Log in Get started

Privacy Policy

Last updated: February 15, 2026

FlashMCP ("we", "our", "us") respects your privacy. This Privacy Policy describes how we collect, use, and protect your personal information when you use our website and services.

1. Information We Collect

Account Information: When you create an account, we collect your email address and a hashed version of your password. We do not store passwords in plain text.

Payment Information: Payment processing is handled entirely by Stripe. We do not store credit card numbers, bank account details, or other payment credentials on our servers. We receive your Stripe Customer ID for billing purposes.

Usage Data: We collect aggregate usage metrics (request counts per billing period) to provide you with analytics and manage billing. We do not log or store the content of your API requests or responses.

Technical Data: We automatically collect certain technical information, including IP addresses (for rate limiting of anonymous requests), request timestamps, and standard HTTP metadata. This data is used for security, performance monitoring, and rate limiting.

2. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the Service
  • Process payments and manage your prepaid credit balance
  • Send transactional emails (account verification, password resets)
  • Monitor and prevent abuse, fraud, and security threats
  • Enforce our Terms of Service and rate limits
  • Respond to your support requests

3. What We Do Not Do

We want to be explicit about what we do not do with your data:

  • We do not sell your personal information to third parties
  • We do not share your data with advertisers
  • We do not log or store API request/response bodies
  • We do not use your data for AI/ML model training
  • We do not send marketing emails (only transactional emails)
  • We do not use tracking cookies or analytics scripts on our website

4. Data Storage and Security

Your data is stored on Cloudflare's global infrastructure:

  • Database: Account data is stored in Cloudflare D1 (SQLite), encrypted at rest
  • Sessions: Session tokens are stored in Cloudflare KV with automatic 24-hour expiration
  • Passwords: Hashed using PBKDF2 with SHA-256, 100,000 iterations, and a unique 16-byte salt per password
  • API Keys: Stored as SHA-256 hashes - we never store full API keys after initial generation

All data in transit is encrypted via TLS. We follow security best practices including constant-time comparison for authentication tokens and webhook signature verification.

5. Third-Party Services

We use the following third-party services:

We do not use any analytics, advertising, or social media tracking services.

6. Data Retention

  • Account data: Retained for the lifetime of your account, plus 30 days after deletion
  • Usage records: Retained for 12 months for billing and analytics
  • Session tokens: Automatically expire after 24 hours
  • Rate limit data: Automatically expires after 60 seconds

7. Your Rights

You have the right to:

  • Access your personal data - available via the dashboard and API
  • Correct inaccurate data - contact us to update your information
  • Delete your account and associated data - contact us at the address below
  • Export your data in a machine-readable format - available via the API
  • Withdraw consent - you can close your account at any time

To exercise any of these rights, contact us at privacy@flashmcp.dev.

8. Children's Privacy

The Service is not directed at children under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. International Data Transfers

FlashMCP operates on Cloudflare's global network, which means your data may be processed in multiple jurisdictions. Cloudflare maintains appropriate data transfer mechanisms including Standard Contractual Clauses for EU data transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. For significant changes, we may also send an email notification.

11. Contact

If you have questions or concerns about this Privacy Policy, please contact us: