Query privacy

What Trooth keeps when you, or an agent acting for you, ask about a company through the public MCP (Model Context Protocol) server, the public API (application programming interface) under /api/network, or /ask. Each line below is read from the code that runs that surface.

MCP server

Every call sends its arguments to Trooth: the company or domain, the token, the search words or the question.

• A daily count. One row per day, tool, company or domain looked up, outcome and client label (a short name taken from the User-Agent header), with the number of calls and their total duration. For trooth_verify the token's id is counted only when a token matched. The count holds no IP address, no question text, no search words and no unmatched token. The same count is also written to Cloudflare Workers Analytics Engine. The code that writes the count sets no expiry for it.
• A policy decision, kept 30 days. For each call: the tool, whether it was allowed and why, the policy version, the client's declared name and version when it sends one, the argument names, types and lengths (never their values), the answer's status and a SHA-256 digest of its text. No IP address and no user identifier are in it. Records older than 30 days are deleted.
• Your IP address is used to rate-limit calls, held in memory for a one-minute window, and is written to no table and no count.

Public API

• The lookup. A read names the company in its URL, for example /api/network/profile?q=acme.com. The read endpoints write nothing about the lookup to Trooth's database.
• Your IP address (for IPv6, its /64 prefix) is stored with a per-minute and a per-hour counter in Trooth's database to enforce the rate limit. A counter more than four windows old is deleted when the next request starts a new window for that route.
• Request logs. The hosting platform's request logs carry the URL, and so the company looked up, and the IP address. The Privacy Policy sets application and error logs at 90 days.
• Trust Profile views. A browser that opens a company's Trust Profile sends one view beacon, which stores a hash of the address, for de-duplication, and the referring page the browser reported. An API read sends no beacon.

/ask

/ask reads the record through the same code as the public API, so the same rate-limit counter (in a bucket of its own) and the same request logs apply. It writes the question nowhere, and it generates no text.

Where this is set out

The Privacy Policy and the Retention Schedule are the documents that bind Trooth. The MCP server repeats its part in the resource trooth://what-a-call-sends.