Privacy Policy

Bouncer (bouncer.run) is a governed gateway for AI agents, APIs and MCP servers, and a free Security Check for npm packages and remote MCP servers. We are the data controller for the personal data described here. Reach us at privacy@bouncer.run.

• Account data. Email address, and the name and avatar your identity provider returns if you sign in with Google. Passwords are never stored in plain text.
• Gateway data. The agents, APIs, policies and keys you create, plus a call log for each proxied request: tool name, decision, latency, status code, token counts and payment receipts.
• Security Check data. The package name or MCP address you check, the resulting report, and a truncated record of the requesting IP address used only for rate limiting (10 checks per hour).
• Product analytics. Anonymous page-level events (which landing headline was shown, whether a visitor reached the dashboard). No cross-site tracking, no advertising cookies.
• Error reports. Stack traces and browser metadata when something breaks.

One-time tokens supplied for checking a private MCP server are used for that single request and are never written to disk. We do not sell personal data, and we do not run advertising or third-party tracking cookies.

To provide the service you asked for (contract), to keep it secure and abuse-free including rate limiting and fraud prevention (legitimate interest), and to meet legal obligations such as accounting.

We use strictly necessary storage only: a session cookie and local storage entry that keep you signed in, and a local flag recording which landing variant you were shown so the page stays consistent. No consent banner is required for strictly necessary storage, and no optional tracking is loaded.

• Account data: for as long as your account exists, then deleted within 30 days.
• Call logs: 90 days rolling.
• Security Check reports: kept so they stay shareable; token-checked reports stay private to you.
• Rate-limit IP records: 24 hours.

We use a small set of sub-processors, each listed with its purpose and region on our sub-processors page. A Data Processing Agreement is available on request.

Under the GDPR and UK GDPR you can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Under the CCPA you can request disclosure and deletion, and opt out of any sale of personal information — we do not sell any. Email privacy@bouncer.run and we will respond within 30 days. You may also complain to your local supervisory authority.

Our infrastructure providers operate globally. Where personal data leaves the EEA or UK, transfers rely on the European Commission's Standard Contractual Clauses.

We update this policy when our practices change and revise the date at the top. Material changes are announced to account holders by email.