Privacy policy: TidyFetch MCP server

Effective November 9, 2026. Operator: ProjectHax LLC (contact: [email protected]). Covers the MCP server at https://mcp.tidyfetch.com/mcp, its sign-in and sign-up pages, and TidyFetch MCP keys.

What we collect

• Account data: the email address you give us (free sign-up or Stripe checkout) and your key's plan and status. Keys are stored only as SHA-256 hashes; we can't read your key after it has been shown to you once.
• Payments: handled by Stripe. We receive the checkout email, Stripe customer/subscription ids and payment references needed to activate, renew, cancel or refund a key. We never see card details.
• Usage: for each tool call we record the key id, the tool name, the time and its duration, to enforce quotas and rate limits. We do not store the tool arguments (URLs, domains, app ids) or the results.
• OAuth: when you connect a client (e.g. Claude) we store the client's registration (name, redirect URLs) and hashes of the access/refresh tokens issued to it.
• Logs: our web server keeps access logs (IP address, time, path, status) for up to 30 days for security and abuse prevention. Keys, tokens and Authorization headers are redacted from these logs.

What the tools do

The tools fetch publicly accessible web pages and public store/job-board APIs on your request and return the content to your AI client. Requests come from our server, identified as TidyFetchBot. Your conversations with your AI assistant are never sent to us; we only receive the tool arguments of each call, which are processed in memory and discarded.

How we use data

Only to provide the service: deliver and validate keys, meter usage, prevent abuse, send transactional emails (via Resend) and answer support requests. No ads, no selling or sharing of personal data, no analytics trackers.

Processors

Stripe (payments), Resend (transactional email), DigitalOcean (hosting, United States), Cloudflare (DNS only).

Retention and deletion

Account and usage records are kept while your key exists and for up to 12 months after it ends (tax and fraud records may be kept longer where the law requires). Email [email protected] to access, correct or delete your data, or to revoke a key or connected client.

Changes

We will update the effective date above when this policy changes.