Privacy

pick.tools needs no account. It records one metadata row per relayed tools/call and nothing about what the call contains.

Stored per call

• time, server and tool name
• mode: picker or composed
• outcome (see Methodology), upstream HTTP status and latency
• request and response size in bytes
• your client label from X-Pick-Client, if you send one
• your client's name from the MCP clientInfo
• the private flag, from X-Pick-Private: 1
• a hash of your IP address: SHA-256 of the IP, the UTC day and a secret seed. The same IP gets a different hash each day.

Never stored

• tool arguments and tool results
• credentials: X-Pick-Key-* and X-Pick-Header-* values are used for one upstream request and dropped

IP addresses and logs

Raw IP addresses are not stored with call records. Request logs record the client IP address and the request path. The rate limiter keys its counters by a salted daily hash of the IP, kept for at most a day. Application logs otherwise name the server slug, the JSON-RPC method and error class names. No log holds tool arguments, results or credentials.

Retention

Raw call rows are deleted after 90 days. Daily rollups per server (counts, latency percentiles, distinct counts) are kept; the counts and latency are published as open data.

Private calls

With X-Pick-Private: 1 a call is left out of every per-server number. It still counts toward a site-wide private total and toward the rate limits.

What reaches others

The vendor that serves a call receives what it needs to serve it: your arguments, your key for that vendor, and your IP address in X-Forwarded-For. The vendor's own privacy policy covers what it receives. pick.tools runs behind Cloudflare, which carries the traffic to and from the site.