Privacy Policy

1. Overview and Scope

This Privacy Policy applies to the static website (egemenyucelen.me) and the hosted EuroLeague Analytics Model Context Protocol (MCP) server operated by Egemen Yücelen. It explains how information is handled when you browse the site or authenticate to query the basketball warehouse.

2. Website Browsing and Zero-Cookie Policy

When you visit egemenyucelen.me:

• Zero Cookies: We do not set or read any cookies (session, tracking, or persistent) on your browser.
• No Analytics Trackers: We do not embed Google Analytics, Meta Pixels, tracking beacons, or telemetry scripts.
• Self-Contained Assets: All stylesheets and fonts are self-contained and served directly from the site domain.

3. Authentication and OAuth Token Processing

The hosted MCP server (https://euroleague-analytics-mcp.fly.dev/mcp) provides authenticated read-only access to our database. When connecting via Google OAuth or Auth0:

• Purpose of Authentication: Authentication is required solely to verify that a connecting client possesses the required read permission (read:warehouse) and to protect database infrastructure from denial-of-service abuse.
• Token Validation: Access tokens (JWTs) are validated in memory against the identity provider's JSON Web Key Set (JWKS). We verify signature authenticity, token audience (aud), issuer authority (iss), and expiration.
• No Profile Harvesting: We do not store your real name, email address, profile picture, or social graph.

4. Durable Per-Subject Row-Budget Storage

To ensure fair warehouse availability and prevent automated scraping sweeps, the server enforces a daily quota of 50,000 returned rows per subject per UTC calendar day.

To enforce this policy across server restarts, the server records an accounting ledger in PostgreSQL (public.mcp_row_usage) via a dedicated, isolated database role:

• Stored Fields: The token's subject identifier (sub), the UTC usage date, the operation type (reserve/settle), and the integer count of rows returned.
• No Query Content Stored: This ledger stores zero prompt text, zero query arguments, zero search criteria, and zero personal information.

5. Necessary Third-Party Infrastructure Providers

To provide reliable hosting, DNS resolution, and security, EuroLeague Analytics relies on the following infrastructure providers:

• Auth0 / Google: Provides OAuth 2.0 / OpenID Connect identity validation and token issuance.
• Fly.io: Hosts the containerized MCP HTTP server instance in the European Union region.
• Supabase (PostgreSQL): Hosts the basketball analytics warehouse and row-budget accounting ledger in Frankfurt, Germany (EU region).
• GitHub Pages: Hosts the open-source repository and static website files.
• Cloudflare: Provides DNS routing, TLS termination, and edge CDN delivery for egemenyucelen.me.

6. Data Sharing and Sale

We do not sell, rent, monetize, or disclose user connection identifiers or usage data to any third parties or advertisers.

7. Contact and Inquiries

For any questions regarding this Privacy Policy or data handling practices, please contact:

Egemen Yücelen
Email: [email protected]
GitHub: github.com/egemeny13/euroleague-analytics