DRAFT for legal review. Not in effect. Bracketed items [like this] need decisions.

Privacy Policy

Last updated: [date]. Operator: [legal entity name, address]. Contact: privacy@toolfindr.dev

What we collect

• Account data: your email address, and if you sign in with GitHub, your GitHub user ID and login. We use the GitHub token only to read your identity at sign-in and do not store it.
• Inventory data: the MCP servers you add, their settings, and an audit log of actions (adds, removals, tool calls by name, token refreshes). We do not store the arguments or results of your tool calls beyond processing each request.
• Upstream credentials: API keys and OAuth tokens you connect. These are encrypted at rest (AES-256-GCM with a per-user key) and decrypted only to call the server you chose.
• Agent connections: OAuth grants you approve for AI agents (client name, scopes, timestamps).
• Technical data: IP address and request metadata, used for security and rate limiting. [Retention: e.g. 30 days.]
• Public tracker: data about public MCP servers from the official MCP Registry, GitHub, and our own health checks. This is not personal data about you.

How we use it

To run the service, keep it secure, prevent abuse, and improve rankings. Aggregated, anonymized reliability statistics (for example "server X succeeded 98% of calls") may feed public scores. We do not sell personal data, and we do not use your tool-call contents for advertising or model training.

Processors

Cloudflare (hosting, storage, compute), [email provider, e.g. Resend] (sign-in emails), GitHub (sign-in, if you choose it). [Add analytics, if any.] When you connect an upstream MCP server, your requests go to that third party under its own privacy policy.

Your rights

You can export your data at /app/account, and you can delete your account there at any time. Deleting removes your inventory, credentials and audit log, and revokes agent connections immediately. [Backup retention: N days.] EU/UK and California residents have additional rights (access, correction, deletion, objection). Contact us to use them. [Legal basis under GDPR: contract / legitimate interests. EU representative, if required.]

Cookies

We use only essential cookies: a session cookie and short-lived sign-in state cookies. No advertising cookies.

Children

The service is not directed to children under 16.

Changes

We'll post updates here and email account holders about material changes.