01Scope
This notice covers the hosted service.
It applies when you visit the public site, create a hosted account, connect an MCP client, save or review artifacts, use destination representations, or manage a subscription. If an organization instructs you to use the service, that organization may have its own privacy responsibilities and policies for the content it asks you to process.
The local open-source server stores data on the operator’s computer and has no hosted account or cloud synchronization. Its operator decides what is saved, how the database is protected, and how long it is retained.
02Information
The service processes account, artifact, connection, and operational data.
- Account data: name, email address, verification state, password hash, passkey records, sessions, and account timestamps.
- User content: titles, Markdown, recipe fields, projects, tags, revisions, and the destination representations you request.
- Provenance you or a client supplies: client and model labels, session identifiers, local paths, repository details, branch, commit, verification notes, and referenced files.
- Review and safety data: lifecycle changes, redacted secret findings, acknowledgements, copy receipts, and project policy.
- Connection and operational data: OAuth client and consent records, scopes, request identifiers, IP address, user agent, rate-limit and usage counters, security events, and service logs.
- Billing data: plan and subscription status plus payment-provider customer and subscription identifiers. Full card details are handled by the payment provider rather than stored in artifacts.
03Purpose
Information is used to provide and protect the workflow you request.
Rahit Ash uses this information to authenticate users, authorize MCP clients, store and retrieve artifacts, build requested representations, preserve revisions and provenance, apply project and safety policy, record copy actions, enforce capacity and abuse limits, operate billing, send transactional account messages, diagnose failures, respond to support or security reports, and comply with applicable legal obligations.
Do not save personal data, confidential information, or credentials unless you are authorized to process it and the hosted service is appropriate for that use. Secret scanning is a fallible guardrail and does not change your responsibility for the content you submit.
04Providers
Specialized providers support the hosted operation.
The hosted service uses infrastructure and database providers and uses Stripe for subscription billing. It also uses an email delivery provider for verification and password-reset messages. Depending on deployment configuration, abuse-prevention, caching, and error-monitoring providers may process limited request or diagnostic information.
Information may also be disclosed when required by applicable law, to investigate abuse or security incidents, to protect users or the service, or as part of a business transaction subject to appropriate safeguards. This notice does not claim that material placed into third-party destinations remains governed by Rahit Ash after you copy and send it there.
05Retention
Keep artifacts only while they remain useful.
Hosted artifacts and their related revisions remain until a user deletes them or the account, subject to operational backups, security records, billing obligations, and legal requirements. Individual artifact deletion removes the active hosted records associated with that item. Account deletion removes the account through the authentication system and cancels an active subscription; some records may need to remain where law, fraud prevention, dispute handling, or backup integrity requires it.
No fixed backup-erasure interval is promised on this page. Contact the operator if your use requires a specific retention commitment before placing regulated or sensitive content in the service.
06Choices
Use account controls first, or contact the operator.
You can review and delete artifacts, revoke OAuth clients, manage authentication methods, and delete the hosted account through available product controls. Depending on your location, applicable law may also give you rights to access, correct, delete, restrict, object to, or receive certain personal information.
Send privacy questions or requests to hi@rashy.me. The operator is Rahit Ash; its stated jurisdiction is Dubai, United Arab Emirates. The operator may need to verify identity before acting on a request.