This is a starting draft that comes with the login kit, not reviewed by a lawyer. It describes what the kit itself does with personal data. Your application will do more, and the parts in square brackets are placeholders: replace this page with terms that cover your whole service, and have them reviewed for your jurisdiction.
What we keep
When you sign in we keep your email address, your name, how you signed in (an emailed code, or Google, Microsoft or LinkedIn), when you agreed to these Terms and to the Privacy Policy, and your account status. We do not receive your password from those providers.
For each place you are signed in — each browser, and each connected tool (MCP) — we keep a short label (for example “Chrome on Windows”, or the connected tool’s own name), when it signed in, when it was last used and how it signed in. Not your IP address, and not your full browser identification. You can see these in the account menu and end any of them with End session; Sign out everywhere ends all of them.
Connected tools receive your data. When you allow a connected tool (MCP client) you choose what it may do: read the data you keep here, and optionally change it. What it reads is sent to that tool and to any service it relies on, such as an AI model, and from then on is handled under that tool’s own terms and privacy policy, not these. We cannot recall it. You can end a tool’s access at any time with End session.
How long we keep it
Your account details are deleted after 30 days without activity. A session ends by itself after 7 days without use. An account that an administrator has suspended or closed is kept, with its status, until the administrator changes it. [Placeholder: state your legal basis for that.]
Your choices
Sign out ends the session in that browser and nothing else. GDPR: forget me (in the account menu, the round icon with your initials at the top right) deletes your data, ends every session, and replaces your email address and name on record with “anonymous”. One minimal pseudonymous record is kept, by default without a time limit (USER_FORGOTTEN_RETENTION_DAYS) — a one-way, keyed hash of your email address and the date you asked to be forgotten — so that we can honour your request and not collect data about you again. [Placeholder: state your legal basis for keeping it.]
Cookies
We set one cookie that identifies your session, and we remember in your browser (until you close the tab) whether you accepted the cookie notice. We do not use advertising or tracking cookies.