Privacy Policy

This policy covers gammarips.com and the GammaRips MCP server at mcp.gammarips.com. It says what personal data we collect, why we collect it, who receives it, how long we keep it, and what you can do about it. We do not sell personal data.

1. What We Collect

• Account data. Your email address, your display name if your sign-in provider supplies one, your account ID, and the date you created the account. If you sign in with Google, we receive your email and name from Google. If you sign in with an email and password, Firebase Authentication stores the password. We never see it.
• Billing data. Stripe collects your card and billing details. We never receive or store card numbers. We store your Stripe customer ID, your subscription ID, and your subscription status.
• API keys. We store only a SHA-256 hash of each key, plus its first 12 characters so you can tell your keys apart. We show the full key once, when you create it.
• OAuth sign-ins and machine clients. When you connect an AI client with OAuth, we store the client's name, its redirect addresses, your consent decision, and a hashed refresh token tied to your account. Access tokens are not stored. When you create a machine client, we store its name, a hash of its secret, and when it was created and last used.
• MCP request data. For each request to the MCP server, our hosting provider logs the IP address, user agent, referring page, requested path, response status, response time, and a timestamp. For each tool call, we also record the tool name, your account ID, the first 12 characters of your API key or your OAuth client ID, your plan tier, whether the call was allowed, and a timestamp. These usage records do not store the arguments of the call.
• Site analytics. Google Analytics records pages you visit, the referring site, approximate location, device and browser type, and events such as sign-in and starting checkout. A Google Ads tag measures whether a visit that came from an ad led to a sign-up. We keep your Google Analytics client and session IDs in your browser's local storage and pass them to Stripe checkout, so a purchase can be matched to the visit that started it.
• Email and messages. Your email address if you join the newsletter, plus the text and reply address of any feedback or cancellation reason you send us.

We do not collect government ID numbers, health data, or precise location. Do not put personal data in tool arguments or feedback messages unless you want us to have it.

2. AI Clients (ChatGPT, Claude, and Other MCP Clients)

When you connect ChatGPT, Claude, Cursor, or another MCP client to GammaRips, the client sends us the name of the tool it calls and the arguments for that call, such as a ticker symbol or a date. We use the arguments to answer that call. We never receive your chat transcript, your other prompts, or the rest of the conversation. The client receives the tool result and handles it under its own privacy policy.

3. Why We Use It

• To run your account and sign you in, on the site and in AI clients.
• To process subscriptions and payments.
• To check which tools your plan includes and to enforce rate limits.
• To keep the service secure and to find and stop abuse.
• To send emails about your account and subscription, such as a welcome email or a notice that a trial ends.
• To send the newsletter, only if you sign up for it.
• To measure how people use the site and the MCP server, and which ads lead to sign-ups.
• To answer your support requests and feedback.
• To meet legal obligations.

4. Who Receives It

We share personal data only with service providers that process it for us, or when the law requires it:

• Google Cloud and Firebase: hosting, sign-in, database, and logs.
• Stripe: payments and subscription billing.
• Mailgun: email delivery.
• Google Analytics and Google Ads: site analytics and ad measurement.
• Government or legal authorities: only when the law requires it.

Market-data providers receive only market symbols and dates from the MCP server. They never receive your identity.

5. How Long We Keep It

• Account and billing records: while your account exists. We delete them when you ask us to delete your account, except records the law requires us to keep.
• MCP request logs (IP address, user agent, path, timestamp): 30 days, then deleted automatically.
• MCP tool-call usage records: while we operate the service, to measure usage and enforce plans. We delete the records tied to your account when you ask us to delete your account.
• OAuth records: a consent request expires after 10 minutes and an authorization code after 5 minutes. A refresh token expires 30 days after its last use. A client registration that no one uses for 90 days expires. Each record is deleted automatically, normally within a day after it expires.
• Access tokens: valid for 1 hour and never stored.
• API keys and machine clients: until you revoke them or delete your account.
• Newsletter list: until you unsubscribe. After that we keep your address marked as unsubscribed, so we do not email you again.
• Feedback and cancellation reasons: while your account exists, or until you ask us to delete them.
• Site analytics: Google keeps this data under the retention setting of our Google Analytics property.
• Stripe and Mailgun keep their own records under their own policies.

6. Your Controls

• Revoke an API key or a machine client on your account page. A revoked key stops working within a few minutes. A revoked machine client cannot get new tokens, and a token it already holds expires within 1 hour.
• Disconnect an AI client in that client's settings. To revoke every OAuth sign-in on our side, email us.
• Cancel your subscription through the Stripe customer portal on your account page.
• Unsubscribe from the newsletter with the link in any newsletter email.
• Block analytics cookies in your browser settings, or with Google's Analytics opt-out browser add-on.
• Ask for a copy of your data, a correction, or deletion by emailing evan@gammarips.com.

7. Cookies and Local Storage

Firebase Authentication keeps you signed in with your browser's storage. Google Analytics and the Google Ads tag set cookies to count visits and measure ad conversions. We store your Google Analytics client and session IDs in local storage, as described in section 1.

8. Security

All connections use HTTPS. Sign-in runs on Firebase Authentication. Stripe processes payments under PCI DSS. We store API keys, machine-client secrets, and refresh tokens only as hashes.

9. Changes

We may update this policy. We post every change on this page with a new date.

10. Contact

Questions? Email us at evan@gammarips.com