This describes what the software does. It is adapted from the privacy page at mcp.zovo.one/privacy, which is checked against the source code. The code is public, so every claim here can be verified in github.com/theluckystrike/mcp-servers.
Who runs this
McpStamp is a Zovo product. The hosted endpoints, the checkout and the licence keys run on mcp.zovo.one. Zovo is a brand operated by autom8 LLC. For any privacy question, email support@zovo.one.
If you run a server on your own machine
Nothing leaves it. The stdio servers read and write only under your own data directory, ${XDG_DATA_HOME:-~/.local/share}/mcp-servers/<server>/. They make no network calls in normal use, send no telemetry, and have no account. A Pro licence key is verified offline with an Ed25519 signature, so activating one contacts nothing. The two exceptions are a server whose whole job is to fetch something you asked for, such as exchange rates or a product page, and those fetch only what the call names.
If you use a hosted endpoint
The hosted endpoints at mcp.zovo.one/mcp/<server> hold data, because they have to. What is kept, and for how long:
| What | Why | Kept for |
|---|---|---|
| An anonymous token, anon_<32 hex> | Separates your data from another caller's. No name, no email, no account. | 30 days, refreshed on each use |
| The documents your calls create, such as invoices or timesheets | They are the point of the server | Deleted 35 days after the last touch |
| A download link for a file a tool produced | To hand you the PDF or CSV | 1 hour |
| Rate-limit counters | To keep one caller from exhausting the endpoint | 2 hours |
Anyone holding your token can read your data, so treat the token as the secret it is. A shared cache of European Central Bank reference rates is read-only and common to everyone; nothing about you is written into it.
If your MCP client connects through OAuth, the access token it receives is an anonymous token of the same kind, with the same 30-day lifetime. The registration details your client sends (such as its name and redirect URLs) are kept for up to 365 days.
If you buy a licence
Payment is taken by Stripe. The card never touches McpStamp or mcp.zovo.one; the checkout page is Stripe's own.
After a successful payment, mcp.zovo.one stores one record against the Stripe session id: the licence key it issued, the product, and the email address Stripe collected for the receipt. That email is kept so a buyer who loses the key can recover it at mcp.zovo.one/recover?session_id=.... A paid webhook also attempts to send the key through Resend to the checkout email address. Email delivery is best-effort; the confirmation page remains the direct key delivery path. A purchase does not subscribe the buyer to setup tips. The licence key itself can carry a twelve character hash prefix derived from the email; it does not contain the address.
If you subscribe to setup tips
The setup-tips signup on mcp.zovo.one stores your email address, signup time, and source label in our licence storage for up to five years. Resend sends the welcome message, an invoice setup tip after about two days, and a bundle offer after about a week. Send markers prevent a completed step from being sent again. Each message has an unsubscribe link; opting out stores a suppression record for five years and stops later setup-tip and bundle-offer messages. Transactional licence delivery is separate. This website has no signup form.
Traffic and analytics
The hosted endpoints and the checkout run on Cloudflare, which logs requests as any web host does. mcp.zovo.one additionally counts clicks on upgrade links and records hosted tool-response and checkout-stage counts by fixed source labels. The hosted-response instrument keeps a SHA-256 token source/probe sidecar for 31 days and private daily token/server deduplication hashes; these are pseudonymous internal identifiers. Daily response counters and deduplication records are retained for at most 31 days from the UTC date's start. Aggregate reports expose no hashes, tokens, tool arguments or results, filenames, emails or client IPs. An emitted upgrade trailer is counted as an emission, not proof that a person saw it. Unmarked requests can include automation. Local stdio servers and the editable browser examples send no usage telemetry or field values.
This website, www.mcpstamp.com, is served by Cloudflare Pages. It loads Google Analytics 4, which uses cookies to count page views. A click on a buy link is sent to Google Analytics as a begin_checkout event with the product and the link's source label. A click on a support link (GitHub, Telegram, Buy Me a Coffee, PayPal) is sent as a support_click event with the link address.
Deleting your data
For a hosted endpoint, stop using the token and everything under it is deleted after 35 days; there is nothing to ask for. For a purchase record, subscription record, or another data request, contact support@zovo.one. Include the Stripe session id for a purchase; do not post licence keys, tokens, or payment details in a public GitHub issue.
What this page is not
It is a description of behaviour written by the person who wrote the code, not legal advice, and not a contract. Where it and the source disagree, the source is right and this page is a bug. The terms for using McpStamp are in the Terms of Service.