Find the right AI tools for any job, task or industry.TOOLGRAIL / YOUR DATA
Privacy policy
How information is handled when you browse ToolGrail or connect its public MCP server.
Effective and last updated: 12 November 2026
The essentials
You can browse and connect without a ToolGrail account. Wishlists and comparisons are saved in your browser. MCP requests contain the inputs your assistant sends; hosting and font providers may also process technical request information.
1. Scope and responsibility
This policy describes the ToolGrail website at toolgrail.vercel.app and its public MCP endpoint at /api/mcp/. ToolGrail operates the directory and the endpoint. It does not operate the third-party products listed in the directory or the AI assistants you use to connect.
This policy covers the current public service. Company registration, company sign-in and submissions are disabled while those features are a work in progress.
2. Information processed and why
| Information | Purpose and handling |
|---|---|
| Website requests | Requested pages, query strings, IP address, request time, browser information, response status and similar technical data may be processed by our hosting provider to deliver, secure and diagnose the service. Search terms can appear in page URLs. |
| MCP inputs | Your assistant sends the query, tool identifiers, role, task, industry, filters and other arguments needed for a requested operation. The server processes those arguments to return public catalog results. Its application handler does not save request inputs or results in a visitor database or deliberately log raw MCP request bodies. |
| Saved selections | Tool identifiers for your wishlist and comparison list are stored in browser local storage. They are not submitted to a ToolGrail account database. A shared comparison URL includes the selected tool identifiers. |
| Admin access | Authorised editor sign-in uses a necessary session cookie and may record a network-address-based key and attempt counters for rate limiting. This is separate from public browsing and the keyless MCP endpoint. |
ToolGrail does not request your assistant’s complete conversation history, private files, account passwords, API keys or payment details. The assistant decides which task-specific inputs to send. Avoid including confidential or sensitive information in those inputs.
3. Service providers and other recipients
- Vercel: hosts and delivers the website and MCP endpoint and may process request information and operational logs for hosting, reliability and security. See Vercel’s Privacy Notice.
- Google Fonts: the website loads fonts from Google’s font services. Your browser sends technical information, including its IP address and request headers, when it fetches those resources. See the Google Fonts privacy information.
- Your AI assistant: retains and processes your chats, connection settings and tool results according to its own policies. ToolGrail does not control that provider’s retention or training settings.
- External websites: opening product, pricing, source or setup links sends you to a third-party service under its own privacy policy. ToolGrail does not automatically connect you to a listed vendor’s account or MCP server.
ToolGrail does not sell visitor data or use MCP inputs to train an AI model. The website code does not include advertising pixels or a third-party visitor analytics integration. Service providers may process information in countries other than your own under their applicable terms and safeguards.
4. Retention
- Wishlists and comparisons: remain in your browser until you remove selections, clear site data, or the browser removes them. There is no server-side backup or cross-device synchronisation.
- MCP queries and results: are processed for the request and are not written to an application-level query-history database. This does not prevent hosting diagnostics or your assistant provider from retaining information under their own settings.
- Hosting records: retention depends on the Vercel plan and project settings; see Vercel’s published runtime-log retention windows. The site code does not configure a separate long-term log archive.
- Editor sessions: the admin session cookie expires after eight hours unless removed earlier. Administrative rate-limit records are stored separately from the public MCP service.
Third-party font, assistant and vendor records are subject to the respective provider’s retention policies.
5. Cookies and local storage
Public browsing and MCP access do not require a visitor login cookie. Wishlist and comparison features use browser local storage rather than advertising cookies. The admin area uses an HTTP-only session cookie for authenticated editors. Blocking local storage can prevent saved selections from surviving a visit.
6. Your controls and choices
- Remove saved tools individually or clear site data for toolgrail.vercel.app in your browser.
- Disconnect ToolGrail from your assistant to stop future MCP requests, and use that provider’s controls for chat history and its stored tool results.
- Use general task descriptions rather than private records in search and MCP inputs.
- Review the privacy policy of any product before opening an account or connecting its MCP server.
Privacy rights depend on where you live and may include access, correction, deletion and objection. ToolGrail currently offers self-service support only; it has no direct contact inbox or form for individual privacy requests. The controls above cover locally saved selections. They do not erase records held by Vercel, Google or your assistant provider, whose own privacy channels and controls apply.
7. Security and changes
The service is delivered over HTTPS. The public MCP tools are read-only and limited to the published catalog; they do not expose company submissions or administrator records. No online service can guarantee absolute security.
We will update this page and its effective date when the described practices change. Any future visitor-account or company-submission features will need updated privacy information before launch. See Documentation for the current scope and Support for self-service help.