Privacy policy

• Account details. When you sign in, our sign-in provider, Clerk, gives us your email address and whether it is verified. If you sign in with Google, Google shares your name, email address, and profile picture with Clerk. We use only the email address.
• Deployments. The package, version, stage, status, timing, and redacted progress output of each deploy you start.
• Credentials you connect. A Cloudflare account you link is stored as an encrypted OAuth token. Pasted Cloudflare or GitHub tokens and secret parameter values are kept only while the deploy runs, or for up to 15 minutes while a signed-out deploy waits for you to sign in.
• Registry activity. Orgs, packages, versions, tokens, and trusted publishers you create, with an audit log of those changes.
• Technical data. Your IP address, used for rate limits and abuse prevention, and service logs.

We use this data to run deploys, operate the registry, keep accounts secure, prevent abuse, and count deploys for plan allowances and public package totals. We do not sell personal data, and we do not use it for advertising.

• Clerk handles sign-in and sessions.
• Google handles sign-in when you choose Google.
• Cloudflare hosts the service, its database, its file storage, and its logs.
• GitHub receives the repository a deploy pushes when you choose GitHub storage.
• Cloudflare Monetization Gateway processes paid MCP deploys.

• Run progress is deleted 24 hours after a deploy finishes.
• A paused signed-out deploy is deleted when its 15-minute sign-in window ends.
• Temporary deployment files and claim links expire after 30 days.
• A one-time Cloudflare sign-in grant expires after 30 minutes.
• Account, registry, and deploy records stay until you ask us to delete them.

You can unlink Cloudflare from your account page at any time, which revokes the token at Cloudflare. To get a copy of your data or delete your account, email us.

We will update this page when our practices change and change the date above.