MateMCP is a service and open-source software project maintained through the MateMCP GitHub repository. This policy describes the information processed by the hosted website, account portal, OAuth control plane and Relay. The local MateMCP Agent also processes information on the computer where it runs.
Information we process
- Account information: email address, account identifier, password hash, account status and administrator status. When you connect an external identity provider, we store its provider name, stable account identifier and the email supplied by that provider.
- Agent and connection information: Agent public identifier, display name, platform, credential hash, granted scopes, revocation status, last-seen information and OAuth client/authorization records needed to authenticate a connection.
- Security and approval records: events such as enrollment, credential rotation, revocation, approval decisions and administrative actions. These records support security, troubleshooting and account operations.
- Operational activity: bounded metadata such as the MCP method/tool name, status, duration, request correlation identifier and configured project name. Runtime activity history is limited to the newest 500 events per Agent. Runtime activity metadata is not the same as the separate security/audit history.
- Website and portal analytics: the website and account portal currently load Google Analytics. Google may receive browser, device, page and usage information and may use cookies or similar technologies according to its own documentation and settings.
- Service request metadata: our hosting, network, CDN and infrastructure providers may process connection metadata such as IP address, request time, user agent and diagnostic information as part of delivering and protecting the service.
Information handled by your Agent and AI client
When an AI client calls an Agent tool, the request and its result travel between that AI client, the MateMCP Relay and the selected Agent so the requested operation can be performed. The Relay is not intended to persist tool arguments, command text, file contents, response bodies, credentials or secret values in runtime activity records. The Agent may read or change local files, run commands, operate a browser or interact with desktop applications within the permissions and approvals you configure. Your AI provider and AI client handle conversation content under their own policies.
MateMCP-managed secret values are resolved locally by the Agent from the operating system credential store. The Relay does not need those secret values to route an operation. Do not grant access to projects, applications or data that you do not want the connected AI client to use.
Why information is used
We use information to create and secure accounts, authenticate OAuth connections, bind each connection to the Agent selected by its owner, enforce scopes and revocation, coordinate approvals, provide the service, diagnose failures, maintain security records and understand aggregate website usage.
Service providers and sharing
We use infrastructure and analytics providers to host and operate the public website, account portal and Relay. Google Analytics is currently enabled on the website and portal. Information is also transmitted to the AI client/provider and to the Agent you connect when needed to execute your requested MCP operations. We do not describe this as a zero-data or no-third-party service. We do not sell personal information. We may disclose information where required by law or to protect the service and its users.
Retention
Account, Agent, OAuth and security records are retained while needed to operate the account, provide the service, investigate security events or meet legal obligations. Runtime activity records are pruned to the newest 500 events per Agent. We do not currently publish a fixed deletion schedule for all account and security records. Local audit and project data may also remain on your own computer and are subject to your local configuration and backups.
Your choices and requests
You can disconnect an OAuth client, revoke an Agent, stop using the service, and manage locally stored secrets and project permissions through the available MateMCP controls. For an account, access or privacy request, use the project issue tracker and avoid posting private information in a public issue. For a sensitive security report, use GitHub's private security advisory flow when available. Account or record deletion may be subject to security, legal and operational retention requirements.
Children
MateMCP is a developer and productivity service and is not designed for children to create accounts independently.
Changes
We may update this policy as the service changes. The effective date at the top of this page indicates the latest revision.
This page describes current product behavior based on the published implementation. It is not a guarantee that every deployment or third-party provider processes information identically.