Privacy

Privacy Policy

Effective date: October 8, 2026

The short version. This summary is for convenience only — the full policy below is what applies.

mcpwarp.io sets no cookies. It counts page views with a self-hosted, cookieless analytics service (Umami) on our own infrastructure; no third-party analytics or tracking scripts run.
The tunnel relays your MCP request and response bodies to your machine. An automated monitoring service inspects this traffic to detect abuse and illegal activity, and keeps the calling client's IP address and request metadata. Beyond a short-lived processing queue, message content is stored, and can be viewed by a person, only if your account is flagged for review. See "Traffic Monitoring" below.
The dashboard at web.mcpwarp.io sets one httpOnly session cookie to keep you signed in.
We collect account data (email, username, account identifier), your server's name, kind and status, monthly usage counters, subscription data from our payment provider, and personal access token hashes.
Card details never touch our servers — our payment provider handles checkout and payment as merchant of record.
Service logs and request traces are kept for 14 days. Performance metrics are aggregate, contain no personal data, and are deleted within 45 days. Traffic monitoring data has its own retention, listed in "Traffic Monitoring" below.
Email support@mcpwarp.io to access, export, or delete the data we hold about you.

This Privacy Policy describes how mcpwarp.io ("Website"), the mcpwarp CLI ("Software"), and the MCP Warp dashboard and tunnel service (collectively, the "Service") handle your information.

1. Information We Collect

Website

mcpwarp.io sets no cookies. It uses a self-hosted, cookieless analytics service (Umami) on our own infrastructure to count page views, and honours your browser's Do Not Track setting. It does no cross-site tracking and does not store IP addresses; it records the page, referrer, browser, operating system, device type and approximate location (country, region, city), linked by an anonymised identifier that resets every month. We process this data on the basis of our legitimate interest in understanding how the Website is used. No third-party analytics or tracking scripts run on mcpwarp.io. Our hosting provider may collect technical information such as IP addresses in server logs as part of operating the infrastructure.

Dashboard Account

When you create an account at web.mcpwarp.io, we collect:

Authentication data: your email address, your username, and the account identifier issued by our authentication service, managed through our self-hosted Keycloak identity provider.
Cookies: web.mcpwarp.io sets one session cookie (__Host-sid, HttpOnly, Secure, SameSite=Strict, 30 days sliding) and a short-lived state cookie during sign-in. No analytics and no third-party scripts run on web.mcpwarp.io. No cookies are set on mcpwarp.io. Our payment provider's hosted checkout runs on its own domain under its own policy.

CLI

The mcpwarp CLI stores your login credentials locally (per-issuer, under~/.mcpwarp/credentials/). Logging in and running mcpwarp up sends your device-flow login and server registration requests to our backend, authenticated as your account.

Tunnel Connection Data

When you register a server and connect via mcpwarp up, we collect:

Server configuration: the server's name, its kind (stdio or HTTP), its status, and its public label <name>-<username>. We do not store the local command, path, port, or URL your server runs at — your CLI config never leaves your machine.
Connection state: whether your mcpwarp up process is currently connected, for routing requests and for display on your dashboard.

The tunnel forwards standard proxy headers (such as X-Forwarded-For) to your own MCP server, which runs on your machine; we never inject identity headers (email, username) into requests it receives.

Cloudflare, our network edge provider, may process connection metadata, including IP addresses, at the network edge under its own privacy policy.

Logging

The tunnel does not keep a general access log of MCP requests. The traffic monitoring service described below records the client's IP address and request metadata for every request to your public MCP URL that the tunnel accepts. Separately, the tunnel's service logs record a connection's IP address when it fails authentication. Our dashboard and API services keep standard HTTP access logs that include your IP address and browser user agent — authorization headers, cookies, and secrets are redacted from these logs. MCP request and response bodies are not logged. They pass briefly through the traffic monitoring queue and are kept longer only for accounts flagged for review (see "Traffic Monitoring" below).

MCP Client OAuth

When an MCP client (such as Claude, ChatGPT, or VS Code) connects to your tunnel URL, it registers via OAuth 2.1 with dynamic client registration against our self-hosted Keycloak. We store the client registration and a mapping between that client and your tunnel so requests route correctly. We do not store OAuth access or refresh tokens issued to the client — those are managed by Keycloak.

When you connect a client such as Claude or ChatGPT, you see a consent screen. The token issued to that client carries your account identifier, username, name, and email address, and is scoped to the single server you authorized.

Personal Access Tokens

Personal access tokens (mcpwarp_pat_...) are minted in the dashboard and shown to you once. We store a hash of the token, its name, a display prefix and last four characters, and creation, expiry, last-used, and revocation timestamps. The plaintext token is shown once and never stored.

Subscription Data

Subscription tier: your current plan (Free, Plus, or Pro).
Tier history: an audit trail of plan changes with timestamps.
Expiration date: when your current subscription period ends (for paid plans).

Payments for paid plans are handled by our third-party payment provider; see theTerms of Service (Payments section). Your payment details (card number, billing address, and related checkout information, which may include your IP address collected for tax-location and fraud-prevention purposes) are collected and processed by the payment provider on its own checkout pages under its own privacy policy. Card numbers never reach our servers and we do not store them.

Payments for paid plans are processed by Polar Software, Inc. (Polar), which acts as the merchant of record for your purchase. Polar is an independent controller of the payment data it collects. Polar's buyer terms and privacy policy apply to your purchase in addition to our Terms and this policy.

Service Monitoring

We use OpenTelemetry, self-hosted, to collect service health metrics and request traces (request paths, status codes, timing data). This does not capture the content of your MCP requests or responses. Performance metrics are aggregate counters and carry no per-user, per-server or per-IP labels. Per-account monitoring of tunnel traffic is a separate system, described next.

Traffic Monitoring (Fair Use and Abuse Detection)

We run an automated monitoring service that inspects traffic passing through the tunnel and may keep selected data from it, to detect and investigate abuse, illegal activity, and misuse of the Service. It applies to every account. It can flag an account for review, but it never blocks traffic or changes your account by itself.

What it keeps.

Client IP address and request metadata, for all traffic. For each request to your public MCP URL that the tunnel accepts, the service records the IP address of the client making the request and metadata such as the time, the MCP method and tool name, the response status, message sizes, the client's user agent, and which of your servers was called. It keeps this as per-account counters and a record of which client IP addresses were seen. The IP address of your own machine, where your MCP server runs, is not sent to the monitoring service.
Message content, only for accounts flagged for review. Request and reply bodies of all traffic pass through a short-lived processing queue, written to disk on our infrastructure, so they can be analyzed automatically; each is deleted once processed. While an account is flagged, the service also keeps a record of each message and a capped amount of its request and reply bodies. Bodies contain whatever your MCP client and your server exchanged, which may include personal data.
Flag records. Details such as the rule or reason for each flag and unflag, when it happened, and who made it.

Flagging. Automated rules look for unusual patterns, such as unusual request or data volume, many unanswered requests, or traffic from many different client networks. Our administrators can also flag or unflag an account by hand. A flag marks the account for human review and notifies our administrators; it does not suspend the account or block its traffic. Any suspension is a separate decision under theTerms of Service. Capture of message content stops when the account is unflagged.

How long.

Bodies in the processing queue: deleted once processed, and in any case within about 6 hours.
Per-minute counters: about 14 days, then rolled up into hourly counters, which currently have no automatic expiry.
Client IP records: about 45 days.
Message records and stored bodies (flagged accounts only): until an administrator deletes them. When an account reaches its storage cap, the oldest bodies are deleted first.
Flag and audit records: no automatic expiry in the monitoring service; the copy in our account database is kept until your account is deleted. Flag notifications on our internal message queue are kept for about 7 days.
Backups of the monitoring database, including any stored bodies: about 7 days in Cloudflare R2.
Flag notification emails: kept in our administrators' mailbox until deleted. Brevo keeps delivery logs under its own policy.

Who sees it.

The automated monitoring system, for all traffic.
Our administrators, to investigate abuse: counters and client IP records for any account, and message content only for accounts flagged for review.
Brevo, our email provider, which delivers the flag notification to our administrators. That email contains your email address, username, and account identifier.
Cloudflare R2, which stores database backups.

The monitoring service, its queue, and its database run on infrastructure controlled by MCP Warp, like the rest of the Service.

Legal basis. We process this data on the basis of our legitimate interest in preventing abuse and keeping the Service available and secure for everyone using it.

Your choices. There is no self-service view of this data. To ask what we hold about your account, or to request its deletion, emailsupport@mcpwarp.io. The monitoring service is not tied to your account, so deleting your account does not delete its data automatically; on a deletion request, our administrators delete by hand all monitoring data held for your account, including flag notification emails in their mailbox. Our rules and retention periods may change; we will update this page when they do.

2. Information We Do Not Collect

The tunnel relays MCP request and response bodies between your MCP client and your local machine in real time. Our monitoring service inspects this traffic automatically, but we do not store its content or let a person view it, unless your account is flagged for review. Bodies pass through an internal queue for at most about 6 hours. See "Traffic Monitoring" above.
Card and payment details never touch our servers — see "Subscription Data" above.
No third-party analytics or tracking scripts run on mcpwarp.io or the dashboard. mcpwarp.io counts page views with self-hosted, cookieless Umami.

3. Third-Party Services

We rely on the following third-party and self-hosted services:

Service	Purpose	Privacy policy
Cloudflare	Network edge: TLS termination and DDoS protection; R2 storage for database backups	Cloudflare Privacy
Hosting provider	Website and service hosting	N/A
Brevo	Transactional email (EU): administrator notices, including abuse flags, and plan-change emails to users	Brevo Privacy
Keycloak	Authentication for the dashboard, CLI, and MCP-client OAuth	Self-hosted on MCP Warp-controlled infrastructure (software: Keycloak)
PostgreSQL	Account, server, and subscription storage	Self-hosted on MCP Warp-controlled infrastructure
NATS	Internal event streaming	Self-hosted on MCP Warp-controlled infrastructure
OpenTelemetry	Service health monitoring	Self-hosted on MCP Warp-controlled infrastructure
Traffic monitoring	Fair use and abuse detection on tunnel traffic	Self-hosted on MCP Warp-controlled infrastructure
Umami	Cookieless page-view analytics on mcpwarp.io	Self-hosted on MCP Warp-controlled infrastructure
Polar Software, Inc.	Merchant of record: payment processing and checkout (since September 2026)	Polar Software, Inc. Privacy

PostgreSQL, NATS, Keycloak, OpenTelemetry, Umami and the traffic monitoring service run on infrastructure controlled by MCP Warp. Database backups, including account and traffic monitoring data, are stored in Cloudflare R2 and kept for about 7 days. Brevo, based in the EU, sends our transactional email from support@mcpwarp.io. It sends notices to our administrators, such as abuse flags, and emails to you when your plan changes: when you move to Plus or Pro or an administrator extends your plan, and when a paid plan ends or is downgraded. For these emails Brevo receives your email address, username, plan name, and the plan's end date. Billing renewals do not send an email, and a flag never emails the flagged user.

4. Your Rights

You have the right to:

Access your data — view your account information, server configuration, and subscription status through the dashboard.
Manage your data yourself — you can delete servers and revoke personal access tokens yourself in the dashboard at any time.
Access, export, or delete your account data — email support@mcpwarp.io. We handle these requests manually and confirm by email. This includes traffic monitoring data, which has no self-service view in the dashboard. We retain records we must keep for tax or accounting purposes.
Cancel your subscription — downgrade from a paid plan to Free at any time through the billing portal (Settings > Billing > Manage billing).

5. Data Retention

Account data (email, username, account identifier) is retained for the lifetime of your account and deleted upon account deletion.
Server configuration is retained while your account is active and deleted when you remove a server or delete your account.
Service logs and request traces are retained for up to 14 days and then automatically purged.
Performance metrics are aggregate counters that carry no user, server or IP identifiers. They are retained for 14 days and deleted in monthly batches, no later than 45 days after collection.
Monthly usage counters and tier history are retained as billing records for the lifetime of your account, except records we are legally required to retain for longer (for example for tax or accounting purposes).
Personal access token hashes are retained until you revoke the token or delete your account.
Dashboard sessions are retained for up to 30 days.
Website analytics (Umami) are kept until deleted.
Traffic monitoring data (counters, client IP records, message records, stored bodies, and flag records) has its own retention periods, listed under "How long" in Traffic Monitoring above. Deleting your account does not delete it automatically; on a deletion request, our administrators delete it by hand.
Database backups, including account and traffic monitoring data, are kept in Cloudflare R2 for about 7 days, so deleted data can remain in backups for up to that long.

6. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children.

7. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date.

8. Contact

For privacy-related questions or requests, contact us at support@mcpwarp.io.