2026-09-16
Moved to dealpages.app · privacy notice and terms
- Dealpages now lives at dealpages.app: this site at the apex, sign-in and the MCP endpoint at app.dealpages.app, published pages at pages.dealpages.app.
- Every existing page link keeps working — the old pages.kylelegare.com addresses redirect to the same page, same token. MCP clients still pointed at app.kylelegare.com keep working too; update them when convenient.
- New: a plain-language privacy notice and terms of service, linked from every page of this site. They describe exactly what the code does.
- claude.ai can now connect with a sign-in instead of a key: add app.dealpages.app/mcp as a custom connector, sign in with your email, press Allow. Standard OAuth 2.1, so other clients that support MCP sign-in work too; API keys keep working exactly as before. Connected apps are listed on your account page with a Disconnect button.
- Account page rebuilt for new users: three-step onboarding, a detail page per deal page with every stakeholder link and a copy button, reversible Unpublish and Kill-link buttons, key labels, and delete-my-account.
- New MCP tool revoke_link (14 tools now); mint_link and list_links return a share block with a ready-to-paste line per person.
- Your own visits no longer count: open a page's preview link once and that browser is yours — checking Sarah's link afterwards records nothing.
- Every hosted page now has a Report this page link in its footer, next to the analytics disclosure, which now links to the privacy notice.
- Abuse limits: sign-in links, beacons, comments and reports are capped per network; publishes are capped per account per hour; 100 live pages per account and 200 links per page. The limits are generous for real use and the errors say what to do.
- Retention: fine-grained engagement events are now pruned after 180 days (raw request logs were already pruned at 90). Comments and page versions stay with the page.
- Under the hood: the console session cookie is now host-locked so a published page can never interfere with it; page-password cookies no longer carry the password hash; an account can be disabled, which takes its pages offline and its keys out of service; deploys run from GitHub on every merge.