Loading...
Legal
Last updated: April 9, 2025
OpenTool ("we", "us", "our") is an open-source MCP (Model Context Protocol) server platform. This Privacy Policy explains how we collect, use, store, and protect your information when you use the OpenTool hosted service at opentool.space, our dashboard, CLI, SDKs, and related services (collectively, the "Service").
If you self-host OpenTool, this policy applies only to any interactions with our hosted services (such as package registries or documentation). Your self-hosted instance is under your own control and responsibility.
When you create an account, we collect your email address and a hashed version of your password. We never store plaintext passwords. Your password is hashed using bcrypt before storage.
We generate and store API keys that authenticate your requests. These keys are associated with your account and can be revoked at any time through the dashboard.
When you connect third-party services (GitHub, Slack, Notion, etc.), we receive OAuth access tokens and refresh tokens from those providers. These tokens are encrypted at rest using AES-256-GCM before being stored in our database.
We collect basic usage metrics including tool execution counts, error rates, and response times. This data is used to improve service reliability and is not tied to individual user identities.
Our servers automatically log request metadata including IP addresses, timestamps, user agents, and request paths. Logs are retained for a limited period for debugging and security purposes.
We do not sell, rent, or share your personal information with third parties for marketing purposes. We do not use your data to train AI models.
We take the security of your data seriously. Our security measures include:
Our database is hosted on Neon (PostgreSQL) with automated backups. Redis caching is provided by Upstash with TLS encryption. The application is hosted on Render with automatic SSL.
OpenTool integrates with third-party services on your behalf. When you connect a provider, we access only the data and permissions you explicitly authorize through OAuth consent screens. The providers we currently support include:
Each provider has its own privacy policy governing how they handle your data. We encourage you to review their policies. We only store the OAuth tokens necessary to execute tool calls — we do not bulk-download or cache your data from these services.
When you connect a third-party service, you are redirected to that provider's authorization page where you grant specific permissions (scopes). OpenTool requests only the minimum scopes necessary for the tools to function. You can disconnect any provider at any time through the dashboard, which will immediately revoke our stored tokens.
We do not access any data beyond what is required to fulfill the specific tool call you initiate. For example, the GitHub "Create Issue" tool only accesses the repository you specify in that request.
You have the right to:
To exercise any of these rights, contact us at the email address below or use the relevant features in the dashboard.
OpenTool is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly.
We may update this Privacy Policy from time to time. Material changes will be communicated through the dashboard or via email. Continued use of the Service after changes constitutes acceptance of the updated policy. The "Last updated" date at the top of this page reflects the most recent revision.
If you have any questions about this Privacy Policy or our data practices, please reach out:
Email: privacy@opentool.space
GitHub: Open an issue
OpenTool is open-source software released under the MIT License. This privacy policy applies to the hosted service at opentool.space. Self-hosted instances are governed by the operator's own policies.