Privacy Policy

What I collect, and what I do not


Privacy Policy

What I collect, and what I do not

Who I am

I am Daniel López. I run TweetFeed alone, from Spain. I am the data controller for tweetfeed.live, api.tweetfeed.live, and mcp.tweetfeed.live. I process personal data under the EU General Data Protection Regulation (GDPR) and the Spanish LOPDGDD.

No accounts

TweetFeed has no accounts and no login. The website, the API, and the MCP server do not ask for your name, your email address, or a key. I set no cookies.

Your browser

The website saves your light or dark theme choice in your browser. It saves nothing else. My servers never read it.

Analytics

The website uses Umami, which I host myself at s.tweetfeed.live, Ahrefs Web Analytics, and Cloudflare Web Analytics. All three work without cookies. They keep only aggregate counts of page views, referrers, and coarse device and country data. Umami does not store your IP address. None of them uses fingerprinting. The legal basis is my legitimate interest (Art. 6(1)(f) GDPR).

The API and the MCP server have no browser analytics. When a known AI agent calls the API, the API sends one event to my Umami. The event holds the path and a shortened User-Agent. It holds no IP address.

Logs and rate limits

Cloudflare serves all requests. It sees your IP address and User-Agent, and it applies a rate limit of 50 requests in 10 seconds for each IP.

The access logs at the CDN and host level hold your IP address, User-Agent, request path, and referer. I use them for abuse prevention, troubleshooting, and rate limiting. They are short-lived, typically 30 days or less. The legal basis is my legitimate interest (Art. 6(1)(f) GDPR).

The API also counts single-IOC lookups (/v1/ioc) for each IP. It does not block them today. When one IP sends more than 20 in a minute, the API writes one log line with that IP address, User-Agent, and request path.

Cloudflare Workers Logs is on for the API and the MCP server. It can record the request URL and status for a short time (days). For a lookup, the URL can contain the value you look up. The MCP server writes no log lines of its own and does not read your IP address.

The data

The IOCs come from public posts on X. I do not read private messages or protected accounts. For each IOC, I keep the post link and the handle of its author as source data. I keep the IOC dataset, with the handle, with no expiry date, as a public archive. The data is public domain (CC0 1.0).

Researcher avatars

TweetFeed shows the public X profile picture of each researcher who is active in the today, week, month, or year windows. I get the picture from unavatar.io and cache it as a static image at tweetfeed.live/pics/*.png. Your browser loads the image from tweetfeed.live. If the cached image is missing, your browser loads that picture from unavatar.io instead. I delete the image 180 days after the researcher leaves the active windows. The legal basis is my legitimate interest (Art. 6(1)(f) GDPR).

Sharing

I do not sell or rent your data. I do not share it beyond the third-party services below. I send no personal data about visitors to X or to those services beyond what they need to serve the request or render the page.

Third-party services

I use these services. Each one has its own terms and privacy policy.

  • Cloudflare, Inc. - DNS, CDN, DDoS protection, Cloudflare Web Analytics, and the Worker behind api.tweetfeed.live. It processes all requests to TweetFeed.
  • GitHub, Inc. - GitHub Pages hosts the website. GitHub also holds the public data repository and the public issue tracker. Issues are public.
  • Ahrefs Pte. Ltd. - cookieless analytics at analytics.ahrefs.com. It receives the page URL and the referrer, and stores no personal identifiers.
  • unavatar.io - source of the researcher avatars. I cache each image. If a cached image is missing, your browser loads it from unavatar.io.
  • cdnjs (run by Cloudflare) - delivers only the highlight.js library. Only the /hunt/ page loads it.
  • X Corp. - the embedded posts on /dashboard/ load from platform.twitter.com.

Your rights and contact

You have the right to access, rectification, erasure, restriction, and portability of your data. You can also object to processing that is based on my legitimate interest. To use a right, contact me as described below. You can also complain to the Spanish data protection authority (AEPD).

To contact me, send an X DM to @0xDanielLopez or open a GitHub issue. A GitHub issue is public, so do not post private data in it. I use what you send only to reply to you about TweetFeed. TweetFeed has no email address.

Last updated: 24 October 2026