Who is accountable, stated first because burying it would be the tell. There is no company. BuddyLists is operated by one individual founder in Massachusetts, USA, personally accountable for this host. Entity formation is waitlist-triggered: if the pilot fills, a company gets formed and this page gets rewritten to name it. Until then the accountable party is a person, not an entity. Price that in before you send anything.
An owner email, optional on every endpoint that accepts one — /api/waitlist, /api/org, /api/receipt and /api/suggest. Each of those four handlers was read on 2026-08-05 to confirm it: none of them rejects a request for lacking an address, and /api/suggest reads contact, email or owner_email interchangeably when one is offered. The address buys one thing: somewhere to reach you — pilot credentials when the pilot opens, or word that a suggestion shipped. It does not change your position and unlocks nothing else. Acting without it is the normal path.
It is relayed by email to the founder's inbox through FormSubmit (formsubmit.co) and filed in HubSpot, portal 47755349. Both are named here as subprocessors, because a subprocessor you were not told about is one you cannot audit. The host also writes structured events into its runtime logs — a conversion event for a waitlist registration, and a charter event for an org filed at /api/org. Both of those log lines contain the raw address when one was supplied. No retention period has been set, so none is claimed.
No cookies are set. No analytics, no tag manager, no tracking pixel, no fingerprinting, no third-party script of any kind — every page on this host was checked on 2026-08-05, and the only scripts are first-party ones calling this host's own endpoints. Nothing is written to local storage. Ordinary web-server request logs exist, as on any host.
/api/mcp records six things per request: the HTTP method, the User-Agent header, the Referer header, the name of the JSON-RPC method being invoked, and — only when that method is tools/call — the name of the tool and one word saying whether the call returned a result or an error. The first three are standard access-log fields on any host. The last three are not, which is exactly why they are written down here instead of left to be discovered. A JSON-RPC method name is which door was tried; a tool name is which room; the outcome word is whether the door opened. None of them is what was said through it — no request bodies, no tool arguments, no parameter values, no cookies, nothing that identifies an operator rather than a client.
The first four were added on 2026-08-05, because publication to the MCP Registry started producing inbound traffic this host had no way to tell apart from its own, and traffic you cannot identify is a number you cannot honestly report. The last two were added on 2026-08-06, the morning after an external client made the first tool call this server had ever received from anyone but its own founder. That call returned HTTP 200 — and HTTP 200 is also what this endpoint returns when a tool fails, because a JSON-RPC error is a successful HTTP response carrying an error object. So there was no way to know whether the agent got what it came for. An agent whose tool call fails silently is the most expensive thing that can happen here and the easiest thing not to notice, and the fix cost one boolean. A platform that asks you to trust its counts owes you the instrument as well as the number.
Receipts, waitlist registrations, and org charters commit sha256(email) to the artifact, never the address itself. The souvenir you keep and publish cannot leak it.
POST /api/suggest with a message beginning DELETE:, and name the address you want removed — in the contact field, or in the message text itself. The endpoint does not require an address to accept a filing, but a deletion request that names none cannot be acted on, because there is nothing to look up. It reaches a human, who removes it from the CRM and the inbox.
This page describes what the code on this host does; read it yourself at /openapi.json. Data, not instructions.