Privacy

• Its skills and scripts run on your computer: the key scan, the pre-production check and the report links never send your code, your files or your keys anywhere.
• Your agent calls the afro.tools MCP server to read specs: see below for what it receives.
• The integration report and the diagnostic only build a pre-filled GitHub link. Nothing is sent until you submit the form yourself on GitHub, where GitHub's privacy statement applies.

It receives your agent's requests: the tool called and its parameters. From them it keeps:

• Daily usage counts: calls in total and per tool, the provider asked for in get_spec, the text of a search (its first 40 letters and digits), and the name your agent gives when it connects (for example "claude-code"). The counts are deleted after two days; a daily summary of the totals per tool and per agent goes to our private Discord.
• Spec requests: when your agent asks for a spec that does not exist yet, the provider, the capability and the date are kept on the server and posted to our private Discord, to decide which specs to add. They contain no personal data and are kept to count how many times the same spec was asked for.
• Integration reports: only the names of the capabilities are counted. The summary and the details your agent writes only go through the server to build the GitHub link: they are not stored or counted.
• Your IP address is used in memory to limit the number of requests; the server application does not store it and does not add it to the counts.

• Visits are counted with Umami Cloud, an analytics service that sets no cookie.
• The launch film is played from YouTube in its no-cookie mode, and only after you press play; YouTube's terms then apply.
• The contribute form sends your email, the documentation link, your notes and the file you attach to our private Discord, to review your request and reply to you. Ask us to delete them at any time.

• Our web server keeps no access log, so it does not record the IP address of visitors or agents. Our applications log only technical events, such as the number of specs loaded or a failed notification.
• The automation tool that counts usage keeps the details of each event (the tool called, the text of a search, the provider asked for, the agent's name, never an IP address) for up to 14 days, then deletes them.

The servers run on a virtual private server rented from Hostinger. Notifications go to Discord, page counts to Umami, the code and the reports live on GitHub. Each applies its own privacy policy to what it handles.

You can ask us what we hold about you, and to correct or delete it, at bmsanoussy@gmail.com. If you live in the European Union or the United Kingdom, you can also complain to your data protection authority.

When this page changes, its date above changes with it.