Privacy Policy

1. Introduction

This Privacy Policy describes how we collect, use, and handle your personal information when you use our service. We are committed to protecting your privacy and handling your data in an open and transparent manner.

2. Information We Collect

We collect the following personal information from you:

• First Name: To personalize your experience
• Last Name: To personalize your experience
• Email Address: For account authentication and communication
• Last Sign-in Timestamp: For security and account management purposes
• Account Creation Timestamp: For record-keeping and account management

We do NOT collect or track:

• Pages you visit on our website
• Browsing history or behavioral data
• Third-party tracking cookies
• IP addresses for tracking purposes

3. How We Use Your Information

We use the information we collect for the following purposes:

• To create and manage your user account
• To provide you with API keys for accessing our service
• To authenticate your identity when you sign in
• To communicate with you about your account
• To improve our service and user experience
• To comply with legal obligations

4. Data Storage and Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized or unlawful processing, accidental loss, destruction, or damage. Your data is stored securely and access is restricted to authorized personnel only.

5. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With your explicit consent
• To comply with legal obligations or valid legal processes
• To protect our rights, property, or safety, or that of our users
• With service providers who assist us in operating our service (under strict confidentiality agreements)

6. Your Rights

You have the following rights regarding your personal information:

• Access: You can request access to the personal information we hold about you
• Correction: You can request that we correct inaccurate or incomplete information
• Deletion: You can request that we delete your personal information
• Data Portability: You can request a copy of your data in a structured, commonly used format
• Withdrawal of Consent: You can withdraw your consent to our processing of your information at any time

7. Data Retention

We retain your personal information for as long as necessary to provide you with our service and to comply with our legal obligations. If you delete your account, we will delete or anonymize your personal information within a reasonable timeframe, unless we are required to retain it for legal purposes.

8. Third-Party Authentication

We offer social login options through third-party providers (such as Twitter/X). When you authenticate using these services, we receive only the basic profile information necessary to create your account (name and email address). Please review the privacy policies of these third-party providers to understand how they handle your data.

9. AI Assistants (MCP Server)

Our MCP server at mcp.rosti.dev lets AI assistants such as Claude and ChatGPT query Rösti on your behalf.

• What we receive: the requests your assistant sends, that is the indicators, search terms and report IDs it looks up. Your assistant decides what to send; we never receive your conversation itself.
• How we use it: we forward each request to the Rösti API to answer it and return the result to your assistant. The MCP server does not store the content of these requests, and we do not use it for any other purpose.
• Without signing in: requests share an anonymous quota. To apply it fairly, we pass the requesting IP address and, if the assistant provides one, an anonymized user identifier (ChatGPT does) to the Rösti API. Both are used only for rate limiting.
• Signing in with Rösti: when you connect an assistant to your account, you sign in on rosti.dev and approve the assistant. We store which assistant you approved, the permissions you granted and records of the issued access tokens, so the connection keeps working; your requests then count toward your account's quota. With the permissions you grant, the assistant receives your account ID and email address. To disconnect, remove Rösti in your assistant or contact us.
• Your own API key: if your client sends your API key, requests are handled like any other request with that key.
• Server logs: our web server logs technical request data (IP address, time, requested path and user agent) for security and troubleshooting and keeps it for 90 days.
• Your assistant's provider: results become part of your conversation with your assistant, which its provider (for example Anthropic or OpenAI) processes under its own privacy policy.

10. Cookies

We use essential cookies to maintain your session and authentication state. We do not use third-party tracking cookies or analytics cookies that track your behavior across the website.

11. Children's Privacy

Our service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us, and we will take steps to delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically for any changes.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at rosti@bin.re .