Privacy policy

Information we handle

We process account information such as name, email address, sign-in records, and workspace membership. To provide hosting, we process submitted specifications, repository or image references, generated definitions, deployment settings, encrypted credentials, and billing records when a paid plan is used.

The gateway and runtime record operational metadata such as time, endpoint, tool name, request ID, authentication outcome, duration, status, resource use, and metered usage. Tool inputs and outputs pass through the hosted service to fulfill calls; the request history shown in the console is intended to store metadata, not full tool payloads. Users should still avoid putting unnecessary personal or sensitive information in tool arguments, specifications, repository code, or logs.

Why we use it

We use this information to authenticate users, build and operate requested MCPs, route tool calls, show operational history, enforce access and usage controls, process payments, prevent abuse, investigate incidents, and respond to support requests. Where an account holder asks us to generate a definition, source material is sent to the configured model provider for that generation. We do not publish a customer's MCP in an external directory without a separate publisher action.

Service providers and transfers

The service uses hosting, database and authentication, email, payment, and model providers as needed for the features you use. These include Hetzner for compute, Supabase for database and authentication, OpenRouter for requested generation, and Lemon Squeezy for configured checkout and billing. A deployed MCP may also contact the upstream services its owner configures. Providers may process information in countries outside yours. Their own notices and the applicable service agreements describe those arrangements.

Newsletter signup requests

When newsletter collection is enabled and you consent, we send your email address, consent version, signup source and submission time to the MCP Ops team’s Slack workspace for manual processing. The form does not verify email ownership or send a marketing email. Do not submit someone else’s address. Signup requests remain in Slack according to the workspace retention settings until the team processes or removes them. You can request removal through our support contact. Newsletter delivery, if activated, must provide a way to unsubscribe.

Cookies and local storage

Authentication uses essential session cookies. We also store a workspace selection cookie and, if you opt in, a browser-local preference for interface sounds. The product does not require you to enable sounds to use any feature. The blog also saves your reading appearance preference in local storage. Reading checklists stay in page memory and reset when you leave; they are not submitted to our servers.

Retention and security

Raw runtime events and runtime observations are pruned according to a configured period of 30 to 365 days. Aggregated usage, audit, account, deployment, and billing records may be kept longer when needed to run the service, satisfy legal obligations, resolve disputes, or protect security. Removing a workspace does not necessarily remove records that must be retained for those reasons. Credentials are encrypted at rest and access to platform systems is restricted. No system can promise absolute security.

Your choices and requests

You can update account and workspace details in the console, revoke issued keys, and remove deployments you control. To request access, correction, or deletion of personal information, or to ask about this policy, use the support contact provided when your account was created. We may need to verify your identity and may be required to retain some information.

Changes

We may update this policy as the platform changes. Material changes will be dated on this page and communicated when required. See also our terms of service.