Data handling by surface
What each surface receives, what it records (read from code, not from intent), retention, and the provider. As of . This page supports the privacy policy; it does not replace it. All threat models.
Summary
| Surface | Receives | Records | Retention | Provider |
|---|---|---|---|---|
| Site pages | An ordinary HTTP request for a page. Tool inputs stay in the tab. | No application code records anything. Request logs at the host and edge are outside our code. | Set by the providers; not stated by us, not testable here. | Static host (DreamHost, by the deploy workflow); Cloudflare in front. Google Fonts is contacted by pages whose CSP still allows it. |
| MCP endpoint | Tool name, arguments and client headers for each call. | Operational metadata only, in Cloudflare Analytics Engine: for each tool call, tool name, network number (ASN), outcome, correlation id, latency, chain depth; at initialize, client name, client version, user agent, ASN. No arguments, no outputs, no IP address in these writes. | Analytics Engine dataset mcp_tool_calls: retention is the platform's default and is not set in our config. Persisted invocation logs are on; their content and retention are Cloudflare's. |
Cloudflare (Workers, Analytics Engine, Queues, rate limiting). |
| Ledger | Receipts the visitor loads; they stay in the tab. | Nothing server-side. In the browser: localStorage for a filter choice, a dismissed-demo flag and pending escalation entries. |
Until the visitor clears site data. | Same static hosting as the site pages. Anchor and signature requests go to the anchor relay. |
| Anchor relay | A hash (or timestamp query) the visitor chooses to anchor; for signature requests, a record hash, a role and a short message. | No logging or storage in the Worker source. The rate limiter keeps a counter keyed on IP. | Ours: none beyond the rate-limit window. Authorities keep what they stamp under their own terms. | Cloudflare (Workers); third-party authorities: FreeTSA, DigiCert, Sectigo, Sigstore, GitHub, OpenTimestamps calendars, Sigsum log operator. |
MCP telemetry wording
The wording used here is operational metadata, the same term the privacy policy uses, and the list above is exactly what the two writeDataPoint calls in the worker pass. If the agent-facing copy settles on a different term, this page will be changed to match it.
Weekly checks and renewal checks
A weekly scheduled job in the MCP worker runs internal self-checks over demo fixtures and passes the results through a Cloudflare queue. A renewal check for an artifact a visitor has chosen to anchor is run by a Cloudflare Workflow, whose platform state is held for a short period by Cloudflare. The privacy policy describes the renewal checks as processed and discarded; the Workflow's own retention is Cloudflare's and is not set by us.
Limits of this page
Numeric retention periods for provider logs and the full sub-processor lists of each provider are left out, because we neither set nor measure them. The DPA, standard contractual clauses, EU representative and data-subject process are not yet published; see the index.