Privacy Policy

Effective date: 27 October 2026. Last updated 4 November 2026.

This policy explains what JustClaw-It, a DBA of Two7 Design LLC ("JustClaw-It", "we") collects when you use justclaw.it.com, the MCP server and the connector, and what we do with it. Two7 Design LLC is the data controller.

What we collect

  • Account data: your email address, and a phone number only if you choose to verify one.
  • API keys: stored as one-way hashes; we cannot see your full key after it is shown to you once.
  • Usage logs: tool calls per key (time, tool, credits used, the number of results, and the search text, prompt or component ID you sent, cut to 200 characters), the IDs of components you pull (for the fair-use cap), and credit balances. You can see your own recent calls on /account; the search text is kept for 90 days and used to run the service and to find gaps in the library. Keyless searches (no key) are logged the same way, with no account attached.
  • Security logs: IP address and browser user agent for sign-in, signup and checkout events, used to stop abuse of the free tier and attacks on accounts. For keyless searches, the IP address (for IPv6, its /64 network) is used to count them against the per-network limits.
  • Payments: handled by Stripe. We receive your plan, subscription status and a Stripe customer ID; we never see or store your card number.
  • Free audit: the public repository URL you submit and the resulting scores, and your email if you ask for the full report. We do not keep your source code.
  • Lockfile licence report: lockfiles you upload for a licence report are processed in memory and never stored, logged or written to disk; we record only their size, the number of packages, the ecosystems, the time taken and the credits used. Only public package names and versions are looked up at deps.dev (run by Google); packages we recognise as private are never sent anywhere. We cannot always tell a private-registry package from a public one, so you can list your private scopes and they are never looked up.

We do not sell personal data, show ads or use tracking cookies. We set two cookies: the session cookie that keeps you signed in to /account, and a random device identifier (jc_dev) set on the signup page and used only to limit how many free accounts one browser can create. The connector CLI sends your key only to justclaw.it.com and stores it in your agents' own config files on your machine.

Why we use it

  • to run the service: authenticate keys, meter credits and enforce plan limits;
  • to bill paid plans and send transactional email (sign-in links, receipts, important service notices);
  • to prevent abuse and keep the service secure;
  • to understand aggregate usage so we can improve search.

Who processes it

  • Hetzner (hosting, Germany, EU)
  • Stripe (payments)
  • Spacemail (outbound email from justclaw.it.com)
  • Cloudflare Turnstile (bot check on signup, when enabled)
  • deps.dev (public package licence lookups for the lockfile licence report: package names and versions only)

How long we keep it

Account data is kept while your account is open. Search text in usage logs is kept for 90 days; other usage and security logs for up to 12 months. Billing records are kept as long as tax law requires.

Deletion and your rights

Email mike+mcpsupport@two7.design from your account address to get a copy of your data, correct it, or delete your account (you can also request deletion on /account). We act on deletion requests within 30 days, revoke your keys and erase your account data, except what we must keep for billing, tax or fraud-prevention law. Depending on where you live (for example the EU, UK or California) you may have further rights, including complaining to your data-protection authority.

Security

API keys are stored as SHA-256 hashes, traffic is encrypted with TLS, and the component database is read only through restricted functions. No system is perfectly secure; if we learn of a breach affecting you, we will tell you.

Age

JustClaw-It is a business tool for people aged 18 and over. We do not knowingly collect data from anyone younger; if we learn we have, we delete it.

Changes and contact

We will email you about material changes, and the effective date above changes with them. Data controller: JustClaw-It, a DBA of Two7 Design LLC. Questions: mike+mcpsupport@two7.design.