Privacy Policy

Effective: June 1, 2026 · Last updated: June 1, 2026

The short version. The AI Finance Stack is an open-source toolkit that runs on your own machine. Your credentials and your data never leave your machine. The public registry server (this site) collects no user accounts, no analytics, no personal data. There is nothing for us to share, sell, or lose — because we never receive your data in the first place.

1. Who this policy applies to

This policy covers two distinct components of The AI Finance Stack:

The public MCP registry server at the-ai-finance-stack.sanjayraghavan.workers.dev — what you're visiting now.
The bundled local MCP servers (e.g., mcps/qbo/) — open-source software you may install on your own machine.

2. What the public registry collects

From you, the user: nothing.

No user accounts. No login. No personally identifiable information collected.
No cookies set by this site.
No analytics, tracking pixels, or third-party scripts.
The registry serves a static catalog of public, open-source agent metadata. Tool calls (browse_agents, get_agent_detail, etc.) return public information about MIT-licensed components. No user-specific data is processed.

Standard Cloudflare Workers infrastructure logs (IP address, request path, timing, response code) are retained by Cloudflare per Cloudflare's privacy policy. The maintainer of The AI Finance Stack does not analyze, export, or otherwise use these logs.

3. What the bundled local MCPs do with your data

The bundled MCP servers (such as the QuickBooks Online MCP) run entirely on the user's local machine. Specifically:

OAuth credentials (refresh tokens, realm IDs) are stored locally in ~/.config/finance-stack/credentials/ on the user's machine, with restrictive file permissions (mode 0600). These credentials never leave the user's machine and are never transmitted to The AI Finance Stack or any third party.
API responses from connected systems (e.g., QuickBooks Online, Mercury, Stripe) are returned directly to the user's local MCP client (Claude Desktop, Claude Code, etc.). None of this data is transmitted to any AI Finance Stack server.
No analytics or telemetry is collected by the bundled MCPs. The software contains no code that "phones home" to The AI Finance Stack or any other server.

The maintainer of The AI Finance Stack therefore has no access to your QuickBooks data, your bank data, your customer or vendor information, or any other data accessed via the bundled MCPs. We could not retrieve, view, or share this data even if we wanted to.

4. What we explicitly do not do

We do not collect, store, process, or transmit user account information.
We do not sell, share, rent, or otherwise disclose user data to third parties — because we do not receive user data.
We do not use cookies, web beacons, or similar tracking technologies on the registry site.
We do not track user activity across sessions, devices, or sites.
We do not aggregate or anonymize user data for analytics, because we do not collect it.

5. Third-party services

The public registry server runs on Cloudflare Workers. Cloudflare provides the underlying compute and edge infrastructure. Standard request-level logs (as described in section 2) are subject to Cloudflare's own privacy policy.

The bundled MCP servers connect to third-party services that you configure (QuickBooks Online, Mercury, Stripe, etc.) using your own credentials. The privacy policies of those services apply to the data those services hold about you. The AI Finance Stack does not modify, intercept, or process this data — it flows directly between your local machine and the third-party service.

6. Your control

Because all data stays on your machine, you control it completely:

To revoke a bundled MCP's access to a third-party service, revoke its OAuth grant in that service's user dashboard (e.g., in your QuickBooks Online account settings).
To delete locally stored credentials, delete the relevant file in ~/.config/finance-stack/credentials/.
To stop using The AI Finance Stack entirely, uninstall the software from your machine. There is nothing for us to delete on our end, because we hold nothing.

7. Changes to this policy

If this policy changes (e.g., if a future version of the registry begins collecting analytics, which is not planned), the change will be visible in the commit history of this file in the public GitHub repo and the "Last updated" date above will reflect the change.

8. Contact

The AI Finance Stack is maintained by Sanjay Raghavan. For privacy-related questions:

File an issue at github.com/sanjay-raghavan/the-ai-finance-stack/issues
Contact via Substack or LinkedIn