Remote data handling#
This policy applies when using the hosted remote MCP. The local PyPI/stdio package has its own data handling.
The remote application is published and operated by Aleksandr Prokofyev, an independent individual developer. See the product and publisher page. The project name does not represent an affiliation with Wikimedia, Google or OpenAI.
Requests are processed to execute read-only MCP tools. Previously unseen entities are supported within bounded schemas. Relevant search text, names, aliases and QIDs in admitted requests are sent to Wikimedia's Wikidata services. Caller-supplied websites are compared as identity evidence; they are not fetched. Public remote V1 does not contact Google Knowledge Graph or any model provider and requires no provider secrets or sign-in. Local installations retain optional Google support.
Request content is not intentionally retained, published, turned into a public corpus or stored in a resolver cache. The service does not intentionally log full tool arguments, prompts, names, addresses, URLs or coordinates. Native Worker logs, traces and Logpush are disabled. Do not send credentials in tool arguments.
Shared upstream coordination stores one global lease, cooldown timestamps and attempt counters. No upstream URL, body, query, session token or tool arguments are stored in this row. Private validation reservations retain only opaque operation identifiers and bounded day/attempt totals; they do not store caller records.
Operational storage contains the global daily/minute admission counters and aggregates by day and tool: calls/errors, provider attempts/errors, response bytes and latency histogram buckets. Completion metrics are best effort. Aggregates are pruned to the current UTC day and preceding 30 days by both requests and a persistent daily alarm. No per-request identity records are stored. The quota row holds the current day only. A temporary isolate cache remembers exhaustion until midnight UTC.
A coarse Cloudflare burst limiter uses the connecting network address as an ephemeral rate-limit key. Application code does not store it or treat it as a person's identity. Cloudflare processes network traffic and supplies aggregate runtime metrics under its privacy policy. This policy does not promise that Cloudflare keeps no infrastructure/security records. Wikidata's own infrastructure receives the relevant queries.
What to send and controls#
Inputs can contain public entity names, aliases, record identifiers and relevant public facts. Names can identify public people, so send only the minimum public record information needed for the comparison. Do not send private personal records, user GPS location, home addresses, government identifiers, credentials, payment data or health information. This service is for public-record comparison, not personal identity verification, background screening or tracking.
You control the explicit tool inputs. There is no account, private workspace connection or permission to read your conversation history or files. Omit optional facts you do not want processed, decline tool use, or disconnect the connector to stop sending further requests. The application does not maintain stored request records to retrieve or erase; this statement does not cover independent provider infrastructure/security records described above. Support issues are public: do not paste private request content there. Use confidential reporting for security concerns.
For questions use the project support page. Report sensitive security issues through the confidential reporting instructions.