Privacy Policy
Last updated October 15, 2026. Operator: Toolweather, Mexico. Contact: toolweather@mail.grokbot.com
Short version: we store as little as we can. No accounts, no cookies, no ad tracking, no raw IP addresses.
What we store
- API keys: only a one-way hash of your key, plus its creation time and daily usage. We can't see or recover your key.
- IP addresses: never stored raw. To limit key creation and count visits, we keep a short hash of your IP (and, for visit counts, your browser's user-agent) salted with a secret and the current day, so it can't be linked across days.
- Usage counts: which endpoints and servers a key checks, per day, so we can enforce limits and improve the service.
- Change-alert watches: the server you watch, your webhook URL and its signing secret, and delivery history.
- Tokens you send for a one-time check: used once for that check and never stored or logged.
- Email: Toolweather has no mailing list. If you email us, we keep the conversation to answer you. The daily digest signup is part of Upstream and is covered by Upstream's privacy policy.
- MCP server data: public information about MCP servers (names, URLs, tool lists, health results). This isn't personal data.
What we don't do
No cookies or analytics trackers, no selling data, no profiling.
Who processes data for us
The service runs on Cloudflare (Workers, D1 database, Pages), which processes requests to deliver them, and the code lives on GitHub. We don't sell or share personal data with anyone else, and we don't use advertising trackers or cookies.
How long we keep it
Daily usage counters and IP hashes are only needed for the current day's limits; we delete them over time and they can't be linked across days. Key records and webhook settings are kept while they're in use. Email addresses are kept until you unsubscribe or ask us to delete them.
Your choices
You can ask us to show, correct or delete data linked to your key, webhook or email address, or object to its use, by emailing toolweather@mail.grokbot.com. Because we only store hashes, we may need the key itself to find its records. Data on a public blockchain can't be deleted by anyone.
Children
The service is meant for developers and is not directed at children.
Changes
We'll update this page if our practices change, with a new date at the top.