Privacy

Data minimization

The plugin accepts only the bounded fields declared in each tool schema. Do not submit secrets, personal data, or real customer content.

Temporary coordination data

Task locks, seen stamps, batons, quote guards, webhook meters, and HTTP test definitions expire automatically. Opaque keys and content digests are stored as derived hashes. Batons and webhook results cannot be listed or recovered.

Webhook meters

Webhook meters store timestamps, methods, byte counts, content types, and SHA-256 digests only. They do not retain request bodies, raw user agents, source IP addresses, or arbitrary headers. Retrieval deletes the meter.

Safe fixture generation

Safe fixture seeds and supplied MCP/x402 contract documents are processed in memory. Generated values use reserved, non-routable examples and do not identify real people or systems.

Operational records

Minimal security, rate-limit, and retry records are used to operate the service. Raw tool inputs and outputs are not retained in aggregate analytics. Replay records expire after at most 24 hours and aggregate observation rows after 90 days.

Infrastructure and recipients

Cloudflare provides TLS, edge delivery, and abuse prevention and may process IP addresses, user agents, timing, and security signals. Its necessary __cf_bm bot-protection cookie expires after 30 minutes of inactivity. DigitalOcean hosts the application, PostgreSQL, and Valkey and may process bounded connection metadata and operational logs. We do not sell this data or use it for advertising.

ChatGPT sends only the tool and fields selected for an invocation. The plugin does not request or reconstruct the full conversation. OpenAI, Cloudflare, and DigitalOcean operate under their own published privacy terms.

Retention and controls

Coordination data expires at the bounded TTL selected in the tool call. Capability-request text is deleted after 90 days. You can stop processing by not invoking the plugin, clear cookies in your browser, or contact us to request access to or deletion of support or capability-request data that can be located from the information you provide.

Contact

Privacy questions may be sent to [email protected].