Privacy policy

This page says what OpenTools stores when you use the website, the API, the CLI or the MCP server, and which other services handle that data. It describes how the product works today.

Who runs OpenTools

OpenTools is run by Fulin Labs. Contact for privacy questions: giovannifulin@gmail.com.

What we store

• Account: your name, email address and a hash of your password. Sign-in sessions, with the IP address and browser string the session was created from, are kept so you stay signed in.
• Workspace: its name, its members, your API keys and your spending controls. An API key is stored as a hash. We show you the full key once, when you create it, and cannot show it again.
• Runs: each call you make through OpenTools. We keep the provider and endpoint, the input you sent, the output the provider returned, the status, the cost and the time. Run inputs and outputs can contain anything you or your agent put in them.
• Balance: your wallet balance and a ledger of top-ups and charges.
• Payments: when you add funds, Stripe handles the card. We store the Stripe identifiers and amounts that link a payment to your credit. We never see or store your card number.
• OAuth connections: when you connect an MCP client such as Claude or ChatGPT, we store the client that registered, the permission you granted and its access tokens.
• If you list your own API as a provider: the server URL you list, the endpoints we read from it, the price you set, your earnings and your payout requests.
• Rate-limit counters, tied to an address or an account, so we can refuse abuse.

What we send to providers

When you run a tool, OpenTools sends your input to the provider that runs that tool and returns its answer to you. The provider receives what you put in the request. It does not receive your account name or email address from us. Each provider has its own privacy practices, and we do not control them. Read the listing before you send personal data.

Cookies

We set the cookies the sign-in system needs: one that keeps you signed in, and a short-lived one while you connect an MCP client. The website loads no analytics, advertising or tracking scripts.

Who processes your data

• Vercel hosts the application.
• Neon hosts the PostgreSQL database.
• Stripe processes payments.
• Coinbase CDP holds the wallet that pays providers that charge over x402.

How long we keep it

We keep your data until you ask us to delete it. We delete it within 30 days of your request, except billing records that tax law requires us to keep.

Your choices

You can revoke an API key in the dashboard at any time, and disconnect an OAuth client by asking us to remove it. To ask for a copy of your data or for deletion of your account, write to giovannifulin@gmail.com.

Changes

We will change the date at the top of this page when the policy changes.