MCPOrbit is built on a simple principle: we don't collect what we don't need. The app runs on your machine, talks to servers you choose, and stays out of the loop on everything else. This page explains that in plain terms — and in the formal terms that data-protection law expects.
At a glance
If you only read one section, read this one. The rest of the document elaborates on these points and adds the disclosures required by the GDPR, CCPA, and similar regimes.
- MCPOrbit is a desktop client. There is no MCPOrbit account, no MCPOrbit cloud sync, and no MCPOrbit-side telemetry.
- Your prompts, tool calls, server responses, and credentials never travel through MCPOrbit infrastructure.
- One feature — checking for updates — sends data to us. It runs automatically every time you launch the App, and the current release has no setting that turns it off.
- Our marketing site uses no third-party tracking, no advertising cookies, and no behavioural analytics.
- You have the right to access, correct, or delete personal data we hold about you. Mail to mcporbit.com is still refused, so the form at /contact is how you exercise that right — the Contact section explains exactly where a submission goes.
Scope of this policy
This Privacy Policy applies to the MCPOrbit desktop application (the App) and the marketing website at mcporbit.com (the Site), together the Services. It does not apply to MCP servers you connect to through the App, which are operated by other people and have their own privacy practices.
Who is the data controller
For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the data controller for personal data processed through the Services is Unprototyped, the small independent software team that builds MCPOrbit. MCPOrbit is the product; Unprototyped is the team accountable for it, and the same name appears on our about page and on the certificate the App is signed with.
We still have no working email address for privacy correspondence. This page used to give one, and it did not reach us. What we have instead is a form at /contact, and what you send through it is written down and kept; the Contact section sets out where a submission is stored and who can read it.
Local-first by default
MCPOrbit is a desktop client. When you connect to an MCP server, the connection is made directly from your computer to that server — whether the server is running locally on your machine, on your private network, or hosted by a third party. Your prompts, tool calls, responses, and credentials never travel through MCPOrbit infrastructure, because there is no MCPOrbit infrastructure in that path.
Practically, that means:
- Server commands, environment variables, and headers you configure are stored locally on your device only.
- Tool inputs and tool outputs are streamed directly between your device and the server you addressed.
- We cannot access this data even if compelled to, because we never receive it.
What we don't collect
Out of the box, MCPOrbit collects none of the following:
- Your name, email address, phone number, billing details, or any other account information — there are no MCPOrbit accounts. The only place we ever ask for an email is the optional newsletter form on our website, described below.
- The names, addresses, or contents of MCP servers you connect to.
- Any tool inputs, tool outputs, or responses streamed through the App.
- Prompts, completions, model traffic, or model identifiers of any kind.
- Advertising IDs, operating-system identifiers, or fingerprints derived from your hardware or software. The update check does send a random per-installation identifier, described under Update checks — it is generated by the updater, not read off your device.
- Telemetry, usage analytics, page views, click-stream data, or feature heatmaps.
- Advertising, analytics, or cross-site tracking cookies on the Site. The Site does set one operational cookie, described under The marketing site.
What we collect
Two things reach us. The update check runs on its own, every time you launch the App. Everything else happens only because you chose to write to us:
Update checks
Every time you launch the App, it asks our update server whether a newer version is available. This is automatic — it happens as the window opens, before you have done anything, and the current release has no setting that turns it off.
The App requests one file: the update manifest for your operating system, which is named after your platform, so the request itself tells us that much. It comes from mcporbit.com/api/updates/latest/. That request carries a random identifier which the updater generates the first time you run the App and stores in the App's data folder, so the same value reaches us on every later check. Your App version is notpart of the request — the manifest is downloaded first and the comparison happens on your machine. We also see the connection's IP address, as the operator of any web server does. The update endpoint is part of this same website rather than a separate service, so a check leaves the same kind of server-log line that loading a page does; both that address and the identifier are handled under the short-term practice described under How long we keep data.
Direct correspondence
If you send a bug report through the App, or write to us through the form at /contact, we receive what you send. We use it to help you and don't repurpose it for marketing or analytics. A form submission carries the email address you type, your name if you choose to give one, and the message itself, and it is written as a row in a private database we control, hosted by Supabase in Ireland. Email to mcporbit.com is still not a route that works, for the reason set out under Contact.
The marketing site
The Site uses no third-party tracking, no advertising cookies, and no behavioural analytics. Two things may be stored in your browser. Our content-delivery provider, Cloudflare, sets a __cf_bm cookie on every request to the Site. It is Cloudflare's bot-management cookie, it lasts about thirty minutes, it is not readable by JavaScript, and Cloudflare documents it as strictly necessary to distinguish automated traffic from human traffic. We do not use it to identify or track you and we do not read it. Separately, we may store a cookie or local-storage value to remember your theme preference (light vs. dark). Server logs may briefly retain IP addresses for the purpose of preventing abuse and serving the Site reliably; these are rotated and discarded under our hosting providers' standard log rotation.
The Site offers an optional newsletter. If — and only if — you submit that form, the address you typed is sent to Loops, our email-marketing provider, and stored there as a marketing contact so we can send you occasional product updates. Loops is operated by Astrodon Corporation in the United States, so submitting the form transfers your address there; see International transfers. We do not attach your IP address, browser, or any behavioural profile to it, we never sell or rent the list, and we use the address for nothing else. Every email carries a one-click unsubscribe, which deletes you from the list. Downloading MCPOrbit does not require an email and never subscribes you to anything.
Legal basis for processing
Where we do process personal data, our legal basis under Article 6 GDPR depends on the activity:
- Consent (Art. 6(1)(a)) — for the Site's newsletter. You can withdraw consent at any time by using the unsubscribe link in any newsletter email.
- Contract (Art. 6(1)(b)) — when you initiate a support conversation, we process the message in order to respond.
- Legal obligation (Art. 6(1)(c)) — when you send a rights request through the contact form, we process what you sent because data-protection law requires us to answer it.
- Legitimate interests (Art. 6(1)(f)) — for short-term server logs used to keep the Site available and prevent abuse, balanced against your reasonable expectations.
- Legitimate interests (Art. 6(1)(f)) — for the App's automatic update check: keeping installations on a supported and security-patched build. This is the basis for both the request itself and the per-installation identifier it carries, both described under Update checks. You can object to this processing at any time through the form at /contact.
The App's automatic update check is described in full under Update checks.
How long we keep data
We hold personal data only as long as we need it for the purpose we collected it. Specifically:
- Update-check requests: the update endpoint is part of the same website application as every other page, so a check leaves the same kind of web-server log line a page request does, the connection's IP address among its fields. Those logs are rotated and discarded under the same standard log rotation as every other request to the Site, and nothing about an update check is written anywhere else.
- The per-installation identifier the update check carries: it is discarded with the log line that holds it. It reaches no application code of ours, so that log line is the only place it exists, and it goes when the log does. We keep nothing that links it to you.
- Site server logs: rotated and discarded under our hosting providers' standard log rotation.
- Newsletter subscription: retained until you unsubscribe, then deleted from our mailing list.
- Support correspondence: retained for as long as needed to resolve your matter, plus a reasonable period for follow-up, then deleted on request.
- Contact-form submissions: kept in our private database for as long as needed to deal with what you raised, plus a reasonable period for follow-up, then deleted on request. Ask through the form and we will delete the record, including the address you sent it from.
How we secure data
The most important security control we apply is not collecting data in the first place. For the limited data we do receive, we use industry-standard safeguards:
- Transport encryption (TLS 1.2+) for all traffic between the App, the Site, and our servers.
- Access controls limiting who on our team can read what you send us through the contact form.
- Separation of the App's update-check traffic from any identifying contact data: an update check reaches no store of ours at all, the update endpoint holds nothing you have written to us, and there is no key that joins the two. The one thing they have in common is the ordinary server-log line every request to this site leaves, described under How long we keep data.
No system is perfectly secure. If you discover a vulnerability we want to hear about it, and there is now a route that carries the report: the form at /contact has a security topic, and a submission on it lands in the private inbox the team reads rather than in the dead mailbox this page used to publish. We will not promise a fast read: we have never measured how long one takes to reach a person, and you should assume it may sit for a while. What we can tell you is that it is written down and kept exactly as you sent it, so nothing is lost while it waits.
Third-party services we use
We rely on a small number of vendors to deliver the Services. Each of them processes data on our behalf under the data-processing terms that vendor publishes, which is the standard GDPR Article 28 requires be in writing:
- Loops (loops.so), operated by Astrodon Corporation in the United States — our email-marketing provider. If you subscribe to the newsletter, the address you submitted is sent to Loops, stored there as a marketing contact, and used to deliver those emails. Nothing you send through the contact form is ever put into Loops: it is a marketing list, and a rights request does not belong on one.
- Supabase Pte. Ltd., in Singapore, operating the database that holds our contact records in its Ireland (eu-west-1) region — where a contact-form submission is stored. When you submit the form, the message, the email address you typed, and your name if you gave one are written as a row there. Private means not published: it is readable by our team, and by Supabase as the operator of the service, not by the public or by search engines. Until September 2026 these records were kept at GitHub instead; they were moved because a record stored in version history cannot be deleted on request, and this page promises that it can.
- GitHub, Inc., part of Microsoft Corporation, in the United States — where our code is hosted. Contact-form submissions are no longer written there. Two support requests sent through an earlier version of the form are still recorded there and are covered by the same deletion promise as everything else on this page.
- Cloudflare, Inc., in the United States — our content-delivery and bot-protection layer. Every request to the Site passes through Cloudflare before it reaches our origin server, so Cloudflare processes your IP address and request metadata in order to serve the Site and filter automated abuse. This is the vendor that sets the __cf_bm cookie described under The marketing site.
- DigitalOcean, LLC, in the United States — hosting provider for the marketing Site and the update server (delivers the App update manifest and the Site).
We do not sell personal information, and we do not share it with advertising networks or data brokers. A current list of sub-processors is available on request.
International transfers
Some of our vendors are based outside the European Economic Area and the United Kingdom. We can name them exactly. If you subscribe to the newsletter, your email address is transferred to Loops in the United States and stored there. If you send us anything through the contact form, the submission itself is stored in Ireland, inside the EEA — but the company that operates that database, Supabase Pte. Ltd., is in Singapore, which is outside it, so the submission is reachable from outside the EEA even though it rests inside it. And loading any page of the Site sends your IP address and request metadata to Cloudflare in the United States, and then on to our origin server at DigitalOcean in the United States — that transfer happens on every request, and unlike the other two it does not wait for you to do anything.
GitHub no longer receives contact submissions, but it still holds the two support requests sent through an earlier version of the form, so the transfer question has not gone away for them. The same limit applies to GitHub as to Loops: we have not negotiated bespoke transfer terms with them either, and what governs the transfer is what GitHub publishes about itself. Its privacy statement says it generally relies on the standard contractual clauses the European Commission published under Implementing Decision 2021/914, and that it has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. framework. We have read that document; we have not audited it, and we are telling you which of the two that is.
The same limit applies to Supabase, and it is worth reading because it differs from the others. We have not negotiated bespoke transfer terms with them, and what governs is what Supabase publishes about itself. Its data processing addendum forms part of the Supabase terms of service, so it applies without being separately negotiated, and it incorporates the standard contractual clauses the European Commission published under Implementing Decision 2021/914, together with the UK Addendum for transfers subject to UK law. Unlike every other vendor named on this page, Supabase makes no Data Privacy Framework certification — we went looking for one and there is none to report, and you should hear that from us rather than notice it missing. We have read that document; we have not audited it, and we are telling you which of the two that is.
We have not negotiated bespoke transfer terms with Loops, and we are not going to describe a safeguard we did not put in place. What applies is what Loops publishes about itself. Its data processing agreement states that it binds anyone using the service, and its privacy policy states that Astrodon Corporation complies with the EU-U.S. Data Privacy Framework and the UK Extension to it, and uses Standard Contractual Clauses for transfers out of the EEA. We have read those documents; we have not audited them, and we are telling you which of the two that is.
The same limit applies to Cloudflare and DigitalOcean: we have not negotiated bespoke transfer terms with either, and what governs is what each publishes about itself. Cloudflare's customer data processing addendum says at section 6.4 that Cloudflare complies with the Data Privacy Framework — which that same document defines as the EU-U.S. Data Privacy Framework, the UK-U.S. extension to it, and the Swiss-U.S. framework — and it offers the standard contractual clauses the European Commission published under Implementing Decision 2021/914, together with the UK Addendum, for transfers the Framework does not cover. DigitalOcean's privacy policy says that DigitalOcean, LLC complies with the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. framework, that it has certified to the U.S. Department of Commerce that it adheres to them, and that its data processing agreement incorporates the standard contractual clauses. We have read both documents; we have not audited them, and we are telling you which of the two that is.
For our other vendors, we rely on the terms each of them publishes. We have not verified those one by one, so this page will not claim a mechanism for them.
Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Erase your data (the right to be forgotten), subject to legal retention obligations.
- Restrict or object to particular processing activities.
- Receive a copy of your data in a portable, machine-readable format.
- Withdraw consent for any opt-in processing at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Lodge a complaint with your local data-protection authority if you believe we have mishandled your data.
These rights are real and we will honour them. To exercise one, use the form at /contact and pick the privacy topic. It helps if you say which right you are exercising. The GDPR gives us one month to respond and we will work to that. The address this page used to publish never reached us and is gone; the Contact section explains what replaced it.
If you would rather not wait on us at all, you do not have to wait for us. In the EEA, the UK, and Switzerland you can take a rights request or a complaint straight to your national data-protection authority, and that path does not depend on our mailbox working.
GDPR (European users)
If you are in the European Economic Area, the United Kingdom, or Switzerland, the GDPR (or its UK or Swiss equivalent) applies to our processing of your personal data. The rights described above apply in full. You also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or the place of the alleged infringement.
CCPA / CPRA (California users)
If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect, the right to delete it, the right to correct it, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights.
We do not sell or share personal information for cross-context behavioural advertising, and we have not done so in the preceding 12 months. To exercise your CCPA rights you need a route to us, and the Contact section sets out honestly what we can and cannot offer you today.
Children
MCPOrbit is a developer tool not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided personal information to us we will delete it — see Contact for the state of our routes to reach us.
Do Not Track and Global Privacy Control
Because the Site does not use cross-site or third-party tracking in the first place, browser signals such as Do Not Track and Global Privacy Control have no additional effect — there is nothing to opt out of. We respect those signals as a matter of policy regardless.
Changes to this policy
If we change how privacy works in MCPOrbit, we will update this page and bump the “last updated” date at the top. Material changes — anything that expands what we collect or how we use it — will also be announced in-app and on the blog at least 14 days before they take effect, so you have time to review them or stop using the Services if you disagree.
Contact
Write to us at mcporbit.com/contact. That form is the route for privacy questions, rights requests, security disclosures, and anything else. It is the only route we have that works, and what you send through it is kept.
We still do not have a working email address, and we would rather say so than let you find out by being ignored. The domain mcporbit.com has no mail exchange record, so mail addressed to anyone at mcporbit.com is refused or dropped before a person ever sees it. This page used to publish such an address. Anything sent there was lost, and nobody who sent it was told. We removed it, and the last version of this page promised that a working route would be published here the day it existed. This is that day.
Because we asked you to stop trusting an address, you are owed the detail on what replaced it. A submission is written as its own row in a private database we control, hosted by Supabase in Ireland, separate from the site itself. It carries your message, the email address you typed, and your name if you gave one. It is not public and it is not indexed. It is durable, which cuts both ways: it will still be there when someone picks it up, and it is a record you can ask us to delete. Deleting it is one operation that finishes when we run it — that is why the record lives in a database and not, as it did until September 2026, in our version history, where nothing can truly be removed. The trade we made is deliberate. A form that records what you send beats a mailbox that looks official and swallows it. We are not telling you someone has read your submission yet. We are telling you it is still there to be read.
