Privacy Policy

1. Overview

Shredly ("we," "us," or "our") provides hosted Model Context Protocol (MCP) servers that connect APIs to AI agents. This policy applies to the Shredly website, dashboard, MCP integration, and hosted servers. It explains the information processed when you create an account, configure a server, share access, or use a connected AI client, including ChatGPT.

2. Information We Collect

Account Information

We collect your email address, first and last name, account identifier, and account timestamps. Google and GitHub sign-in provide basic profile information and authentication information; email sign-in uses a one-time code. We store session and API-key records, including expiration information, your sign-in method, account tier, and Stripe customer identifier when applicable. These records let us authenticate you, associate your servers with your account, and manage subscriptions.

Server and Tool Configurations

We store the configuration you submit through the dashboard or MCP management tools: server names, identifiers, slugs, descriptions, access settings, and tool definitions. Tool definitions include API URLs, HTTP methods, static headers, request-body templates where supplied, input schemas, safety annotations, response transformations, and timeouts. Creating or updating a configuration stores these values; listing servers and tools returns configuration information to the requesting client.

Authentication and Connection Information

When a connection requires authentication, we process the relevant API key, authorization token, or other credential to authenticate requests and contact the configured API. Server settings may also contain authentication-header settings and OAuth configuration, including provider URLs, client identifiers, client secrets, scopes, and additional parameters. OAuth sign-in and token exchange process authorization codes and provider responses. Supply credentials only when necessary for an authorized connection, and keep them out of tool descriptions, prompt templates, and support messages.

Prompt Templates, Sharing, and Custom Domains

We store reusable prompt names, titles, descriptions, template text, and argument definitions. When a client requests a prompt, we process its supplied arguments to return the completed template. Sharing records identify the server owner, people granted access, and when access was granted. Custom-domain records include the hostname, provisioning identifiers, verification status, and any OpenAI domain-verification token you supply. A domain-verification token is served on the domain so OpenAI can verify ownership.

Usage and Analytics Data

We collect page views, time on page, timestamps, referring URLs, browser user-agent information, and campaign parameters in URLs. Our website analytics use a persistent visitor identifier stored in your browser and send usage events to the TideShift analytics service. The website also loads Google Analytics, which processes website usage and browser information using its own identifiers and cookies. This information helps us understand site use and troubleshoot performance.

Tool Inputs, Outputs, and Logs

Shredly receives tool arguments from the requesting AI client, sends the configured request to your upstream API, processes its response, and returns the result to that client. Inputs and outputs can contain information about you or other people, depending on your configuration. The same applies to management-tool results, such as server configurations, session profiles, and sharing information.

We retain invocation records such as the server identifier, tool name, timestamp, source IP address, and associated account information where available. Operational logs can also record request contents, URLs, headers, tool arguments, response excerpts, and error details. Authentication information and data included in inputs or outputs can therefore appear in operational logs; this processing is not limited to temporary memory. These records support dashboard activity, troubleshooting, and service operation.

Billing and Support

We process subscription status, Stripe customer and checkout identifiers, and billing-event information to manage paid plans. Payment-card details are entered through Stripe checkout, rather than through Shredly MCP tools. If you contact support, we receive your email address, message, and any files or diagnostic information you choose to include. Do not include credentials or prohibited sensitive data in a support request.

3. How We Use Your Information

• Use account, session, and credential information to sign you in and authorize requests
• Store and manage the servers, tools, and prompt templates you configure
• Use tool inputs and upstream responses to carry out requests and return results to your AI client
• Use sharing records to grant or revoke server access and identify the people involved
• Use hostname and verification information to provision custom domains and support domain ownership checks
• Use subscription and billing records to manage paid plans and billing communications
• Use invocation records, operational logs, and website analytics to show activity, diagnose errors, and improve reliability
• Use support correspondence and account information to answer requests, send login codes, and communicate service changes

4. Who Receives Information

Information is sent to the following recipients when needed for the features you use:

• Your connected AI client — tool descriptions and schemas, requested prompt templates, tool results, and management information returned for your authorized requests. When you use ChatGPT, OpenAI receives these responses. The AI provider's own privacy policy governs its handling of that information.
• Your configured API and OAuth providers — tool inputs, required authentication information, and connection requests needed to perform the operations you configure.
• People you grant access to — server and sharing information available through the access you grant. Public server tool descriptions and schemas can be discovered by clients that connect to the public endpoint.
• AWS — hosted account and configuration data, requests and responses processed by the service, and operational logs.
• Cloudflare — hostname and provisioning information for custom domains and traffic handled through its domain infrastructure.
• Stripe — checkout, customer, payment, and subscription information for paid plans. Stripe handles payment-card entry and processing.
• Google and GitHub — authentication information when you choose their sign-in services. Google also receives website usage information through Google Analytics.
• TideShift analytics — visitor identifiers, page and browser information, campaign parameters, and usage events sent by the website.

5. Data Retention

We retain account and server configuration information while it is needed to provide your account and configured services. This includes tool definitions, stored connection settings, prompt templates, sharing records, and custom-domain settings. Sessions have their own expiration settings; signing out does not delete your account or servers, and archiving a server is not the same as erasing its stored records.

We retain tool-call metadata, operational logs, and website analytics for 90 days after collection. These records may remain during that period after a session expires, a connection is removed, or a server is archived. Contact us to request earlier deletion of information associated with your account. Records required for legal or financial compliance, such as billing records, may be kept longer when necessary to meet those obligations.

To request account deletion, email support@shredly.io. We delete your personal data within 30 days of an account-deletion request, except information we must retain for legal or financial compliance, such as required billing records. Removing a Shredly account does not remove copies already received by your AI client, upstream API, or another recipient; contact those providers for their retention and deletion controls.

6. Prohibited Data

Shredly is not designed or certified to process sensitive regulated data, and its MCP management tools do not require health information, biometric data, government-issued identifiers, or payment-card data. Do not configure or use Shredly tools, schemas, request templates, or prompts to solicit, transmit, or store health information, biometric identifiers, Social Security numbers or other government-issued identifiers, payment-card numbers or security codes, or other special-category personal data. The prohibition applies to inputs, outputs, configuration text, and support attachments. Use synthetic, non-sensitive data for testing. Payment-card entry for a Shredly subscription takes place through Stripe's payment flow.

7. Security

Shredly uses HTTPS for its website and hosted connections and authenticates access to account operations. You control the credentials, upstream endpoints, and access settings used by your servers. Protect your API keys and limit the permissions of connected services to what your tools need. No method of internet transmission or storage is completely secure.

8. Your Choices and Requests

You can use the available Shredly tools to update server configurations, remove tools or prompt templates, revoke server-sharing access, remove a custom domain, or archive a server. Disconnecting Shredly in an AI client stops that client's connection; it does not by itself delete records held by Shredly or the client. To request access to, correction of, or deletion of account information and stored records, contact support. We may need to verify your identity before acting on a request.

Your browser stores your Shredly session and basic profile in local storage to keep you signed in. Signing out clears those stored session and profile values. You can clear site storage and cookies in your browser or restrict analytics requests with browser privacy controls. Clearing browser storage removes local identifiers but does not erase previously collected server or analytics records; a new analytics identifier may be created when you return. Blocking required storage or scripts can affect sign-in and other features. Google also provides a Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Depending on where you live, you may have additional privacy rights. To ask about your information or exercise an applicable right, email support@shredly.io.

9. Children's Privacy

Shredly is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

10. Changes to This Policy

We may update this policy as the service or its data practices change. We will post the updated policy here and revise the date at the top of the page.

11. Contact

Questions about this policy? Reach us at support@shredly.io.