Privacy Policy

convention.sh is operated by Huellen Software Consulting, LLC (Illinois LLC #13344175), doing business as convention.sh ("convention.sh", "we", "our", or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the convention.sh service (the "Service"), including our hosted MCP server, website, and related tools.

By using the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree, do not use the Service.

We do not receive, collect, store, or train on your source code. The convention.sh MCP server delivers static markdown conventions; it does not accept code as input. Your codebase never leaves your machine as part of using the Service.

We do not sell, share, license, or otherwise transfer any user content to third parties for AI training, model fine-tuning, or any similar purpose.

The convention.sh MCP server performs no AI inference and makes no calls to any large language model on the request path. It is a static-content delivery service: an agent calls the read_convention tool with a convention id, and the server responds with the corresponding markdown body. Nothing about the request is interpreted by a model on our side.

We collect only the categories of information necessary to operate the Service:

• Account information — name, email address, and authentication identifiers when you create a paid-tier account.
• Billing information — billing address and subscription metadata. Card details are processed directly by our payment processor and are never stored on our servers.
• Request metadata — IP address, timestamp, the convention id requested, and (for paid plans) the API token presented. Used for rate limiting, abuse prevention, billing, and capacity planning. We do not log request bodies beyond what is required to route the request.
• Device and technical data — browser type, operating system, and referring URLs, when you visit our website.

We use information to:

• Provide, operate, and improve the Service.
• Authenticate paid-tier requests and enforce rate limits.
• Process payments and manage subscriptions.
• Send transactional emails (receipts, account alerts, security-relevant notices).
• Detect, investigate, and prevent abuse, fraud, and violations of our Terms.
• Comply with legal obligations.

All payment processing is handled by a third-party PCI-DSS compliant payment processor. When you provide payment information, it is transmitted directly to that processor using industry-standard TLS encryption. convention.sh does not store your full card number, CVV, or other sensitive payment-card data.

By making a purchase, you authorize the payment processor to store your payment method for future subscription billing and agree to that processor's terms and privacy policy.

We do not sell your personal information. We share data only in these circumstances:

• Service providers — third-party vendors who help us operate the Service (hosting, email delivery, payment processing, error monitoring) under contractual confidentiality obligations.
• Legal requirements — when required by law, subpoena, court order, or government authority, or to protect the rights, safety, or property of convention.sh or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, your data may be transferred subject to standard successor-confidentiality obligations.
• With your consent — for any other purpose with your explicit permission.

Our website uses a minimal set of first-party cookies required for session management and aggregate, privacy-respecting analytics. The MCP server itself does not use cookies. You can control cookies through your browser settings.

We retain account and billing information for as long as your account is active or as needed to provide the Service and comply with our legal obligations. Request metadata is retained for a rolling window sufficient for rate-limiting, abuse prevention, and billing reconciliation.

You may request deletion of your account and associated data at any time by emailing [email protected]. We will delete your account record and revoke any associated API tokens. Aggregate, non-identifying request metrics may be retained for capacity planning, and certain records may be retained for legal, tax, accounting, or compliance purposes.

We use industry-standard technical and organizational safeguards to protect information in our custody, including TLS in transit and access controls at rest. No system is perfectly secure; accordingly, we cannot guarantee absolute security and you use the Service at your own risk.

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data (subject to Section 9).
• Opt out of non-transactional communications.
• Lodge a complaint with a supervisory or data protection authority.

To exercise these rights, contact us at [email protected].

The Service is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us personal data, contact us and we will promptly delete it.

The Service is operated from the United States. By using the Service, you consent to the transfer of your information to the United States and to its processing under U.S. law, which may differ from the laws of your jurisdiction.

We may update this Privacy Policy from time to time. Material changes will be announced on this page or by email. Continued use of the Service after changes become effective constitutes acceptance of the revised Policy.

Questions about this Privacy Policy? Contact us at [email protected].

convention.sh is a product of Huellen Software Consulting, LLC (convention.sh dba Huellen Software Consulting, LLC). Illinois LLC #13344175.