Privacy Policy

SG Statutes MCP (https://mcp.joshng.dev) is operated by Joshua Ng as a free research tool. The MCP endpoint can be used without an account; creating an account, which requires only an email address, raises the rate limits. This policy explains what data is collected in each case and how it is handled, and is written against Singapore’s Personal Data Protection Act 2012 (PDPA).

For any enquiries, questions or concerns, please contact Joshua at admin@joshng.dev.

1. What is collected

Account. Your email address (stored lowercased) identifies your account, together with its creation date. To verify the address we send a six-digit code by email; only a SHA-256 hash of the code is stored, and it expires after ten minutes. We use your address to operate your account and, where necessary, to contact you about the service. We send no other email.

Sessions. Signing in creates a server-side session record: a random identifier, your email, and the created, last-used and expiry times. Your browser holds only a signed cookie with the session identifier.

Access tokens. For each token we store the name you give it (do not put anything sensitive there), a SHA-256 hash of the token, and the created, last-used and revoked times. The token itself is shown once at creation and is never stored in readable form.

MCP requests with an account. Each request is logged with: your email and the token used, the tool name (or a generic label where the call is unrecognisable or unusually large), a SHA-256 hash of the tool’s arguments, the response time, whether it succeeded, the timestamp, the IP address and the user-agent (truncated to 512 characters). These records are used to operate and troubleshoot the service, enforce rate limits, and detect abuse such as bulk extraction.

MCP requests without an account. The same record is written, with the same purposes, except that there is no email and no token to record. In their place we store a caller key derived from your IP address — a keyed one-way hash, not the address itself — which lets requests from one caller be counted together without the identity field being an address. The IP address itself is recorded in the same record, exactly as it is for an account holder. Using the service without an account is not anonymous and is not untraceable: the address is what makes rate limiting, block lists and abuse detection possible, and it is the only means of identifying a caller who has no account.

The text of your queries is not stored. Only the hash is stored, which allows repeated identical calls to be counted without reading them. As statutory queries are short and predictable, hashing should be treated as data minimisation rather than a guarantee of anonymity.

Short-lived request counters are kept per account and per IP address for rate limiting, and an IP address may be recorded on a block list if usage crosses an abuse threshold or breaches the Terms of Use. Where there is no account, a block list entry against the IP address is the only measure available. The application and the hosting platform also produce ordinary web-server logs (method, path, status and timing).

2. What is not done

No analytics, tracking pixels, advertising or third-party scripts are used; the only cookies are those needed to sign you in. Personal data is not sold, rented, traded or disclosed for marketing, and no marketing email is sent. Queries are not used to train machine-learning models, and no payment information is collected; the service is free.

3. Third parties

Fly.io, Inc. hosts the service; the application and its database run in Fly.io’s Singapore (sin) region. Fly.io is a United States company; its edge network, support and administrative functions may involve access from outside Singapore, and its platform logs are held under its own arrangements.

Resend, Inc. delivers the verification-code emails; it processes your email address and the message for that purpose. Resend is a United States company.

For the cross-border element we rely on those providers’ standard data-processing terms, which bind them to protection standards comparable to the PDPA. Data is disclosed to no one else except where required by law.

4. Retention

Personal data is kept only for as long as it is needed for the purposes described above, or for as long as retention is necessary for legal or business purposes. Once neither applies, it is deleted.

5. Access, correction and deletion

Write to the address above, from your account email, to ask what data is held about you, to correct it, or to close your account. On closure we delete the account record, every token (which stops working immediately), every session, and the usage records attributed to you. A response will be given within 30 days, or you will be told when to expect one.

If you have used the service without an account, the only thing connecting a record to you is your IP address and the time of the request; tell us both, as precisely as you can, and the same response applies.

6. Security

Traffic is served over HTTPS. Verification codes, tokens and tool arguments are stored only as hashes. Session cookies are HttpOnly, Secure and SameSite, and sessions live server-side, so they can be ended immediately. State-changing forms are CSRF-protected, and the application runs as a non-root container user with the statute corpus opened read-only. The database file itself is not encrypted; it is protected by the platform’s volume access controls and container isolation. This is a small single-server service; do not treat it as a confidential channel.

7. Data breaches

If a breach occurs it will be assessed promptly and reasonable steps taken to contain it. Where it is likely to result in significant harm to affected individuals or is of significant scale, the Personal Data Protection Commission will be notified within three calendar days of the breach being determined notifiable, and affected account holders will be notified by email as soon as practicable.

8. Changes

This policy may be updated from time to time; the current version is always published at https://mcp.joshng.dev/privacy. If a change materially affects how your personal data is used, account holders will be told by email before it takes effect.