---
title: Privacy Policy
description: How nekuda processes information when you use WebMCP Kit, its browser SDK, and these documentation pages.
sidebar:
  label: Privacy
seo:
  title: WebMCP Kit Privacy Policy
---

**Last updated: August 13, 2026**

This Privacy Policy explains how OpenCommerce Network, Inc., doing business as nekuda ("nekuda," "we," "us," or "our"), processes information in connection with WebMCP Kit, the WebMCP browser SDK distributed by nekuda, and the WebMCP Kit documentation (together, the "Services"). It does not replace the privacy policy of a website that installs the SDK or the terms of the coding agent, source-control provider, package registry, or other third-party service you choose to use.

For privacy questions or requests, email [founders@nekuda.ai](mailto:founders@nekuda.ai).

## The short version

- **The plugin works in your development environment.** WebMCP Kit reads and changes repository files through your coding agent. The plugin does not upload your source code, routes, schemas, or generated tools to nekuda.
- **The SDK sends limited usage telemetry by default.** This helps us measure SDK adoption, browser support, tool registration, reliability, and performance. It is designed not to identify a visitor, does not use cookies or browser storage, and does not include raw tool inputs or results.
- **Full tool-call tracking is separate and off by default.** A website operator may choose to enable authenticated tracking or OpenTelemetry. That channel can include full URLs, tool inputs and results, error text, and persistent pseudonymous identifiers.
- **You can turn default telemetry off.** The SDK honors Global Privacy Control and provides both page-wide and per-registration controls described below.
- **We do not sell WebMCP Kit data or use it for targeted advertising.**

## 1. Scope and roles

This policy applies to:

- the WebMCP Kit plugin and its local review interface;
- the nekuda WebMCP browser SDK, including packages currently or previously published under nekuda or AgentLane names; and
- the WebMCP Kit documentation website.

OpenCommerce Network, Inc. is generally the controller of information collected through the documentation site and the SDK's default usage-telemetry channel.

When a website operator enables the separate authenticated tracking channel, that operator decides why the data is collected and which tools and destinations are configured. The operator is responsible for giving its visitors any required notice and obtaining any required consent. Where those events are sent to nekuda's hosted collection service, nekuda processes them to provide the service to that operator, subject to the applicable customer agreement. If the operator sends events only to its own endpoint or OpenTelemetry exporter, nekuda may not receive them at all.

## 2. The WebMCP Kit plugin

The plugin examines a developer's repository, proposes tools, writes approved code, and verifies the result through the coding agent running it. This work happens in the developer's environment. The plugin has no hosted source-code scanner and does not send repository contents to nekuda.

During an interactive run, the plugin may create a local `.webmcp` folder containing a tool plan, generated code copies, status records, comments, feedback, and approvals. Those files remain under the developer's control. They may be committed to a repository or included in a pull request if the developer approves that workflow, in which case the developer's source-control provider and repository access rules apply.

The coding agent that runs the plugin may process repository content under its own agreement and privacy policy. Installing the plugin or SDK, loading the local review interface, or publishing a pull request may also create ordinary request logs with the relevant package registry, code host, content-delivery network, or source-control provider. Those providers control their own services.

## 3. Documentation-site data

When you visit the WebMCP Kit documentation, our hosting and security providers may process standard request data such as IP address, user-agent information, requested page, referring page, timestamps, and security events. We use this information to deliver and secure the site and diagnose technical problems. The documentation site does not currently use advertising cookies.

If you contact us, we receive the information you choose to send, such as your name, email address, company, message, and related correspondence. We use it to respond, provide support, and manage our relationship with you.

## 4. Default SDK usage telemetry

Unless a website operator turns it off, the SDK sends a small event when it loads, when tools are registered, and when a tool call finishes. The events may include:

- SDK version and installation method;
- whether a WebMCP browser surface is available and how it was provided;
- a random session identifier created in memory for that page load;
- a reduced route pattern, route-segment count, broad referrer category, page visibility, and top-page or iframe context;
- browser name and major version when available, primary language, broad device form factor, and a coarse agent-runtime category;
- tool names and stable keys, versions and purpose categories supplied by the developer, registration outcomes, schema fingerprints, and counts describing schema shape;
- call order, outcome, duration, response size and block count, error class, and a standardized error signature; and
- ordinary network metadata that accompanies an HTTPS request, such as the site's origin, IP address, and user-agent header. An API key may also associate an event with a customer account when the website operator has configured one.

The default channel is designed for product-level measurement, not visitor profiling. Its event body does **not** intentionally include:

- source code or repository content;
- page text, page title, full URL, query string, or fragment;
- raw referrer URLs;
- tool descriptions, parameter names, or full schemas;
- tool inputs, tool results, or raw error messages;
- names, email addresses, payment details, or account credentials;
- a persistent visitor identifier; or
- cookies, `localStorage`, or `sessionStorage` identifiers.

The SDK reduces paths to route patterns and removes common variable values from error signatures. A site-controlled slug or unusual error message can still contain information those rules do not recognize. Website operators should not put personal information or secrets in URL paths or error messages and should disable telemetry where that cannot be assured.

### Turning default telemetry off

For a guaranteed page-wide opt-out, set the global flag before the SDK loads:

```js
globalThis.__WEBMCP_TELEMETRY__ = false;
```

A registration can also opt its own tools and calls out:

```ts
registerTools(tools, { telemetry: false });
```

Because the SDK-load event is scheduled when the module is imported, use the page-wide flag when the registration happens later in the page lifecycle. The SDK also stays silent when the browser sends [Global Privacy Control](https://globalprivacycontrol.org/) and in server-rendering environments without a document.

## 5. Optional tool-call tracking

The separate `tracking` option is off unless a website operator configures an API key or enables OpenTelemetry. When enabled, it can process:

- a random visitor identifier stored in `localStorage` until browser storage is cleared;
- a random session identifier stored in `sessionStorage` and refreshed after 30 minutes of inactivity;
- event time, site origin, full page URL and path, referrer, and page title;
- tool name, stable key, version, call identifier, and duration;
- raw tool input and normalized result; and
- raw error text when a tool call fails.

Tool inputs, results, URLs, and error text are controlled by the website and may contain personal or sensitive information. Website operators that enable tracking must choose an appropriate lawful basis, provide their own notice, configure consent where required, limit the data their tools return, and avoid sending information they do not need.

Authenticated events may be sent to nekuda's collection service, a custom endpoint selected by the website operator, the operator's OpenTelemetry pipeline, or a combination of those destinations. The operator's privacy policy should identify the destinations it uses. Setting `tracking: { disabled: true }` stops this optional channel; it does not stop the separate default telemetry channel.

## 6. How we use information

We use information covered by this policy to:

- provide, maintain, secure, and troubleshoot the Services;
- understand SDK adoption, browser compatibility, registration success, tool reliability, and performance;
- improve the plugin, SDK, documentation, and developer experience;
- provide customer-configured analytics and support;
- prevent abuse and enforce applicable agreements; and
- comply with law and protect the rights, safety, and security of users, nekuda, and others.

We do not use WebMCP Kit telemetry to make decisions that produce legal or similarly significant effects about individual visitors.

## 7. Legal bases

Where applicable law requires a legal basis, we rely on:

- **legitimate interests** in operating, securing, measuring, and improving the Services, balanced against the limited nature of the default telemetry and the controls available to website operators and visitors;
- **contract** when processing is necessary to provide a service requested by a customer or user;
- **consent** where consent is required or chosen by the website operator; and
- **legal obligations and protection of rights** where processing is necessary to comply with law or establish, exercise, or defend legal claims.

Website operators are responsible for deciding whether the default telemetry is appropriate for their users and jurisdiction. If consent or a different notice is required, they should keep telemetry disabled unless and until those requirements are met.

## 8. How we disclose information

We may disclose information:

- to hosting, infrastructure, security, communications, support, and data-processing providers that help us operate the Services;
- to the relevant website operator or customer for authenticated tracking configured for that operator;
- to destinations selected by the website operator, such as a custom endpoint or OpenTelemetry provider;
- to professional advisers and authorities when reasonably necessary to comply with law or protect rights and safety; and
- as part of a merger, financing, acquisition, reorganization, bankruptcy, or transfer of all or part of our business, subject to appropriate protections.

We do not sell personal information collected through WebMCP Kit, and we do not share it for cross-context behavioral advertising.

## 9. Retention

We retain information only for as long as reasonably necessary for the purposes described above, including service delivery, security, product analysis, customer commitments, dispute resolution, and legal compliance. The period depends on the nature and sensitivity of the information, the feature that produced it, the customer's configuration and agreement, the risk of harm, and applicable legal requirements.

We delete or de-identify information when it is no longer needed. Aggregated or de-identified statistics that no longer identify a person may be retained for longer. Local plugin files remain under the developer's control and follow the retention rules of the developer's device and repository.

## 10. International processing

nekuda and its providers may process information in the United States, Israel, and other countries where they operate. Those countries may have different data-protection laws from your country. Where required, we use recognized safeguards for international transfers, such as adequacy decisions, contractual protections, or another lawful transfer mechanism.

## 11. Security

We use reasonable technical and organizational measures designed to protect information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

## 12. Your choices and rights

Depending on where you live and the context, you may have rights to access, correct, delete, restrict, or receive a copy of personal information; object to certain processing; withdraw consent; or appeal a decision about a request. You may also have the right to complain to your local data-protection authority. We will not discriminate against you for exercising applicable privacy rights.

Email [founders@nekuda.ai](mailto:founders@nekuda.ai) to make a request. We may need to verify your identity and authority. Because default SDK telemetry does not use a persistent visitor identifier, we may be unable to connect an event to you without details such as the website, approximate time, and page-load session identifier. If your request concerns tracking on a website that installed the SDK, contact that website operator first; we will assist the operator where required.

You can also use the SDK controls in Section 4, clear browser storage used by optional tracking, or enable Global Privacy Control in a supported browser.

## 13. Children

The Services are developer tools and are not directed to children under 16. We do not knowingly collect personal information from children through the Services. Operators of child-directed websites should keep SDK telemetry and tracking disabled unless they have established an appropriate legal basis and provided all required notices and controls.

## 14. Changes to this policy

We may update this policy as the Services or legal requirements change. We will post the revised policy here, change the "Last updated" date, and provide additional notice when required by law.

## 15. Contact

For privacy questions, rights requests, or complaints, contact:

**OpenCommerce Network, Inc. (nekuda)**  
[founders@nekuda.ai](mailto:founders@nekuda.ai)  
[https://nekuda.ai](https://nekuda.ai)