Data Retention Policy

What we store

The only durable record is one row per account, holding:

• Email — your account identity, from Google sign-in.
• Endpoint token — a random secret for your personal MCP URL (not personal data).
• Connection tokens — your providers' OAuth refresh tokens, AES-256-GCM encrypted at rest.
• Preferences — enabled connectors and privacy settings.
• Connector credentials — API keys you enter for settings-based connectors, AES-256-GCM encrypted at rest.
• Created-at timestamp.

That is exactly your account and the connectors you chose. Encrypted tokens cannot be read from a database dump without our separate encryption key. Retention: for the life of your account, erased immediately on deletion.

What we never store

• Source data— emails, documents, analytics, calendar events. Fetched live per request, passed to your agent, and discarded. This holds in every mode, including “Send clear”: that only changes what the agent receives, never what we keep. We keep nothing either way.
• The pseudonymization mapping — the token↔value link lives only in session memory and is destroyed with the session. Stability comes from a derived per-account key, not a stored table.
• Prompts, responses, or agent output.

Session cache

Optional and off by default. If you enable it, tool results are held in memory only (Redis with persistence fully disabled) for the TTL you choose, then evicted — never written to disk.

Logs

Application logs are metadata only: method, request path (with any secret token redacted), status, latency, tool name, and error type — never request or response bodies. Logs rotate and are size-capped (~30 MB per service), so nothing accumulates indefinitely. No web access logs record your URLs.

Deleting your account

From Connect → Delete account you can permanently erase your account. We revoke your Google tokens, tear down any live sessions, delete your account row, and clear your session. Because we hold no source data, there are no content backups to purge.