Privacy Policy — CoTrackPro MCP Connectors

Effective 2026-05-23.

This policy covers the two CoTrackPro MCP connectors — cotrackpro and mermaid-renderer — when accessed from an MCP client such as Claude or ChatGPT. It does not cover the broader CoTrackPro platform; see the platform privacy policy for that.

Public URL for directory submission: https://github.com/dougdevitre/cotrackpro-antigravity/blob/main/connectors/PRIVACY.md

What these connectors do

They expose CoTrackPro's orchestration graph — roles, triggers, workstreams, artifact schemas, workflows, and the diagrams derived from them — and a generic mermaid-to-image renderer. They do not expose subscriber, child, or family case data, evidence, or court records.

Data we receive

Authentication identity. A Clerk-issued OAuth 2.1 bearer token, which we validate against the configured Clerk issuer's JWKS to obtain your Clerk user subject. Used for authorization, optional allowlisting, and audit logging.
Tool arguments. The parameters you pass to a tool — e.g. a role_id, an artifact name, or diagram_code (mermaid text you supply to the renderer). We do not ask for, and these tools do not require, any personal or case information.

Data we store

Graph cache (DynamoDB). cotrackpro caches Airtable trigger and workstream lookups for 1 hour (TTL-expired automatically).
Render cache (S3). mermaid-renderer stores rendered images keyed by a SHA-256 of the diagram source, encrypted at rest (AES-256), with a 30-day lifecycle expiry. Large outputs are returned as presigned URLs that expire after 1 hour.
Audit logs (CloudWatch). Each tool call logs the connector name, timestamp, your Clerk subject, the tool name, a SHA-256 hash of the arguments (never the raw arguments), status, and latency. Raw tool arguments are not written to logs.

Recipients / sub-processors

Amazon Web Services — Lambda, DynamoDB, S3, CloudWatch (hosting, caching, logging).
Clerk — OAuth token issuance and JWKS-based validation.
Airtable — source of live trigger/workstream graph data (cotrackpro only).
A public CDN (cdn.jsdelivr.net) serves the mermaid library used during headless rendering.
Twilio — SMS and voice transport for the optional reminders channel (via the cotrackpro-talk app that owns the number).
ElevenLabs — voice synthesis for outbound voice reminders.

We do not sell personal data or use it for advertising.

Retention

Graph cache: ≤ 1 hour (TTL). Render cache: ≤ 30 days. Presigned URLs: ≤ 1 hour. Audit logs: per the CloudWatch log-group retention configured at deploy time.

SMS and voice reminders (Twilio number)

Reminders are an opt-in channel, separate from the connectors above and governed by ../mcp/twilio-sms.yaml.

Data received: your phone number (E.164), your consent record, and the reminder-relevant metadata derived from your own deadline/exchange artifacts. Message bodies carry no case detail — only a relative-time prompt and a deeplink back into the app.
Data stored: consent and contact preferences in the hub user-data store keyed by contact#<e164>; a reminders ledger (status, retries, idempotency). PII retention is 90 days (per mcp/twilio-sms.yaml).
Controls: STOP / HELP / START keywords (STOP honored within one message), quiet hours, per-user frequency caps, a suppression list, a per-message opt-out footer, and case detail only via an authenticated app deeplink. Outbound voice calls require separate voice consent.
No sharing for marketing: mobile opt-in/SMS consent data and phone numbers are never shared or sold to third parties or affiliates for their own marketing or promotional purposes. The full opt-in disclosure, message samples, and frequency/rate terms are published at https://cotrackpro.com/sms-consent.
Sub-processors: Twilio (message/call transport, via cotrackpro-talk) and ElevenLabs (voice synthesis). Crisis resources are sourced from the canonical server-side links helper, never composed in a message body.

Your controls

Revoke the connector's access by removing it in your MCP client and/or revoking the Clerk OAuth grant in your Clerk account.
Data portability and export terms: see ../docs/data-portability.md.

Security and contact

Security model and data classification: ../SECURITY.md. Report a security vulnerability to security@cotrackpro.com per that policy.

Privacy questions, data-access, and deletion requests: privacy@cotrackpro.com.

This connector and its outputs are educational and informational only — not legal or clinical advice. Canonical safety policy: ../.agents/rules/cotrackpro-guardrails.md.