WP AI Bridge privacy
What the MCP service at mcp.hostcrafter.com stores about your site and its connections, and what it never keeps.
Last updated 27 October 2026
For each registered site
- its address, and the address of its REST API
- an id the service gives it
- the site's secret, encrypted with a key only the service holds
- the IP address the site registered from
- the plugin and WordPress versions, and the page where its administrators approve sign-ins
- a count of today's tool calls, reset every day
- for a site connected from the HostCrafter panel, the HostCrafter plan it belongs to
For each connection
- its id and the name you gave it
- how it signs in, and a one-way hash of its secret — never the secret itself
- what it may do on each site
- when it was made, when it was last used, and when it expires
- for a sign-in connection: the AI app that registered (its name and the addresses it returns to) and a hash of its current refresh token
What it never stores
No record of what a connection did: not the tools called, not what was sent, not what came back. Your posts, media, settings and users are never stored on the service. A request passes through it on the way between your AI app and your site — encrypted to your site on the way in — and is gone once it is answered.
The service's own technical log notes when a site registers or leaves, with its address, and errors. It never records tool calls, and it is rotated automatically.
The log on your site
Each tool call is written to a log in your own WordPress database: when, which connection, which tool, whether it worked, how long it took, and a short summary of what it was given (the size of a post's text, never the text). It holds up to 10 MB, the oldest entries going first. Read or clear it under AI Bridge → Logs; deleting the plugin deletes it.
How long it is kept
- A connection: until you revoke it, it expires, or 30 days pass without it being used.
- A site: until the plugin is deactivated or you remove it under AI Bridge → Settings, both of which delete it and its connections at once. A site that stops checking in is disabled after 30 days and deleted after 90.
- A registration in progress: an hour. A sign-in waiting for approval: ten minutes.
Who sees it
HostCrafter runs the service on its own servers. We do not sell this information, share it for advertising, or give it to anyone else unless the law requires it. The AI app you connect is run by its own company, under its own privacy policy.
Your rights and contact
Email [email protected] for a copy of what the service holds about your site, or to have it deleted — or delete it yourself: removing the site from AI Bridge → Settings deletes everything above at once. Our general privacy policy covers hostcrafter.com and HostCrafter hosting.