All servers · Bundle · Source
Last updated 16 October 2026. This describes what the software does, checked against the source it is generated from. The code is public, so every claim here can be verified in https://github.com/theluckystrike/mcp-servers.
Nothing leaves it. The stdio servers read and write only under your own data directory,
${XDG_DATA_HOME:-~/.local/share}/mcp-servers/<server>/. They make no network calls in
normal use, send no telemetry, and have no account. A Pro licence key is verified offline with an
Ed25519 signature, so activating one contacts nothing. The two exceptions are a server whose whole
job is to fetch something you asked for, such as exchange rates or a product page, and those fetch
only what the call names.
The hosted endpoints at mcp.zovo.one/mcp/<server> hold data, because they have to.
What is kept, and for how long:
| What | Why | Kept for |
|---|---|---|
An anonymous token, anon_<32 hex> | Separates your data from another caller's. No name, no email, no account. | 30 days, refreshed on each use |
| The documents your calls create, such as invoices or timesheets | They are the point of the server | Deleted 35 days after the last touch |
| A download link for a file a tool produced | To hand you the PDF or CSV | 1 hour |
| Rate-limit counters | To keep one caller from exhausting the endpoint | 2 hours |
Anyone holding your token can read your data, so treat the token as the secret it is. A shared cache of European Central Bank reference rates is read-only and common to everyone; nothing about you is written into it.
Payment is taken by Stripe. The card never touches this site; the checkout page is Stripe's own.
After a successful payment this site stores one record against the Stripe session id: the licence key
it issued, the product, and the email address Stripe collected for the receipt. That email is kept so a
buyer who loses the key can recover it at /recover?session_id=.... A paid webhook also
attempts to send the key through Resend to the checkout email address. Email delivery is best-effort;
the confirmation page remains the direct key delivery path. A purchase does not subscribe the buyer to setup tips. The licence key itself can carry a twelve character hash prefix
derived from the email; it does not contain the address.
The footer signup stores your email address, signup time, and source label in our licence storage for up to five years. Resend sends the welcome message, an invoice setup tip after about two days, and a bundle offer after about a week. Send markers prevent a completed step from being sent again. Each message has an unsubscribe link; opting out stores a suppression record for five years and stops later setup-tip and bundle-offer messages. Transactional licence delivery is separate.
This site runs on Cloudflare, which logs requests as any web host does. This site additionally counts clicks on upgrade links and records hosted tool-response and checkout-stage counts by fixed source labels. The new hosted-response instrument keeps a SHA-256 token source/probe sidecar for 31 days and private daily token/server deduplication hashes; these are pseudonymous internal identifiers. Daily response counters and deduplication records are retained for at most 31 days from the UTC date's start. Aggregate reports expose no hashes, tokens, tool arguments or results, filenames, emails or client IPs. An emitted upgrade trailer is counted as an emission, not proof that a person saw it. Unmarked requests can include automation. Local stdio servers and the editable browser examples send no usage telemetry or field values.
For a hosted endpoint, stop using the token and everything under it is deleted after 35 days; there is nothing to ask for. For a purchase record, subscription record, or another data request, contact support@zovo.one. Include the Stripe session id for a purchase; do not post licence keys, tokens, or payment details in a public GitHub issue.
It is a description of behaviour written by the person who wrote the code, not legal advice, and not a contract. Where it and the source disagree, the source is right and this page is a bug.