cloud-tools collects nothing

cloud-tools runs on your own machine. There is no telemetry, no analytics and no phone-home: the only hosts in the source are cloud provider APIs, plus github.com for the binary download. There is no account, no sign-up and no identifier.

Credentials, and where they go

Credentials you supply are used to sign requests to your own cloud provider and are held in memory for the life of that call. They are never written to disk, never logged and never sent to MunHQ. Responses go back to the MCP client that asked for them and nowhere else.

Read-only access is sufficient for every tool. All seven declare readOnlyHint: true, and nothing in the server creates, modifies or deletes a cloud resource.

Third parties

The only network destinations are the cloud APIs of the providers whose credentials you supply: Amazon Web Services, Google Cloud, Cloudflare and OVHcloud. Your data reaches them under your existing relationship with them, not through us.

What is written to disk

Nothing, with one exception: the npm wrapper caches the downloaded binary under ~/.cache/cloud-tools/bin/ so it is not re-fetched on every run. That cache holds a program, never your data and never your credentials.

Diagnostics go to stderr, which your MCP client captures. Credentials are never logged. Error messages quote the provider's own response, which may name a project or a resource — the same information the tool was asked to report.

Data retention and sharing

We retain nothing, because we receive nothing. There is no data to share, sell, profile or hand to a third party, and no retention period to state.

Who is responsible, and how to reach us

MunHQ operates this tool. Write to hello@munhq.com with any question about this policy, or to ask what we hold about you — the answer is nothing, and we are happy to say so in writing.

This policy covers the tool named above. The munhq.com privacy policy covers the website, and the terms cover both.