Privacy

Last updated: October 2026.

MCP Canary is run by XAKPC Dev Labs, a sole proprietorship in Armenia. Contact: [email protected].

What we store

• Workspace. An id and a hash of its token. There is no account, name, or email.
• Monitors and webhooks. What you send: endpoint URLs, tool names, tool arguments, assertions, webhook URLs. Target headers and tokens are encrypted at rest and never returned.
• Check results. Status, timings, the tool names and schemas, and failure details. A failure can include the value that failed an assertion (up to 1 KB) or the error text a tool returned. Full tool responses are not stored.
• Billing. Your plan, the Polar customer and subscription ids, and period dates. Polar handles the payment and your payment details; we never see card numbers.
• Request logs. IP address and request path, for rate limits and abuse protection, kept for a short time.

Do not put personal data in tool arguments. Use a test record, for example [email protected].

How long

Incidents and failed checks: 7, 30, or 90 days by plan. Passed checks: 1 day. Deleting a monitor deletes its checks and incidents. Backups are kept for up to 30 days.

Who processes data

• Hetzner Online GmbH: servers (Hillsboro, Oregon, USA) and backups (Falkenstein, Germany).
• Polar Software (merchant of record): payments, invoices, taxes. See polar.sh/legal/privacy.
• GitHub: release downloads.
• This website loads fonts from Google Fonts and styles from the Tailwind CDN. They receive your IP address. The site sets no cookies and has no analytics.

Your rights

Ask us to export or delete the data of your workspace. Include the workspace id (canary entitlement --json) and send the request from a place that proves you control it, for example by deleting the monitors with your token first.