Technical privacy information

The remote service stores product account identifiers, hashes of account recovery credentials, workspace memberships, device metadata, OAuth client registrations, authorization grants, token lifecycle state, and request/result data required to route operations and resolve uncertain outcomes. Commands, file content, and tool results pass through the cloud service in remote mode. Native runtime state and process output also reside on the enrolled device.

Recovery credentials are displayed only when created or rotated; their plaintext is not retained by the account service. Device credentials and client OAuth credentials are separate. Protect them and do not put secrets into public packages or tool arguments. No email identity is inferred from a device, hostname, or browser profile.

Revocation stops future authorized dispatch and requests cancellation of affected active work. It does not erase previous effects, provider audit records, or all stored operation data. Cloudflare hosts the production service; the MCP client has its own data handling. Local stdio operation does not use the remote routing service. The separate desktop overlay retains activity timing and minimal device/modifier state, not typed text or keystroke histories.

Website analytics. Website pages currently include Cloudflare Web Analytics for page-view and browser-performance measurement. The browser loads Cloudflare’s analytics beacon and sends those measurements to Cloudflare. These website analytics are separate from the remote tool requests, file content and results described above. Cloudflare’s documentation describes the beacon’s collection and retention.

This page describes implemented technical behavior. A complete commercial offering also requires a verified publisher identity, contractual terms, and a defined retention and customer privacy policy.