Privacy Policy
Last updated September 12, 2026
This policy explains what the hosted MCP servers listed on adamwanninger.com collect, how they use it, where it's kept, and for how long. Adam Wanninger runs these servers as a personal project. The policy covers the hosted servers only. A copy of the code that you run on your own computer sends nothing to me.
In short
- When you sign in, Google gives the server your Google account ID and your email address. The email address is used only to check that it's verified, and is never stored.
- The server stores your Google account ID with the tokens it gives your MCP client. They are deleted no more than 30 days after your client last uses them.
- Your requests to the tools (which bus, which stop) are answered, not stored.
- Google Cloud keeps request logs, which include your IP address, for 30 days.
- Nothing is sold, used for advertising, or shared, apart from Google Cloud, which runs the servers.
What the server receives from Google
To sign you in, the server asks Google for two permissions, openid and
email. Together they give the server:
- your Google account ID, a number that identifies your account;
- your email address, and whether Google has verified it.
The server asks for nothing else: not your name, photo, contacts, Gmail, Drive, calendar, or any other data in your Google account. Google sends this information in a signed ID token, which the server checks and then discards. Google also sends an access token for your Google account. The server throws it away without using it and never stores it.
How the server uses it
- Email address: used only to confirm that Google has verified it; if not, sign-in is refused. For a server open only to certain people, it's also checked against the list of people allowed. It's never stored, and never written to a log.
- Google account ID: linked to the tokens the server gives your MCP client, so the server knows whom they belong to.
What the server stores
The records below are kept in Google Cloud Firestore, in the United States (Google Cloud's us-east1 region, in South Carolina). Each record is filed under a SHA-256 hash of its code or token, so the codes and tokens themselves are never stored.
| Record | What it holds | How long |
|---|---|---|
| Client registration | The MCP client app that connects registers itself: its name, the addresses to send you back to after sign-in, and an ID and secret the server generates for it. Nothing about you. | 90 days after the client last receives tokens |
| Sign-in in progress | What your MCP client sends to begin signing in: its ID, its return address, a one-time state value and code challenge, and which server you're connecting to. Also a one-time secret the server uses with Google. | 10 minutes |
| Authorization code | Your Google account ID, the client's ID, and the sign-in details above | 60 seconds, and it can be used only once |
| Access token | Your Google account ID, the client's ID, the permissions granted, which server the token is for, and when it expires | 1 hour |
| Refresh token | The same as an access token | 30 days. Each use replaces it with a new one, so the tokens of a client you stop using are gone within 30 days. |
Expired records are ignored at once, and Firestore deletes them automatically, usually within a day.
Your requests to the tools
What you ask a tool for, such as a vehicle number, a route, or a stop name, is used to answer you. It isn't stored or logged. To answer, each server fetches public data from its source: QueensCoach reads the Charlotte Area Transit System's public transit feeds. Those requests carry nothing about you.
Logs
- Google Cloud Run records each request made to a server: the time, the address requested, the result, how long it took, your IP address, and your MCP client's user agent.
- The server's own log records failed sign-ins, the Google account ID of any sign-in it refuses, the client ID of each MCP client that completes sign-in, and problems reaching its data sources.
Both are kept in Google Cloud Logging for 30 days and then deleted automatically.
Cookies and this website
The servers set no cookies. This website sets none either, and has no analytics or trackers. GitHub Pages hosts it, and may log visitors' IP addresses for security; see GitHub's privacy statement.
Sharing
Your information isn't sold, used for advertising, or shared with anyone. The only exception is that the servers run on Google Cloud (Cloud Run, Firestore, and Cloud Logging), so Google processes this data on my behalf as the hosting provider. I'll disclose information only if the law requires it.
Adam Wanninger's MCP Servers' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Your choices
- Stop using a server: remove it from your MCP client. If your client revokes its tokens as it does so, the server deletes them immediately. Otherwise they expire within 30 days.
- Remove the app from your Google account: go to myaccount.google.com/connections. This removes the app from your Google account. Because the server holds no Google tokens, its own tokens are unaffected and expire on their own.
- Ask for deletion: email deletion@adamwanninger.com, and I'll delete the records linked to your account. The server doesn't store email addresses, so I can't look you up by email. I'll work with you to find your records, or clear every active sign-in, which signs everyone out. Request logs can't be deleted one by one. They're deleted automatically after 30 days.
Children
The servers aren't directed at children under 13, and don't knowingly collect their information.
Changes
If what the servers collect changes, this page changes first, and the date at the top shows when it last did.