Privacy Policy

This policy covers the remote Extenshi MCP connector at mcp.extenshi.io, which connects Claude and other MCP clients to your Extenshi account. It explains what the connector receives, what it stores, why, for how long, and who processes it. Your Extenshi account itself is covered by the Extenshi privacy policy.

What the connector receives

• Tool inputs only. When Claude calls a tool, it sends that tool's arguments — for example a search phrase, an extension or store id, a project id, a manifest you ask to import, a policy text you ask to publish, or a Pay offer you ask to create. The connector does not receive your wider Claude conversation, your Claude memory, chat history or files.
• Your identity after sign-in. You sign in on Extenshi's own login page; the connector never sees your password. It receives your Extenshi account identifier and email and the permissions you approved on the consent screen.

What the connector does with it

Every tool call runs against Extenshi's own services on your behalf and is limited to the permissions you approved:

• Catalog and research: reads the public Extenshi catalog — extension listings, ratings, security analysis, market statistics — and our documentation. Catalog reads count against your account's read allowance.
• Projects: reads and, when you ask, updates your Dojo projects — repository metadata, manifest observations, project specifications, imported manifests and CI ingest secrets.
• Release evidence: records test, scan, listing, privacy and payment evidence metadata (browser, artifact and input hashes, status).
• Hosted pages: registers, verifies and removes the homepage and support page URLs of your projects. Verification fetches only the URL you registered and stores a hash of the page.
• Hosted privacy policies (Pro projects): publishes the policy text you approve at your project's public URL. "Update with AI" sends your current policy, saved form answers and manifest permissions to Anthropic's API to draft a proposal; nothing is published until you publish it.
• Extenshi Pay: reads and configures your own Pay applications, offers, seller profile and SDK keys, and exports your Pay records. The connector never moves money: it does not charge, refund or pay out. Connecting a payment provider, accepting agreements and identity verification (KYC) happen in your browser with the payment provider, not through the connector.

What we store

• Content you create through tools — project records, imported manifests, workspace revisions, evidence metadata, hosted-page registrations and hashes, published policy versions, Pay applications and offers — is stored in your Extenshi account exactly as if you had created it in the Extenshi dashboard. Published privacy policies are public by design.
• Secrets are stored as hashes. OAuth access and refresh tokens and CI ingest secrets are stored only as hashes and cannot be recovered from our records.
• Usage analytics (only if you leave it on at connect time): for each tool call, the tool name, duration, a coarse success/error category, your account identifier and a connection identifier. We never record tool arguments, tool results or conversation content, and your email address is not sent to our analytics provider.

We do not keep tool arguments or results beyond what a tool is designed to save to your account.

Retention

• OAuth access tokens expire after 1 hour and refresh tokens after 30 days; revoking the connector invalidates them immediately.
• Account content (projects, evidence, policies, Pay configuration) is kept until you delete it or delete your Extenshi account, and is erased within 30 days of account deletion. Pay transaction records are retained for 10 years where accounting and tax law requires it.
• Usage analytics are kept for 12 months and then deleted.

Processors and where data lives

• Hosting: Extenshi services and databases run on servers in the EU (Hetzner, Germany and Finland), behind Cloudflare for TLS and network protection.
• Analytics: PostHog (EU region) receives usage analytics with your account identifier, never your email or content.
• AI drafting: Anthropic (Claude API) processes policy text only when you use "Update with AI".
• Payments: Stripe processes Pay onboarding and payments under its own terms once you connect it.

We do not sell personal data and do not use connector data for advertising.

Your choices

• Usage analytics are optional. Untick "Share usage analytics" on the consent screen when you connect; no analytics or error reports are sent for that connection. To change your choice later, disconnect and connect again. The local @extenshi/mcp package honours DO_NOT_TRACK and EXTENSHI_TELEMETRY=0.
• Disconnect the connector or revoke its access at any time from your Extenshi account; access stops immediately.
• New permissions are never added without a new consent.
• Ask for access, export or deletion of your data at [email protected].

Contact

Questions, data requests and security reports: [email protected].