Privacy policy

The website

When enabled, this site uses cookieless, privacy-friendly analytics (a Plausible/Umami-style endpoint) that measures aggregate page views and referrers only. It sets no cookies, stores no personally identifying information, and does not track you across other sites. Analytics is off entirely unless the site is built with the analytics environment variables, so previews and local runs never phone home.

Because no personal data or cookies are involved, the site does not show a cookie-consent wall. See the analytics disclosure for details.

The mcpfold CLI

The CLI is local-first and collects nothing by default — there is no network sink wired in the shipped tool. Telemetry is strictly opt-in: it is sent only if you set `MCPFOLD_TELEMETRY=1`, and it is forced off if you set `DO_NOT_TRACK=1` (the cross-tool convention) or `MCPFOLD_TELEMETRY=0`.

If you do opt in, each event is a fixed allow-list of non-identifying fields (such as which subcommand ran) and passes through the same secret redactor the rest of the tool uses, as a final guard. Your configuration contents and secrets are never collected.

The optional hosted cloud

The hosted team cloud is optional (and self-hostable). If you create an account, we store your account identifier (such as your email) and the configuration you choose to sync. That configuration carries secret references — placeholders like `${env:…}` — never the secret values themselves, which stay on your machine and are resolved locally.

We use the account data only to provide the service (authentication, sync, and the audit trail). We do not sell your data.

Legal bases for processing (GDPR)

For visitors in the EU/EEA and UK, we process the limited data described here on the following legal bases under the GDPR: performance of a contract (Art. 6(1)(b)) to operate the hosted cloud you signed up for — authentication, config sync, and the audit trail; our legitimate interests (Art. 6(1)(f)) in understanding aggregate, cookieless site traffic to improve the project, which is why analytics carries no personal data and honors Do-Not-Track / Global Privacy Control; and your consent (Art. 6(1)(a)) where you actively opt in, such as CLI telemetry or subscribing to updates. The local CLI processes no personal data at all.

Data sharing, processors and subprocessors

We do not sell personal data, share it for cross-context behavioral advertising, or share it with advertisers. Where the hosted service relies on infrastructure providers, they act as processors that handle data solely to run the service on our behalf under data-processing terms.

The subprocessors we currently use are: Supabase (managed Postgres, authentication, and hosting for the hosted cloud and edge service), Stripe (payment and subscription processing for paid plans — Stripe handles card data directly; we never see full card numbers), and Cloudflare (Pages hosting and CDN for the website). This list is kept current; material changes are reflected in the version and effective date above.

International data transfers

Our infrastructure providers may process data in the United States and other countries. Where personal data of EU/EEA or UK residents is transferred internationally, it is protected by appropriate safeguards such as the Standard Contractual Clauses offered by those providers. Because the CLI and all local software run entirely on your own machine, they involve no cross-border transfer.

Data retention

The website analytics is aggregate and non-identifying, so there is nothing personal to retain. For the hosted cloud, we retain your account data and synced configuration for as long as your account is active; when you close your account or ask us to delete it, we remove your account data (which cascades to the teams, machines, configs, and audit records tied to it), subject to any short retention required to meet legal, security, or billing obligations. Opt-in CLI telemetry events are non-identifying and retained only in aggregate.

Your rights and choices

The CLI and everything local require no account and collect nothing by default. For the hosted cloud, and to the extent the GDPR, UK GDPR, or US state privacy laws apply to you, you have the right to access a copy of your data, to correct inaccurate data, to delete your data, to receive it in a portable format, to object to or restrict certain processing, and to withdraw consent at any time. You will not be discriminated against for exercising these rights.

In the hosted app you can act on the two most common rights yourself: your dashboard has a "Download my data" button (a machine-readable JSON export) and a "Delete my account" button that permanently erases your account and everything synced with it. For any other request, email [email protected] from the address associated with your account; we respond within the timeframes the applicable law requires (generally within 30 days for GDPR and 45 days for California requests). You can also opt out of CLI telemetry at any time as described above, unsubscribe from any update emails, and opt out of website analytics by sending a Do-Not-Track or Global Privacy Control signal, which we honor automatically.

If you are in the EU/EEA or UK and believe we have not handled your data properly, you have the right to lodge a complaint with your local data-protection authority.

California and US state privacy rights

We do not sell your personal information and we do not share it for cross-context behavioral advertising, so there is no "sale" or "share" to opt out of under the CCPA/CPRA and comparable US state laws. California and other US-state residents still have the rights to know, access, correct, delete, and be free from discrimination for exercising them; use the same contact above to make a request. Because we honor Global Privacy Control, a GPC signal is treated as a valid opt-out preference.

Children's privacy

mcpfold is a developer tool intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

Contact and changes

For any privacy or data-protection question, or to exercise a data-subject right, email our dedicated privacy contact at [email protected]. This policy is versioned and dated (see the effective date above); material changes will update the version. You can also open an issue on https://github.com/dj-pearson/MCPFold.