Core documentation content is fully readable without JavaScript. The table of contents, assistant, and some copy buttons enhance the experience but are not required.

Legal

Privacy Policy

Last updated: May 2026. This policy explains what data Zephex collects, why, how long it is kept, and what controls you have.

WHO WE ARE

Zephex is a cloud-hosted MCP (Model Context Protocol) proxy service. Users connect their AI code editors to our endpoint and access developer tools through a single API key. The service is operated as a sole proprietorship.

DATA WE COLLECT

Category	Data	Source
Account	Email address, OAuth provider ID, display name	Signup / OAuth
Authentication	Hashed password, MFA secret (encrypted), session tokens	Login
API Keys	SHA-256 hash of key, key prefix, creation date, last-used timestamp	Key creation
Usage	Tool name, timestamp, response status, latency per request	Each API call
Billing	Stripe customer ID, subscription status, payment method last 4 digits	Stripe
Device	Hashed IP address, User-Agent, MCP client name/version	Each request
Analytics	Page views, feature usage events (anonymized)	Dashboard interaction

DATA WE DO NOT COLLECT

Your AI model prompts or chat history.
Full repository contents — only files explicitly referenced in tool arguments are processed.
Editor conversation context surrounding tool calls.
Biometric data, precise geolocation, or device identifiers beyond User-Agent.
Data from tools you did not call — Zephex only processes the specific tool invocation you initiate.

HOW WE USE YOUR DATA

Authentication — verify your identity and authorize API requests.
Service delivery — route tool calls to the correct backend and return results.
Usage tracking — enforce plan limits, calculate billing, and display analytics in your dashboard.
Abuse prevention — detect and block credential stuffing, DDoS, and anomalous patterns.
Email notifications — send usage warnings, billing alerts, and security notices (configurable in Settings).
Product improvement — aggregate, anonymized usage patterns inform which tools to prioritize.

DATA RETENTION

Data type	Retention period	On account deletion
Account profile	Until account deleted	Removed within 30 days
API key hashes	Until revoked or account deleted	Removed immediately
Usage events (tool name, timestamp)	90 days rolling	Removed within 30 days
Hashed IP / User-Agent	90 days	Removed within 30 days
Tool input/output content	Not stored — processed in memory only	N/A
Billing records (Stripe)	As required by tax law (typically 7 years)	Anonymized
Audit logs	1 year	Removed within 30 days
Email queue records	30 days after send	Removed immediately

THIRD-PARTY PROCESSORS

Zephex uses industry-standard third-party services for specific functions: database hosting, payment processing, transactional email delivery, and rate limiting. All processors are bound by data processing agreements. No processor receives full plaintext API keys. Tool call content passes through infrastructure in memory and is never written to disk or logs.

AI MODEL TRAINING

Zephex does not use any user data — prompts, tool inputs, tool outputs, code, or usage patterns — to train AI models. This applies to all plans (Free, Pro, Max) without exception. Zephex is a proxy; it routes requests to tools and returns results. It does not fine-tune, distill, or otherwise learn from your data.

Session cookie — HttpOnly, Secure, SameSite=Strict. Required for dashboard authentication. Expires on logout or after 7 days of inactivity.
CSRF token — HttpOnly, Secure. Prevents cross-site request forgery on state-changing actions.
Theme preference — localStorage (not a cookie). Stores dark/light mode choice.

Zephex does not use advertising cookies, tracking pixels, or third-party analytics scripts that set cookies.

YOUR RIGHTS

Regardless of your location, you can:

Access — request a copy of all personal data we hold about you.
Rectification — correct inaccurate information.
Erasure — delete your account and all associated data (Dashboard → Settings → Delete Account).
Portability — receive your data in a machine-readable format.
Objection — opt out of non-essential processing (e.g., marketing emails via Settings → Notifications).
Restriction — request that we limit processing while a dispute is resolved.

To exercise any right, use Dashboard → Settings or email support@zephex.dev. We respond within 30 days.

CHILDREN

Zephex is not directed at individuals under 16. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

CHANGES TO THIS POLICY

Material changes are announced via email to registered users at least 14 days before taking effect. The "Last updated" date at the top reflects the most recent revision.

CONTACT

Privacy questions: support@zephex.dev

Was this page helpful?

Privacy Policy

Quick Links

API Reference

Troubleshooting

Community

Plugins

Pricing

Privacy Policy