GPLCoffee
Get Started

Legal

Privacy Policy.

How we collect, use, and protect your data.

Last updated: October 14, 2026

GPLCoffee ("we", "us", "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

1. Information We Collect

Information you provide

  • Account data: Name, email address, and password when you register.
  • Payment data: Processed by PayPal - we do not store credit card numbers. We receive your PayPal email, transaction IDs, and subscription status.
  • Support communications: Messages you send to our support team.
  • Access tokens: When you create an access token to connect an AI assistant or MCP client, we store the name you give it, its permissions, its expiry date, and when it was last used. The token itself is stored only as a one-way hash, so we cannot read it back.

Information collected automatically

  • Download records: Product name, version, timestamp, and IP address for each download.
  • Usage data: Pages visited, search queries, browser type, operating system, and referring URLs.
  • IP addresses: Collected with each download and login for security and abuse detection purposes.
  • Connector site data: When the Connector checks for updates, it sends the slugs and versions of the plugins it manages on that site. We store the latest list for each connected site to show you pending updates, and delete it when the site is disconnected. The Connector also reports whether you have turned on approved jobs for that site.
  • AI assistant activity: Each request an AI assistant makes with one of your access tokens is logged with the tool used, a short summary of its arguments (such as plugin slugs or a search query), the number of results, the outcome, the time, and a one-way hash of the IP address.
  • Download links: When a single-use download link is created for you, we record the product and version. Each link expires 10 minutes after it is created. When it is opened, we record the IP address and browser user agent, and the download is added to your download records.
  • Connector jobs: Install and update requests you send to a connected site, how you approved them (on the Service or through an AI assistant), and the result the site reports, such as installed, updated, or failed, with the installed version.

2. How We Use Your Information

  • Service delivery: Process downloads, manage subscriptions, allocate credits.
  • AI assistants and Connector jobs: Answer requests from AI assistants you connect, run the install and update jobs you approve, apply the limits we publish for them, and show you your access tokens and job history so you can review or revoke access.
  • Security and abuse prevention: Monitor download patterns, detect automated bulk downloading, investigate Terms of Service violations, and generate evidence reports for account review.
  • Transactional communications: Receipts, password resets, subscription changes, download notifications.
  • Service improvement: Analytics to understand usage patterns and improve the platform.
  • Marketing (with consent): Product updates and promotional emails. You can unsubscribe at any time.

3. Data Sharing

We do not sell your personal data. We share information only with:

  • PayPal: Payment processing and subscription management.
  • Resend: Transactional and marketing email delivery.
  • PostHog: Privacy-friendly product analytics (with consent).
  • Cloudflare: CDN, DDoS protection, and DNS.
  • DigitalOcean Managed PostgreSQL: Database hosting (data stored in Singapore, sgp1).
  • AI assistants you connect: When you connect an AI assistant or MCP client with an access token, the information it requests (such as catalog results, your plan and credit balance, or your connected sites) is sent to that assistant and handled by its provider under the provider's own terms and privacy policy. We do not otherwise share your data with AI providers.

We may also disclose information if required by law or to protect our rights in legal proceedings, including PayPal disputes.

4. Cookies

  • Essential cookies: Authentication session tokens and CSRF protection. Always active.
  • Analytics cookies: PostHog analytics. Only set with your explicit consent via our cookie banner.

You can manage cookie preferences at any time via the cookie settings in the site footer.

5. Data Retention

  • Account data: Retained as long as your account is active.
  • Download logs: Retained for the lifetime of the account for security, dispute evidence, and credit tracking purposes.
  • Access tokens: Kept while active. A revoked or expired token is deleted 30 days after it was revoked or expired.
  • AI assistant activity and download link records: Deleted 30 days after they are recorded.
  • Connector job records: Deleted about 90 days after the job has finished, failed, been cancelled, or expired.
  • Payment records: Retained as required for accounting, tax, and dispute resolution.
  • After account deletion: Personal data is permanently deleted. Anonymized aggregate statistics may be retained. AI assistant activity and download link records are removed on their 30-day schedule above.
  • Marketing suppression list: To honor an opt-out permanently, we keep your email address on an internal suppression list even after account deletion, so we never contact you again by mistake. It is used for nothing else, and no other personal data is kept.

6. Your Rights

You have the right to:

  • Access your personal data via your account dashboard.
  • Update your profile information and email preferences.
  • Delete your account from your account settings, which permanently removes your personal data.
  • Revoke any access token at any time from your account, which stops every AI assistant using it.
  • Export your data - contact support for a data export request.
  • Withdraw consent for marketing emails at any time.

7. Data Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), bcrypt password hashing, one-way hashing of access tokens and download links, secure session management, and regular security reviews. No system is 100% secure - we cannot guarantee absolute security.

8. International Data

Our database is hosted in Singapore (DigitalOcean Managed PostgreSQL, sgp1). Our application servers are in Singapore (DigitalOcean, sgp). If you access the Service from outside Singapore, your data may be transferred to and processed in Singapore.

9. Changes to This Policy

We may update this Privacy Policy at any time. Material changes will be communicated via email or a notice on the Service.

10. Contact

For privacy-related questions or data requests, contact us via our help page.