Privacy Policy
mcphost is operated by Joseph Yen (contact below). This page describes what the service stores and why. The design principle is minimal collection: signup asks for a name string and nothing else — no email, no web forms, no analytics scripts, no advertising trackers.
What we store
- Tenant records: the display name given at signup, a tenant id, timestamps, plan, and a SHA-256 hash of the bearer key (never the key itself).
- Tools: the specifications and code a tenant publishes, as required to execute them.
- Secrets: values a tenant stores via
host.secret_set, encrypted at rest with AES-256-GCM. - Call and usage records: per-call metadata (tenant, tool, timestamp, duration, outcome) and tool logs, used for metering, quotas, billing, debugging, and abuse prevention.
- Network data: IP addresses appear in rate-limiting state and short-lived server logs, used for abuse prevention.
- Billing data: payments are processed by Stripe; we store plan status, Stripe customer and event identifiers, and a ledger of billing events. We never see or store card numbers. Stripe's handling is described in its own privacy policy.
Where it lives
Service data is stored on servers we rent from Hetzner in Germany (EU). Backups are kept on the same infrastructure. Our subprocessors are Hetzner (hosting), Cloudflare (DNS and, if enabled, email forwarding), and Stripe (payments).
What we do with it
We use stored data to run the service, meter and bill usage, enforce quotas and the acceptable-use policy, debug problems, and secure the platform. We do not sell data, share it for advertising, or use tenant code or data to train models.
Legal basis and your rights
We process data to perform the contract created at signup and for our legitimate interests in securing and improving the service. If you are in the EU/EEA, in California (CCPA/CPRA), or in a jurisdiction with similar rights, you can request access to, correction of, or deletion of data associated with your tenant by contacting us from a position that demonstrates control of the tenant (a signed request via the tenant's key, or the billing identity). Deleting a tenant removes its tools, secrets, and records except ledger entries we must keep for tax and accounting.
Retention
Tenant data persists while the tenant exists. Terminated or deleted tenants' data is removed within 30 days, except billing ledgers retained as legally required. Server logs rotate on a short schedule.
Changes
Updates appear on this page with a new date.