Privacy policy

Last updated 2026-09-21. webmcp.fast is operated by Proticom (Huntington Beach, CA, United States). This page says what the service processes, in plain terms. The design goal is that your data stays on your machine and the gateway knows as little as it can.

What we process

• Your account email address. It is the only personal identifier we ask for. We use it to send the 6-digit sign-in code and, rarely, a message about the service. There are no passwords.
• Sign-in and session data. Sign-in codes are stored hashed, last 10 minutes and work once. A session is one HttpOnly, Secure, SameSite=Lax cookie on webmcp.fast. We set no advertising or analytics cookies and load no third-party trackers.
• Your handle and the organisation record it belongs to.
• Device metadata. For each paired device: the name you gave it, its Ed25519 public key, a SHA-256 hash of a machine identifier (used only to stop one machine being paired to many free handles), the daemon version, the platform string, and when it was last connected. The private key never leaves your machine.
• Server metadata. The aliases of the servers a device offers, their transport and status, and the policy you set on the dashboard.
• OAuth records. The registered client name and redirect URIs of each agent you approve, and the grant that binds it to one endpoint. Tokens are stored hashed.
• IP addresses, briefly, for rate limiting sign-in, pairing and handle checks, and in Cloudflare's standard request logs.

Relayed MCP traffic

The JSON-RPC messages between an agent and your local server pass through the gateway in memory so they can be routed. They are not stored: not the tool arguments, not the results, not resource contents, not prompts.

Audit metadata

So that you can see what your connectors did, each relayed call records metadata only: the time, the device, the server alias, the MCP method, the tool name, the duration and the outcome, plus the client name when a session opens. No argument or result bodies are recorded. Audit rows are kept for 30 days and then deleted.

Who else is involved

The service runs entirely on Cloudflare (Workers, Durable Objects, D1, KV, Email Service, and Turnstile on the sign-in form when enabled), which acts as our infrastructure provider. We do not sell personal data and do not share it with anyone else, except where the law requires it.

Retention and deletion

Account, handle, device and grant records are kept while the account exists. Revoking a device or disconnecting a connector takes effect at once. Free handles that stay offline for 60 days may be released. To have your account deleted or to get a copy of what is held, write to support@webmcp.fast from the account's email address.

Changes

If this policy changes in a way that matters, the date above changes and account holders are told by email. Related: terms, security, contact.