# Privacy and data handling

> What OpenNomos stores, what it does not, and which upstream providers see your queries. Draft based on the service code.

URL: https://mcp-docs.opennomos.com/docs/reference/privacy

<Callout type="warn" title="Draft">
This page describes what the service code does. It is not yet a legal privacy policy. Items marked TODO are undecided or not verified.
</Callout>

## What we store

| Data | Why | Retention |
| --- | --- | --- |
| Account: email, sign-in sessions, OAuth grants | Sign-in and authorization | While the account exists. TODO: deletion policy |
| API keys | Authenticate scripts | Only a hash is stored; the full key is shown once |
| Projects and profile cards | Your project context | Until you delete the project |
| **Memories** (text, kind, tags, which client wrote it) | Project memory you saved explicitly | Until forgotten; a forgotten memory disappears from reads immediately and is purged after 30 days |
| **Opportunities** (URL, title, summary, tags, stage, follow-ups) and their event history | Growth follow-up | Until removed. TODO: deletion tool |
| Experiments, actions, outcomes | Growth loop | Same |
| **Short links** and **click logs** | Attribution | See below. TODO: retention period |
| Briefing records | "Since your previous briefing" | TODO |
| Usage counters per pack and month | Monthly cost limits | TODO |

Each growth record notes the credential and client (for example "Claude Code") that wrote it.

## Short link clicks

When someone opens a redirect link, we record the time, whether it looks like a bot, the **country**, the **referrer host** (not the full URL) and a **visitor hash**. The hash is computed from IP address and user agent with a secret that **rotates daily**, so it can count visitors within a day but cannot be reversed and cannot link a person across days. We do not store the IP address or the user agent.

## What we do not store

- **Research results.** Tool outputs are returned to your agent and not saved unless your agent explicitly writes them to memory or tracks them. Public results may be held in a short in-memory cache (10 minutes) inside the server process.
- **Private messages.** Tool descriptions tell agents not to put private message text or personal data into summaries. Nothing enforces this, so do not log it.
- **Credentials for third-party platforms.** OpenNomos does not log in to X, Reddit or Xiaohongshu as you and does not act on them.

## Upstream providers

Queries (search text, URLs, domains, keywords, questions) are sent to third-party data providers to fulfil a call. The service reaches most of them through the Monid gateway (`api.monid.ai`), which routes to underlying providers; some sources can also use TinyFish, Serper or AISA directly as fallbacks. Providers named in the code include TikHub (social sources), DataForSEO (SEO and ChatGPT search), TinyFish (web search and page reading) and Search1API (news and trending). TODO: confirm the public list, each provider's retention terms, and where they process data.

## Where data lives

The service runs on Cloudflare Workers with a Cloudflare D1 database (primary in Tokyo / APAC). Backups use D1 Time Travel; there is no separate off-platform backup configured. TODO: confirm data residency statements.

## Authentication and email

Sign-in uses email one-time codes; the email is sent through Resend. GitHub sign-in is implemented but not configured. TODO: list processors.

## Your control

You can forget any memory with `memory_forget` and revoke an OAuth connection or API key in the console. TODO: account and data deletion request process and contact address.