Privacy policy

Last updated: 2026-11-08

Local mode

When you run the server yourself, your CSV files, store profiles, snapshots and credit ledger stay on your machine under ~/.stockcash-mcp/. The local server makes no network calls. We never see your data.

Hosted mode

When you use mcp.yourdomain.com, the CSV content you send is processed in memory by the hosted server to produce the report. We do not write your raw CSV files to storage and do not log request bodies. Store profiles and snapshots you create through hosted tools are stored on the hosted server, isolated per account, so a weekly digest can work; delete them with store_profile.

What we store for accounts

• Email address and a hashed password or magic-link identity (Supabase Auth).
• Plan, credit allowance, usage events and API keys (stored so the dashboard can show them).
• Stripe customer id and subscription status. Card data never reaches us; Stripe handles it.
• Local license keys, mirrored so the dashboard can show yours.

Sub-processors

• Supabase — authentication and account database.
• Stripe — payments, invoices and tax.
• Cloudflare — site hosting, gateway and rate limiting.
• Fly.io — hosted MCP compute and per-account storage.
• Resend — optional transactional email for license keys.

Retention and deletion

Account data is kept while the account exists. Email hello@stockcash.dev to delete an account; we remove profiles, keys, usage and hosted snapshots, and cancel the Stripe subscription. Licence keys already issued stop working at their printed period end.

No tracking

The marketing site uses no cookies, analytics or third-party scripts. The sign-in pages load Supabase’s client library from a public CDN.

This page is a starting template, not legal advice. Add your company name, address and jurisdiction before launch.