1. Introduction
Multiplist ("we," "us," "our") operates the multiplist.ai website and the Multiplist MCP server (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
2. Information We Collect
Account Information
When you create an account, we collect your email address and a hashed password. We do not store plaintext passwords.
Vault Content
When you save conversations, documents, or transcripts to your vault, we store the content you provide along with extracted structured meaning (seeds). This is the core function of the Service — your content is stored to enable extraction, search, and retrieval.
MCP Connection Data
When you connect via MCP (Claude Desktop, ChatGPT, or other clients), we log: tool calls made, timestamps, success/failure status, and latency. We do not log the content of your conversations with AI assistants — only the content you explicitly save to your vault.
OAuth Data
When you connect via OAuth (Claude.ai, ChatGPT), we process authorization codes and issue access tokens. We store hashed tokens, not plaintext. Dynamic client registrations are stored for session management.
Usage Analytics
We collect anonymous usage data to improve the Service: page views, feature usage patterns, and error reports. We do not use third-party tracking pixels or sell data to advertisers.
3. How We Use Your Information
- To provide and maintain the Service — storing your vault content, running extraction, serving search results
- To authenticate you and manage your sessions
- To enforce rate limits and prevent abuse
- To generate audit logs for compliance (90-day retention)
- To improve the Service based on aggregated, anonymized usage patterns
4. Data Processing
Your vault content is processed by large language models (LLMs) for extraction. We use third-party LLM providers (OpenAI, Anthropic) for this processing. Your content is sent to these providers' APIs to generate structured extractions. These providers process data according to their own privacy policies and data processing agreements. We do not use your content to train AI models.
5. Data Storage and Security
Your data is stored in PostgreSQL databases hosted on Railway (US-based infrastructure). We use encryption for sensitive fields (API keys, OAuth tokens). Access to production databases is restricted to authorized personnel. We perform regular backups.
6. Data Retention
- Vault content (sources, seeds): Retained until you delete them or close your account
- Audit logs: 90-day retention, then automatically purged
- OAuth tokens: Retained until revoked or expired
- Account data: Retained until you request deletion
7. Your Rights
You have the right to:
- Access your data — your entire vault is accessible through the web UI and MCP tools
- Export your data — use the export features to download your sources and seeds
- Delete your data — delete individual sources/seeds or request full account deletion
- Revoke MCP access — revoke any MCP token or OAuth connection at any time
8. Third-Party Services
We use the following third-party services:
- Railway — hosting and database infrastructure
- OpenAI — LLM processing for extraction (when user selects OpenAI provider)
- Anthropic — LLM processing for extraction (when user selects Anthropic provider)
9. Children's Privacy
The Service is not intended for users under 16 years of age. We do not knowingly collect personal information from children under 16.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.
11. Contact
For privacy-related inquiries, contact us at: privacy@multiplist.ai