The short version
- The desktop catalogue and workspace can run without an account. If you never sign in, most of your work never reaches us.
- If you use the hosted workspace, we store the account profile Freebuff returns, the projects and messages you create, and hashed workspace tokens.
- We use only essential cookies, to sign you in and protect the site. There is no advertising, cross-site tracking or analytics cookie, and we do not sell data.
- You can ask for a copy of your data, or for it to be corrected or deleted, at privacy@avernic.com.
Who we are
AlphaMCP is operated by an individual based in the United Kingdom. We are the controller of the personal data described here under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For anything about your data, email privacy@avernic.com. These pages form part of our Terms of Service.
What we collect
Your account
The hosted workspace signs you in with Freebuff. Freebuff gives us an account identifier, and usually your name, email address and picture. We store those, your plan, whether you are an administrator, whether the account is suspended, and when it was created or last updated. We never receive your Freebuff password.
Your workspace
If you sign in, we store what you put into the workspace: projects and their Project Contracts, integrations and their scope decisions, pipelines and schedules, runs and their steps, approvals and the person who decided them, messages, teams and team notes, and any skill packs you import. Team notes are visible only to the account that owns the team.
Tokens and the Convio bridge
Workspace tokens are stored on our side only as a one-way hash, with their name, a short prefix, when they were created and when they were last used. If you choose to connect Convio, we also store the endpoint, a masked hint, the server name, the tool count, the skills you import and the API key needed to call Convio on your behalf. That key is never returned by the API and is deleted when you disconnect.
Security and administration
We keep audit records of administrative actions, such as a plan change, suspension, restoration or account deletion, so the control plane can be reviewed. Our hosting provider also keeps short-lived request logs to run and protect the service.
What stays on your device
The desktop catalogue, the workspace JSON, local logs and the credentials file live in the app's data folder on your machine. They are read locally. A workspace token and the content you choose to sync are sent to the hosted workspace only when you connect it. The app does not scan your files in the background or upload your disk.
Why we use it
| Purpose | Data | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Creating your account, signing you in and providing the workspace | Account profile, sessions, projects, runs, approvals, messages, teams | Contract: we need it to provide the service you signed up for |
| Keeping accounts secure, preventing abuse and enforcing the Terms | Tokens, audit records, request logs, suspension records | Legitimate interests: protecting AlphaMCP and the people who use it |
| Connecting Convio when you ask us to | Convio endpoint, API key, imported skills | Contract and your instruction |
| Understanding whether the service is healthy | Operational logs and error records | Legitimate interests: running and improving the service |
| Meeting legal obligations and responding to lawful requests | Whatever the obligation requires | Legal obligation |
We do not use your data for advertising, we do not sell it, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. An approval gate exists precisely so a person decides.
Where it is stored
The hosted workspace runs on Cloudflare's global network, and its D1 database may be located outside the United Kingdom, including in the United States. Freebuff, Convio and any service you connect may also process data in other countries.
Where data leaves the UK, we rely on adequacy regulations, including the UK–US Data Bridge where the provider is certified, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses as offered by the provider.
The local desktop workspace stays on your device unless you choose to sync it.
How long we keep it
| Data | Kept for |
|---|---|
| Account, projects, contracts, pipelines, runs, approvals, messages and teams | While your account exists. Deleted or anonymised when the account is deleted, subject to the exceptions below. |
| Workspace tokens | Until you revoke them or the account is deleted. Last-used time is updated while they are active. |
| Convio connection and imported skills | Until you disconnect Convio or delete the account. |
| Team notes | Until the team or account is deleted. |
| Sessions | At most 30 days of inactivity and 90 days in total, or until you sign out. |
| Audit and moderation records | As long as needed to keep the service secure, enforce a suspension and prevent abuse. A suspension record can outlast the account it relates to. |
| Hosting request logs | A short period, as operated by Cloudflare. |
| Local workspace and logs | On your device until you delete them or remove the app's data folder. |
Security
Traffic between the app and the hosted workspace uses HTTPS. Workspace tokens are stored as one-way hashes on our side; the app stores the token you pasted in its local credentials file. Sign-in cookies are HttpOnly and host-only. Administrative access to member data is limited to administrators, and every administrative change is recorded in the audit log.
The local workspace is ordinary JSON on your device, protected by your operating system and disk encryption rather than by us. If your device is shared or lost, treat the workspace and its credentials file as exposed, revoke the token and remove the data folder.
No system is perfectly secure. If a breach affects your data and is likely to put you at risk, we will tell you and the regulator as the law requires.
Your rights
Under the UK GDPR, you can ask us to:
- give you a copy of your personal data (access), in a portable format where it applies;
- correct data that is wrong (rectification);
- delete your data (erasure);
- limit how we use it (restriction);
- stop using it where we rely on legitimate interests (objection).
Email privacy@avernic.com from the address on your account. We will reply within one month and may ask you to confirm your identity. These rights have legal limits; for example, we may keep a suspension or audit record to prevent abuse.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Children
AlphaMCP is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you think a child has given us personal data, contact us and we will delete it.
Changes
We will update this page when what we collect or how we use it changes, and change the date at the top. If a change is significant, we will tell signed-in members before it takes effect.
Contact
Privacy questions and requests: privacy@avernic.com. Terms questions: legal@avernic.com.