Privacy and product feedback

What is recorded

Profile, campaign, environment, release revisions, operation, known public references, optional topic, technical result, duration, result counts and blocker codes. The server determines the profile and environment; it does not trust agent-supplied labels.

Search and feedback text is retained only when it is at most 160 characters and 12 words, and every word belongs to a small English/Spanish technical vocabulary. If any part fails that filter, the entire text is discarded. This minimises collection; it does not guarantee perfect anonymisation.

Plugin connection attribution

Arkiv plugin connections send a shared package version and host label by default. The server stores only a closed distribution category, a published plugin version or other, and a host category. Initialization client names are reduced to a closed client family; raw headers and names are discarded.

This attribution does not include installation or session IDs, project names, paths, working directories, prompts, local files, SDK state or skill usage. Counts describe request attempts, not people or a linked conversion funnel. Attribution is a client claim, not proof of installation.

In Claude Code, set ARKIV_TELEMETRY=off before starting a new session to turn off plugin connection attribution. Codex uses a static header and has no plugin environment-variable opt-out. This setting does not disable the MCP's existing operation telemetry or hosting logs.

Hooks make no network requests. Local skill-usage collection and sharing are not enabled. Attribution uses the same intended 90-day event retention and authorised operator access described below. Verification traffic is excluded from live product reports.

What not to send

Never send private keys, credentials, wallet addresses, emails, personal information, private code, confidential schemas, private submissions or unpublished ideas. Schema modelling and document checks process their inputs transiently; product telemetry retains only counts and closed codes, not the content, summaries or hashes.

Schema checks may quote short matched spans of the authorized draft in their response so you can inspect a finding. Those quotes are untrusted input and remain outside product telemetry. No blockers found means only that these text checks found none; it does not verify your application or event eligibility.

Product telemetry does not store conversations, IP addresses, IP hashes, fingerprints or identifiers that link requests. Abuse protection uses IP-derived keys temporarily in worker memory. They are pruned lazily after idle expiry or lost when the worker restarts; this is not a fixed one-minute retention promise. They never enter the product database or exports.

Feedback is optional

Your agent can help write /arkiv/friction.md locally without sending that report to this MCP. Optional submit_feedback and report_outcome calls require your permission to share the minimised fields. Refusing does not prevent access to guidance.

The permission flag is an assertion from your agent, not consent the server can independently verify. Your agent must distinguish its own observations from opinions you actually expressed. Capture is best-effort: an accepted call does not guarantee a stored event or submit a hackathon entry.

Tool calls are not unique people. The MCP does not automatically see your local command results or the rest of your conversation.

Access and retention

Only authorised Arkiv operators can access the private dashboard, APIs and exports. The intended retention window for new events is 90 days. Enforcement requires operator review; there is no automatic deletion or migration of historical Ideathon data.

Operators export aggregates for the selected profile, environment and period. To request a review or deletion, contact the Arkiv team with the profile, period and category, without resending confidential content. Because people are not tracked, an individual history cannot be reconstructed. Any deletion requires explicit authorisation and scope review.

Hosting infrastructure

Hosting logs are separate from product telemetry and may contain network metadata under the hosting provider's own policies. The application does not print request inputs or credentials. Infrastructure operators must review hosting-log configuration and retention separately.

Tally submissions, geography and external identity sources are not joined to product telemetry.