Retention and privacy
Current MCP windows
Section titled “Current MCP windows”| Data | Retention contract |
|---|---|
| OAuth authorization code | Functionally valid for 60 seconds; consumed or expired digest rows purge within 24 hours |
| MCP action audit rows | At least 90 days, then daily purge |
| Soft-deleted Tasks | 30 days, then daily hard purge |
| Attachments on completed Tasks | Contracted for purge 30 days after completion; availability depends on the implemented storage lifecycle |
Sensitive data boundaries
Section titled “Sensitive data boundaries”Free personal data that remains local to a device is not available to hosted MCP tools. Cloud-backed data is still filtered by connection, MCP resource, scope, ownership or membership, and entitlement.
OAuth authorization codes are stored as digests, not reusable credentials. Access tokens and refresh tokens must remain confidential and must not be placed in prompts, tool arguments, logs, or support messages.
Account deletion
Section titled “Account deletion”Account deletion removes the person’s server-side account data according to the published policy and service deletion workflow. Device-local data is controlled on the device. Review the current Privacy Policy and Account Deletion guide before deciding how your integration should handle a disconnected or deleted account.