HostCrafter MCP Server Privacy

For each registered site

its address, the address of its REST API, and the route name the plugin answers on
an id the service gives it
the site's secret, encrypted with a key only the service holds
the IP address the site registered from
the plugin and WordPress versions, the page where its administrators approve sign-ins, the names of the tools its plugin offers, and how many AI abilities each of its other plugins offers (counts only)
for a site connected from the HostCrafter panel, the HostCrafter plan it belongs to

For each connection

its id and the name you gave it
how it signs in, and a one-way hash of its 384-bit secret — never the secret itself
what it may do on each site
when it was made, when it was last used, and when it expires
for a sign-in connection: the AI app that registered (its name and the addresses it returns to) and a hash of its current refresh token

For the free allowance

for each site address, the number of tool calls in the current 24 hours and when they started; kept until those 24 hours end, also after the site is removed, so that removing and adding a site does not reset the allowance
for a site that was removed, its address and its old id for 24 hours, so that connecting it again within a day is the same site

Images you upload in your AI app

Images you drop into the upload panel (or the upload page) are held on the service for at most 5 minutes after your last upload, then deleted, and at once when your site has added them to its media library. They are checked to be JPEG, PNG, GIF or WebP images and are seen by nothing else. Only your site fetches them, from a one-time address. Nothing about them is kept after they are deleted.

What it never stores

No record of what a connection did: not the tools called, not what was sent, not what came back. Your posts, media, settings and users are never stored on the service. A request passes through it on the way between your AI app and your site — encrypted to your site on the way in — and is gone once it is answered.

The service's own technical log notes when a site registers or leaves, with its address, and errors. It never records tool calls, and it is rotated automatically.

The log on your site

Each tool call, sign-in and connection change is written to a log in your own WordPress database: when, which connection, what happened, whether it worked, how long it took, and a short summary of what it was given (the size of a post's text, never the text). It holds up to 10 MB, the oldest entries going first. Read it, or clear one connection's entries or all of them, under HostCrafter MCP → Logs; deleting the plugin deletes it.

How long it is kept

A connection: until you revoke it, it expires, or 30 days pass without it being used.
A site: until you remove it under HostCrafter MCP → Settings, deactivate the plugin choosing Revoke everything, or delete the plugin — each deletes it and its connections at once. Deactivating with Pause keeps them, answering nothing, until the plugin is active again. A site that stops checking in is disabled after 30 days and deleted after 90.
A registration in progress: an hour. A sign-in waiting for approval: ten minutes. An uploaded image: at most 5 minutes after the last upload.

Who sees it

HostCrafter runs the service on its own servers. We do not sell this information, share it for advertising, or give it to anyone else unless the law requires it. The AI app you connect is run by its own company, under its own privacy policy.

Your rights and contact

Email [email protected] for a copy of what the service holds about your site, or to have it deleted — or delete it yourself: removing the site under HostCrafter MCP → Settings deletes everything above at once. Our general privacy policy covers hostcrafter.com and HostCrafter hosting.