DRAFT: pending review. This page is a working draft and is not yet a final legal document.
privacy
Privacy Policy
Last updated 25 October 2026. This policy explains what JustClaw-It collects when you use justclaw.it.com, the
MCP server and the connector, and what we do with it.
Open decisions before this draft is final:
- Legal entity: Who is the contracting party and merchant of record: M P personally, Two7 Design, or a new LLC? The pages say "JustClaw-It" until this is set.
- Jurisdiction: Governing law and venue (which US state, or elsewhere) for disputes.
- Contact email: A dedicated legal/privacy address, or keep mike+mcpsupport@two7.design.
- Data retention: How long usage logs, audit logs and closed accounts are kept (the draft says 12 months for logs, 30 days to action a deletion request).
- Refund window: Whether to add a goodwill window (for example 7 days on a first subscription) on top of the billing-error refunds the draft promises.
- Self-serve cancel: /account has no cancel button and there is no Stripe customer portal yet, so the drafts (and /support) say cancel by email. Add the Stripe portal, or accept email cancels.
- Minimum age: The draft says 16+; confirm, or use 13+ / 18+.
What we collect
- Account data: your email address, and a phone number only if you choose to verify one.
- API keys: stored as one-way hashes; we cannot see your full key after it is shown to you once.
- Usage logs: tool calls per key (time, tool, credits used, the number of results, and the
search text, prompt or component ID you sent, cut to 200 characters), the IDs of components you pull (for the
fair-use cap), and credit balances. You can see your own recent calls on /account; the
search text is kept for 90 days and used to run the service and to find gaps in the library.
- Security logs: IP address and browser user agent for sign-in, signup and checkout events,
used to stop abuse of the free tier and attacks on accounts.
- Payments: handled by Stripe. We receive your plan, subscription status
and a Stripe customer ID; we never see or store your card number.
- Free audit: the public repository URL you submit and the resulting scores, and your email
if you ask for the full report. We do not keep your source code.
We do not sell personal data, show ads or use tracking cookies. We set two cookies: the session cookie that
keeps you signed in to /account, and a random device identifier (jc_dev) set
on the signup page and used only to limit how many free accounts one browser can create. The connector CLI sends your key only to justclaw.it.com
and stores it in your agents' own config files on your machine.
Why we use it
- to run the service: authenticate keys, meter credits and enforce plan limits;
- to bill paid plans and send transactional email (sign-in links, receipts, important service notices);
- to prevent abuse and keep the service secure;
- to understand aggregate usage so we can improve search.
Who processes it
- Hetzner (hosting, Germany, EU)
- Stripe (payments)
- Spacemail (outbound email from justclaw.it.com)
- Cloudflare Turnstile (bot check on signup, when enabled)
How long we keep it
Account data is kept while your account is open. Usage and security logs are kept for up to 12 months.
Billing records are kept as long as tax law requires. [DECISION: confirm retention periods.]
Deletion and your rights
Email mike+mcpsupport@two7.design from your account address to get a copy of your
data, correct it, or delete your account. We act on deletion requests within 30 days, revoke your
keys and erase your account data, except what we must keep for billing, tax or fraud-prevention law. Depending on
where you live (for example the EU, UK or California) you may have further rights, including complaining to your
data-protection authority.
Security
API keys are stored as SHA-256 hashes, traffic is encrypted with TLS, and the component database is read
only through restricted functions. No system is perfectly secure; if we learn of a breach affecting you, we will tell you.
Children
JustClaw-It is not directed at children under 16.
Changes and contact
We will email you about material changes. [DECISION: legal entity / data controller name and address.]
Questions: mike+mcpsupport@two7.design.