept payment for placement in the index.
The site runs one piece of JavaScript: a single first-party script on the homepage that registers in-browser tools for AI agents (WebMCP). It renders nothing, stores nothing, sets nothing, and contacts no third party — every request it makes is to this site's own API. Every page renders fully with JavaScript disabled.
When you search
We log each query to operate and protect the service: the query text and any filters, the number of results, how long the query took, a salted hash of your IP address, your browser's user-agent string, and the time. The hash lets us apply rate limits and detect abuse without storing your IP address itself, though it should still be treated as personal data. Those rows are written by calls to the API (/api/find), the MCP server and the A2A endpoint, including an MCP client’s connection handshake, and each also records which of them was called and, when the caller uses an API key, that key in place of the hash; the search box on this site’s home page writes no row. Our lawful basis is legitimate interests — running a functioning, non-abusable public service and understanding what the index is asked for. Query logs are kept for 90 days and then deleted.
When you contact us
If you request a probe, join the verification waitlist, or email us, we store the hostname you gave, your email address and the time. We use it only to reply and to carry out what you asked for. We keep it until the request is resolved and for a reasonable period afterwards, or until you ask us to delete it.
When an agent registers
Agents may register for higher rate limits. We store the issued key, a label and usage counters so the limits can be applied. Each registration also records the time, the same salted hash of your IP address that we log for searches, your browser's user-agent string, the first characters of the issued key, a claim token and whether the registration has been claimed, so that registrations can be audited and claimed by email. We ask you for nothing personal to register; the salted hash and the user-agent string described above are recorded automatically.
Infrastructure
The site runs on Cloudflare, which processes requests on our behalf and keeps its own operational logs for security and network purposes. Email is delivered through our email provider.
Information about websites in the index
The index describes websites, not people. We record what a public web page and its public files say, and what our probe observed when it checked. Where a website is run by an individual — a sole trader, for example — that information may amount to personal data, so the same rights below apply to it.
Our probe identifies itself as KnownGood-Verifier with a contact URL. It
honours robots.txt. It never probes and never lists a site that declares
ai-input=no. If you run a site and want it removed, or want us never to check it,
the routes are set out at /bot, or email us and we will action it.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct or delete it, or object to our processing it. Email hello@knowngood.sh and we will respond within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
If this page changes materially we will update the date at the top.