# Privacy · Onto > What Onto collects through its API, SDK, MCP server, dashboard and site, where it's kept, how long, and who else sees it. **Source:** /legal/privacy **Extracted:** 2026-09-24T18:14:20.469Z --- Legal ## Privacy Policy What Onto collects through the Read API, the MCP server, the Serve SDK, the dashboard and this site: where it's kept, for how long, and who else sees it. Onto is early and run by its founder. This isn't a DPA or a certification. In force Last updated 24 Sep 2026 Previous version 5 Sep 2026 Contact [founder@buildonto.dev](mailto:founder@buildonto.dev) What we collect ### By where it comes from. Read off the code on 24 Sep 2026. Don't put secrets in a URL you send us: the URL is kept. #### Your account Sign-in Your email, and your name and company if you gave them at signup. With GitHub or Google, the identity they return. Passwords stay with Supabase Auth. Keys A SHA-256 digest of each Read API key, never the key itself. Serve site keys are stored as issued today; we're moving them to digests too. Billing Your plan, purchases and credit balance. Polar takes the payment; we never see card details. #### When you use the API or MCP server Each call The endpoint, the URL you asked for, the status, whether it came from cache, the time taken, bytes in and out, an estimate of tokens saved, the credits it cost, and when. Not kept The page itself, its Markdown and its score. Those live only in the hour's cache. MCP sign-in Registered clients, one-time codes and refresh tokens, so the client can call Onto for you. The keyless reader At md.buildonto.dev, a count of reads per IP address, to hold the 10-read limit. It's kept without an expiry. #### When your site runs the Serve SDK Each agent visit The route, the visitor's full user-agent, the agent it matched, your SDK version, the page sizes, and the country of the server that reported it (not the visitor's). No visitor IP, query string or cookies. Also counted Requests that ask for Markdown by header or ?onto, even from a person or a script. At build The Markdown copy of each page, uploaded to your Onto account. #### On buildonto.dev Page views Vercel Web Analytics and Speed Insights: aggregate and cookieless. Vercel also keeps host logs (IP, user-agent, path). Scans Nothing is kept from a scan except three running totals for the homepage counters. Saved reports Only if you save one: the URL, score, grade, title and the full scan result with up to 12,000 characters of the page's Markdown. Only you can read or delete it. Email Resend sends the welcome email and your support messages. Waitlist addresses from before 5 June sit in Notion. How long ### What expires, and what doesn't yet. 1. **An hour**A read's page and Markdown, in the cache 2. **A month**Quota counters, which reset on the 1st 3. **30 days**An MCP refresh token, unless it's used first 4. **Until you delete it**A saved report 5. **No limit yet**Account records, usage and visit records, uploaded pages and the reader's IP counts. Nothing deletes them on a schedule today; setting periods for each is the next change to this policy. Who else sees it ### Every service your data reaches. If this list changes, this table changes with it. 1. [**Vercel**Their privacy policy](https://vercel.com/legal/privacy-policy) Hosting, and Vercel KV (run by Upstash) for short-lived dataEvery request in transit; page payloads cached for an hour; monthly quota counters; MCP sign-in grants; the keyless reader's per-IP counts; cookieless page analytics on buildonto.dev`next, @vercel/kv, @vercel/analytics` 2. [**Supabase**Their privacy policy](https://supabase.com/privacy) The database, and dashboard sign-inAccount (email, name and company if you gave them), sign-in identity, API key digests, usage records per call, Serve visit records, pages your SDK uploads, reports you save`@supabase/supabase-js` 3. [**Polar**Their privacy policy](https://polar.sh/legal/privacy) Billing and subscriptionsYour email, plan and purchases. Card details stay with Polar`@polar-sh/sdk` 4. [**Resend**Their privacy policy](https://resend.com/legal/privacy-policy) EmailYour email and first name for the welcome email; your message, email and plan when you contact support`resend` 5. [**Notion**Their privacy policy](https://www.notion.so/notion/Privacy-Policy) The old waitlistEmail addresses left on the waitlist before signup opened on 5 June 2026`@notionhq/client` 6. [**Google Fonts**Their privacy policy](https://policies.google.com/privacy) Fonts on the reader pagesYour IP address and browser details when you open a page at md.buildonto.dev`fonts.googleapis.com` Your rights ### Access, correct, delete. Under GDPR, UK GDPR, CCPA or India's DPDP Act you may have the right to see, correct, delete or restrict what we hold about you. **Ask by email**Write to [founder@buildonto.dev](mailto:founder@buildonto.dev) with what you want and your account email. A person replies. **Delete your account**There's no delete button yet: email [founder@buildonto.dev](mailto:founder@buildonto.dev?subject=Delete%20my%20Onto%20account) with the subject “Delete my Onto account”. We keep only what the law or fraud prevention needs, such as invoices. **Keys and connections**Replacing a key in the dashboard revokes the old one. An MCP connection is removed from the client that made it. Cookies ### Sign-in, not advertising. #### Cookies Sign-in Supabase's sign-in cookie, shared across buildonto.dev and its subdomains so you stay signed in on both, for up to 400 days. Dashboard Which of your sites is open (a year), and a flag for the demo mode. None of Advertising, analytics or cross-site cookies. Vercel Web Analytics doesn't use cookies. #### We never * Sell your data, or anything you send us * Send it to an AI model: Onto calls none * Train a model on what you read * Run advertising or cross-site tracking The rest ### Where, who for, and changes. **Where**With the services above, in the regions they run. We don't offer a single-region option. **Who it's for**Developers and site owners. Not directed at anyone under 16. **Changes**The dates at the top are the source of truth. A change that matters gets a new date here, not a quiet rewrite. Related ### How we protect it, and what our fetcher does. Security cites the code behind every control; Onto-Reader lists every request it sends to a site. [Security](/legal/security) [Onto-Reader](/about-bot) --- ## Structured Data (JSON-LD) ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://buildonto.dev/#org", "name": "Onto", "url": "https://buildonto.dev", "logo": "https://buildonto.dev/icon.png", "sameAs": [ "https://x.com/buildonto", "https://github.com/ravixalgorithm/ontosdk" ] }, { "@type": "WebSite", "@id": "https://buildonto.dev/#site", "url": "https://buildonto.dev", "name": "Onto", "publisher": { "@id": "https://buildonto.dev/#org" } }, { "@type": "SoftwareApplication", "name": "Onto", "applicationCategory": "DeveloperApplication", "operatingSystem": "Web", "url": "https://buildonto.dev", "description": "Onto serves AI agents clean Markdown from your own site, at the same URL, and shows you which agents came. Plus the AIO score, a Read API and an MCP server.", "publisher": { "@id": "https://buildonto.dev/#org" }, "offers": { "@type": "Offer", "price": "0", "priceCurrency": "USD", "description": "Free tier: 1,000 credits / month" } } ] } ```