1. Data we collect
Account and sign-in
You sign in through auth.uefnmcp.com with Discord, Google, or GitHub. The provider you choose asks for your consent and can share an account id, a username or display name, an avatar, and an email address when that provider sends one. We store the account id, which provider you used, the provider id, the display name, and the avatar URL when one is provided. You can replace the display name in the portal; the name you save is what the portal and the MCP consent screen show. We never see or store your Discord, Google, or GitHub password. Each provider's own privacy policy governs what that provider collects. An email a provider sends at sign-in is a login-time hint. The account record we keep does not store that email address.
API keys
You can create API keys in the portal for scripts and older clients. We store a hash of the key, a short prefix, a label, the plan tier, when it was created, and when it was last used. The full key is shown once, when you create or rotate it. We cannot show it again.
Connected MCP clients
Claude, ChatGPT, Codex, Grok, Cursor, and other remote clients can connect with OAuth after you allow them. We store the grant: the client id, the name and address the client gave us, the redirect address, the scopes, and when you approved it. You can disconnect one client or every client from the portal.
Usage
We count hosted tool calls so daily limits can be enforced. For each API key, and for browser OAuth, we store the UTC day, the tool name, and how many times it was called. These are operational counts, not an advertising profile.
Verse checks
A hosted Verse check runs without the UEFN editor. The log stores file names, whether the check passed, error and warning counts, how long it took, a short first error, and the size of what you sent. It does not store your Verse source.
Studio skills, bundles, and files
Studio skills, bundles, snapshots, runbooks, and project files are stored for your account, or for a studio you belong to. Teammates you invite can see that studio's content according to their role. If you invite someone by email, we store the address you typed so we can send the invite through Cloudflare Email and match it when they accept. A Discord, Google, or GitHub username or account id used as an invite is stored the same way.
Screenshot shares
You can upload a PNG, JPEG, or WebP image. We re-encode it to WebP before storing it, which drops the original file and metadata embedded in it, such as EXIF. The public link is an unlisted address on shots.uefnmcp.com. There is no public gallery. Anyone who has the link can open the image until it expires or you delete it. Free links expire after 7 days. Pro and Studio links expire after 90 days. Pinned links do not expire. You can delete a screenshot you uploaded. Deleting it removes the image, and the link stops working.
Do not upload illegal content. If we learn an upload includes sexual content involving anyone under 18, we delete it.
Billing
No payment processor is connected. We do not collect payment card numbers. Prices on the pricing page are proposed and are not charged. The portal can list invoices later; today that list is empty.
Cookies
One strictly necessary session cookie keeps you signed in for about 14 days. Short-lived cookies finish the sign-in handoff and, for a couple of minutes, let the portal show a new API key once. Cloudflare may set its own security cookies. We do not use advertising cookies or third-party analytics trackers. The site loads typefaces from Google Fonts, so your browser requests those files from Google. That request is covered by Google's privacy policy.
Security logs
Cloudflare, which hosts this service, can keep short-lived technical logs, including IP addresses, for security, abuse prevention, and debugging. Those logs are not a personal analytics profile, and we do not sell them.