Privacy Policy — ProjectStudio

Last updated: 2026-10-31. ProjectStudio is a public, no-authentication MCP connector operated by mmcco (contact below). This policy describes exactly what data the tools receive, why, who receives it, how long it is kept, and the controls you have. It reflects the connector's current tools and behaviour.

1. What data we process

• Your call inputs only: the text you pass to the tools — a selection you drew (chat_create_selection, chat_capture_region), a document's original and proposed text (document_open, document_preview_patch, document_apply_patch), the content you register in a workspace (ws_document_create, ws_document_apply_patch), an annotation body (chat_pin_selection, ws_annotation_add), an action request (chat_transform_selection, ws_action_commit) and a workspace focus (ws_state_set_focus, workspace_set_focus).
• No accounts, no cookies, no advertising or tracking identifiers. The connector has no authentication; a durable workspace is reached by an unguessable workspace_id that acts like a bearer secret.
• The connector does not fetch external URLs and does not read your files: it works only on text you pass at call time. Region-capture tools produce metadata only (bounding box + source binding) — no image rendering, no image retention.

2. Why we process it (purposes)

• Solely to compute and return the result you asked for: show a preview, apply a patch as a new immutable version, bind a selection to its source, record an annotation or an action request, or hold the workspace state you set up.
• We do not profile you, sell data, or use it for advertising or AI model training.

3. Who receives data (recipients / third parties)

• Vercel — infrastructure host (serverless + private Blob store). It may keep standard HTTP technical logs (IP, timestamp) under its own policy. ProjectStudio stores workspace content in a private Vercel Blob namespace that is unlisted and accessed only by the connector itself.
• The AI host (ChatGPT or Claude) you go through relays the call under its own policy.
• No other third party receives your data. Your data is neither sold, exchanged, nor used to train models.

4. How long we keep it (retention)

Two processing modes:

• Stateless primitives (default) — the chat_*, document_*, action_*, workspace_get_context and artifact_find_latest tools keep nothing. Each call is processed in memory and the result returned; inputs are not stored.
• Durable workspaces (optional, opt-in) — when you explicitly call ws_create, the content you then register in that workspace (immutable document versions, annotations, recorded action requests, focus state, append-only audit log) is kept durably until deletion is requested. There is no automatic expiry. Email infodev@mmcco.co to request deletion of a workspace by its workspace_id.

5. Your controls

Stateless calls retain nothing to access or delete. For a durable workspace: email the support address with the workspace_id to request export or deletion. Because the endpoint is public and unauthenticated and a workspace_id is a bearer secret, do not place personal, health, banking or government identifiers in any tool and treat each workspace_id like a password.

6. Security

Traffic is over HTTPS. The MCP endpoint (/mcp and /api/mcp) is public and unauthenticated. Workspace data lives in a private Vercel Blob namespace with unguessable identifiers; the connector exposes no tool to list workspaces. The original of a document is always preserved; versions are immutable; undo moves a pointer non-destructively.

7. Contact

mmcco — infodev@mmcco.co. Questions, corrections and deletion requests are handled at this address.