Overview
Shibui Finance operates the MCP server at mcp.shibui.finance, a sign-in beta of the same server at mcp-beta.shibui.finance, and the website at shibui.finance. This policy explains what data we collect, how we use it, and your rights. mcp.shibui.finance works without an account. The beta host needs a Google sign-in or an API key; the section "Sign-in beta" applies only if you use it.
The controller responsible for data processing under the GDPR is Ingenieurbüro Christian Richter, Modersohnstr. 64, 10245 Berlin, Germany. Full legal and registration details are listed in our Imprint.
Data we collect
When you use the Shibui Finance MCP server, your MCP client (e.g. Claude Desktop or Claude Code) sends SQL queries to our server. We process these queries to return financial data results. We may log the following:
- The SQL query text (for debugging and performance analysis)
- The user prompt or question that motivated each query, as recorded by the MCP client (for debugging and quality analysis)
- Query execution time and row count
- Standard HTTP request metadata: IP address, timestamp, user-agent string
- For each tool call: the tool name, IP address, user-agent string, a session identifier taken from your client's request headers (or built from the user agent and IP address), and the user ID ChatGPT sends with its requests. We record these in a server log and in our self-hosted Umami analytics
Apart from these, we collect nothing that identifies you on mcp.shibui.finance, unless you write it into a prompt. That host has no user accounts and sets no cookies, and we use no tracking pixels. Prompts are free-text user input, so please avoid including personal information you would not want logged (names, account details, private context).
Sign-in beta (mcp-beta.shibui.finance)
mcp-beta.shibui.finance serves the same data to users who sign in with Google, or who use an API key they created while signed in. Everything under "Data we collect" applies there too. In addition, we store:
- Your Google account ID and email address, and when you first and last used the beta. Google sends us these when you sign in. We ask Google only for the openid and email permissions, so we receive no name, profile picture, contacts or other data from your Google account.
- Your API keys, if you create any with the manage_api_keys tool: for each key a SHA-256 hash (never the key itself), the label you gave it, and when it was created, last used and revoked.
- Your sign-in tokens: the access, refresh and ID tokens Google issues for your sign-in, stored encrypted on our server. The ID token contains your Google account ID and email address. We also store the registration your MCP client makes with our server (its name and redirect addresses).
- Your Google account ID in the query log and in the server log entry for each tool call, plus the key's ID when you use an API key. On the beta host, your prompts and queries are therefore linked to your account.
Signing in sends you to Google, which handles the sign-in under the Google Privacy Policy. Google learns that you signed in to Shibui Finance. While you use the beta, our server renews your sign-in with Google about once an hour. We use your tokens only to check and renew your sign-in.
The sign-in pages set these cookies on mcp-beta.shibui.finance only. They are needed for the sign-in and are not used for tracking:
- __Host-MCP_CONSENT_STATE_… and __Host-MCP_CONSENT_BINDING protect the approval step against forged requests. They expire after 15 minutes.
- __Host-MCP_APPROVED_CLIENTS and __Host-MCP_DENIED_CLIENTS remember whether you approved or denied an MCP client (up to 25 clients), so you are not asked again. They expire after one year.
This website (shibui.finance)
The landing page at shibui.finance is a static HTML site. It uses Umami, a self-hosted, privacy-friendly analytics tool, to collect basic page view statistics (pages visited, referrer, browser, OS, and country, region and city derived from your IP address). Umami does not use cookies, does not track you across sites, and does not share data with any third party. All analytics data is stored on a server we rent in Germany. Standard web server access logs (IP, timestamp, requested path) may be retained for up to 30 days for security and abuse prevention purposes.
How we use data
Query logs, server logs and tool-call analytics are used exclusively for:
- Debugging server errors and query failures
- Performance monitoring and query optimization
- Security monitoring and abuse prevention
- Understanding how the service is used, to improve it
On the beta host we also use your account data to sign you in, to check your API keys, and to see which account made which request. We use your email address only to identify your account and to answer you when you write to us.
We do not sell, share, or disclose query data or account data to any third parties.
Legal basis (GDPR)
Where the GDPR applies, we process server logs, query text, the prompts that motivated those queries, tool-call analytics and website analytics on the basis of our legitimate interest (Article 6(1)(f) GDPR) in operating, securing, debugging, and improving the service. On the beta host, we process your Google account ID, email address, API keys and sign-in tokens because they are needed to provide the signed-in service you asked for (Article 6(1)(b) GDPR). Recording your account ID in our logs, and keeping backups, rest on our legitimate interest in security, abuse prevention and recovery (Article 6(1)(f) GDPR). The sign-in cookies are strictly necessary for that service, so we set them without asking for consent (Section 25(2) no. 2 TDDDG). We do not use this data for advertising, profiling, or automated decision-making.
Data retention
Query logs are retained for up to 90 days, after which they are automatically deleted. Server access logs are retained for up to 30 days.
On the beta host, we keep your account record and API keys, including revoked keys, until you ask us to delete your account. Sign-in tokens are deleted at the latest one year after your last sign-in or renewal.
Third-party services
The MCP server, on both hosts, runs on a virtual server rented from OVH in Germany. Our analytics and our backups run on a second server, rented from a hosting provider in Germany. The website shibui.finance is hosted on AWS Amplify (Amazon Web Services) and delivered through the AWS CloudFront network, whose servers are located worldwide, so a page you request may be served from outside the EU. AWS processes your IP address and request details to do so and may keep access logs. Amazon Web Services and Google are certified under the EU-US Data Privacy Framework, which the European Commission has recognised as adequate. On the beta host, Google handles the sign-in (see "Sign-in beta").
We do not use Google Analytics, social media tracking pixels, or advertising networks. Analytics for the website and the MCP server are handled by self-hosted Umami (see above).
Your rights (GDPR)
If you are located in the European Economic Area, you have rights under the General Data Protection Regulation (GDPR), including:
- The right to access data we hold about you
- The right to correct inaccurate data
- The right to request deletion of your data
- The right to restrict processing
- The right to receive the account data you gave us on the beta host in a portable format
- The right to object to processing
- The right to lodge a complaint with a data protection authority, for example the Berliner Beauftragte für Datenschutz und Informationsfreiheit, or the one where you live
On mcp.shibui.finance we keep no accounts, so we can find your data only by IP address, time or prompt text; include those when you write. On the beta host we can find everything linked to your Google account ID. To exercise any of these rights, contact us at chris@shibui.finance.
Deleting your beta account and API keys
You can revoke an API key yourself: ask your MCP client to call the manage_api_keys tool while you are signed in with Google. A revoked key stops working immediately.
To delete your account, email chris@shibui.finance from the address you sign in with. Within one month we delete your account record and all your API keys, which stops the keys working, and remove your account ID from the query log. Server log entries are deleted on their regular schedule, and copies in our daily backups are replaced within seven days.
Also stop using Sign in with Google for Shibui Finance in your Google Account (see Google's help page). Your sign-in then ends within about an hour, and your stored sign-in tokens stop working; they are deleted at the latest one year after their last renewal. Until you do, your MCP client stays signed in, and its next request creates a new account. Stopping Sign in with Google alone does not delete the data we hold.
Security
All connections to mcp.shibui.finance and mcp-beta.shibui.finance are encrypted with TLS (HTTPS). SQL queries run against a read-only copy of the market database, so they cannot change any data. That database contains only publicly available historical market data. On the beta host, the manage_api_keys tool can create and revoke only your own API keys. We store API keys only as hashes and keep sign-in tokens encrypted.
Changes to this policy
We may update this policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.
Contact
For privacy questions or data requests, contact:
chris@shibui.finance
See also our Terms of Service and Imprint.