Privacy
Effective 21 October 2026. This notice describes the current website, released products, support channels, telemetry, and public feedback.
The servers process code and runtime artifacts locally. Your MCP client can send returned content to its model provider.
Website operator and controller
Bogdan Novosad, a Spanish sole trader trading as GliderMCP, controls the personal data described here. NIF: Y8622372P.
Business address: Samaniego-Campoamor 22, 7º A, 03189 Orihuela, Alicante, Spain.
Email privacy@glidermcp.com for privacy requests. See the legal notice for supplier details.
Website requests, storage, and cookies
Cloudflare receives website requests and delivers the site. Request data includes IP addresses, requested URLs, headers, timestamps, and security or network diagnostics.
Cloudflare also creates aggregate zone analytics from edge requests. We use this processing to operate, secure, and understand the website.
We rely on our legitimate interests in providing a reliable and secure website.
Cloudflare may set essential security or rate-limit cookies when its services require them.
Public pages set no site cookies. When accounts are enabled, the account service uses essential sign-in, session, and invitation cookies.
Account cookies are Secure, HttpOnly, and limited to this website. The sign-in cookie, and the plan you chose on the pricing page before signing in, last up to ten minutes.
The session cookie lasts up to 24 hours. The invitation cookie lasts up to one hour.
The site stores your theme choice, optional game high score, and playground request history in your browser only.
Playground history can contain up to 100 tool names, parameters, outcomes, errors, durations, and timestamps. You can clear it in the playground or browser settings.
The playground uses a local server by default. You can enter another URL or supply one through the server query parameter.
The server you select receives connection checks and tool parameters. Review that server’s privacy terms before you use a remote URL.
This build does not load Google Analytics. It serves JetBrains Mono from this website and sends no font requests to Google.
Contact and correspondence
Email privacy@glidermcp.com for privacy requests or support@glidermcp.com for general enquiries.
Cloudflare routes domain email to a Gmail mailbox and sends our replies. Cloudflare and Google process message content, contact details, and delivery information.
We use this information to answer requests, take requested pre-contract steps, meet legal duties, and manage related support.
The legal basis depends on the request. It can be contract steps, a legal obligation, or our legitimate interest in answering enquiries.
We keep correspondence while we need it for the request, related follow-up, legal duties, or legal claims.
Do not send passwords, payment card details, or confidential source code.
Local code and runtime evidence
The servers read workspace files and return results through MCP. GliderTrace can also execute commands and store runtime artifacts.
Product telemetry excludes source code and runtime artifacts. Review your client’s data policy for content it forwards or retains.
Glider 12.3.0 and GliderTrace 1.3.0 store bounded failure records on your device. The journal is independent of telemetry uploads and can contain sensitive context despite its filters. See the local record fields, limits, and controls.
Product telemetry
Telemetry is on by default. It includes installation identifiers, product and platform facts, tool outcomes, and documented health or workspace metrics.
Installation identifiers can link events from the same installation. We do not treat those identifiers as proof that the records are anonymous.
We use telemetry to measure product use, compatibility, reliability, and failures. Cloudflare validates events and sends the filtered records to Grafana Cloud.
Use --no-telemetry or DO_NOT_TRACK=1 to disable telemetry and agent feedback. See the full field list and controls.
Feedback your agent sends
All four products include send_feedback. It sends agent-authored text and product facts, then publishes a public GitHub issue. Glider development builds can add abstract reproduction evidence.
Glider development builds also let an agent preview an invented, small code example for public feedback. The agent must show you the complete issue and duplicate comment, obtain approval, and send the same content. The server does not store previews or verify approval. Your MCP client controls tool approval.
The example, run instructions, and evidence become public GitHub content. Ordinary feedback still rejects code. Filters for either route cannot prove that a report contains no sensitive information.
We process a report to publish, group, investigate, and answer it. We rely on our legitimate interest in receiving and responding to product feedback.
Set GLIDER_FEEDBACK=0 to disable feedback separately. See feedback fields, retention, and controls.
Website analytics
The website counts the steps toward a purchase. It counts views of the home, product, installation, pricing, and account pages, clicks on a paid plan button, sign-in starts and completions, and opened checkouts.
A count record contains the step, the page, the plan, the billing interval, and a seat range.
It can also contain the sign-in method and the external website that sent you, from a fixed list of sites. Other sites become other.
It can contain a campaign label from a fixed list, taken from the utm_source link parameter. Other labels become other.
It can also contain the country that Cloudflare derives from the request.
A count record contains no cookie, account or session identifier, email address, IP address, user agent, or referring address. We cannot link two count records to the same visitor.
Your browser sends page, plan-button, and checkout counts without cookies. The website server records the sign-in steps. Cloudflare Workers Analytics Engine stores the records.
We use the counts to understand how visitors move from the website to a purchase. We rely on our legitimate interest in understanding and improving the website.
Sign-up and purchase totals come from the account records described below. Google Analytics is disabled on this website. Product telemetry is separate and follows the controls described above.
Accounts, payments, and product licenses
When registration is open, create an account with Google or with email and password. Amazon Cognito verifies the email of an email account. Your account shows current availability.
Amazon Cognito verifies your identity. The account service stores your email, identity reference, personal account, team memberships, roles, and invitations in Cloudflare D1.
Team administrators can enter an invitee’s email address and role. Cloudflare sends the invitation email and processes its delivery information.
We use these details to create and manage accounts and teams, deliver invitations, and protect access. The legal bases are steps toward or performance of a contract and our legitimate interests in service security and team administration.
A team invitation does not provide a paid product license. A named developer needs an assigned seat and a confirmed paid period.
The account service stores purchase requests, Paddle customer and subscription references, payment periods, payment outcomes, refunds, and seat assignments. It uses these records to fulfill purchases, prevent duplicate charges, and manage commercial access.
Paddle is the payment provider and merchant of record. Paddle collects checkout and payment details and processes invoices, renewals, cancellations, and refunds. Its privacy notice describes its processing.
Native activation links a verified account and assigned seat to a product credential and signed license. The service stores credential hashes, expiry, revocation, and grant records to issue and protect access.
We process account, purchase, and license records to perform the contract, meet applicable legal duties, and protect the service against abuse.
The Paddle portal verifies the email used for checkout. Team membership does not itself authorize access to the payer’s portal.
Recipients and international transfers
Cloudflare processes website requests, product ingest traffic, account records, and email delivery. Its customer DPA describes its Data Privacy Framework and contractual safeguards.
Amazon Cognito processes sign-in, email verification, and account recovery details. Its service terms and privacy information describe applicable transfer safeguards. If you sign in with Google, Google shares your account identifier, email address, and its verification status with Amazon Cognito. Google also shares basic profile details, such as your name and profile picture. Cognito keeps only the identifier, email address, and verification status for your account. An existing account links Google only when you connect it while signed in.
Grafana Labs stores filtered product telemetry. Its data processing agreement describes its transfer safeguards.
Google stores support correspondence. Its transfer-framework notice describes its Data Privacy Framework and contractual safeguards.
GitHub stores public feedback issues. Its privacy statement describes its Data Privacy Framework and contractual safeguards.
These providers can process data outside the European Economic Area. Their notices identify locations, subprocessors, and applicable safeguards.
Your privacy rights
Where applicable, you can request access, correction, deletion, restriction, or portability of your personal data, and object to processing.
Where processing relies on consent, you can withdraw that consent. Contact privacy@glidermcp.com.
You can complain to the Spanish Data Protection Agency (AEPD) or your competent data protection authority.
Retention
Local files, runtime artifacts, and client transcripts follow the retention settings of their respective tools.
Glider and GliderTrace check their journal at startup and hourly while they run. They remove inactive files older than 14 days and limit each product to 20 MiB. Files can remain while no server runs or while another process holds them open.
We keep telemetry while needed to compare product versions, investigate reliability, and measure feature use. The active Grafana Cloud policy retains product logs for 14 days. Cloudflare request logs are separate and follow provider-controlled retention. We have not verified their retention period; the Grafana period does not apply to them.
Cloudflare Workers Analytics Engine keeps website count records for three months.
Scheduled cleanup deletes filed, duplicate, and failed feedback database records once their last status update is more than 30 days old.
We keep reports available if they require publication or a retry. This deletion schedule covers the active database; provider backups follow separate retention.
We keep profiles and memberships while the account or team exists. You can request deletion through the privacy contact above, subject to applicable legal duties.
To limit sign-in abuse, the service stores a keyed hash of the client IP address and a ten-minute window, plus an attempt count. It stores no raw IP address in this account throttle.
Account throttle records expire at the window boundary. Sign-in requests or the five-minute cleanup task remove expired records.
Account sessions expire after 24 hours and sign-in transactions after ten minutes. Scheduled cleanup removes their expired database records.
Invitations expire after seven days. Scheduled cleanup removes invitation and delivery records 30 days after expiry.
The service removes the encrypted invitation link when the email provider accepts the message, or after final delivery failure, revocation, or expiry.
We retain payment, refund, license, and revocation records while needed to fulfill subscriptions, reconcile payments, prevent fraud, and meet legal record duties. Account deletion does not automatically erase records required for those purposes.
Native approval requests expire after ten minutes. Later activation requests remove expired records in bounded batches, with a one-hour grace after completed exchanges. This is not an immediate deletion guarantee.
Public GitHub issues follow GitHub retention. Closing or archiving an issue does not delete it.