Privacy Policy
Last updated October 9, 2026.
Mappstack is the business name of SY Innovations Pty Ltd (ABN 38 668 523 760), Australia. This policy covers app.mappstack.com and its MCP server at app.mappstack.com/mcp.
What we collect
- Account: your Stackure account ID. Stackure, our own sign-in service, holds your email and name to send sign-in links.
- Content: the projects, diagrams, elements and layouts you or a connected AI client create.
- Access tokens: OAuth tokens issued to clients you connect, such as Claude.
- Request logs: method, path, status and timing. Never request bodies.
- IP address: held in memory for 1 minute to rate limit the MCP server, never stored.
- Cookies: 1 session cookie for sign-in. No analytics or advertising cookies.
What we don't collect
The MCP server receives only the tool name and arguments a client sends. We never receive your conversations, chat history, memory or files.
How we use it
To sign you in, store and validate your diagrams, keep the service secure and fix faults. We don't sell data, show ads or use your content to train AI models.
Sharing
Only with Railway, which hosts the app and its database, and when the law requires it.
Retention
- Content stays until you delete it. Deleting a project, diagram or element removes it from the database immediately.
- To close your account, email us. We delete your account and every project in it within 30 days.
- Request logs are deleted when our hosting provider's log retention expires.
Your rights
You can access, correct, export and delete your data. Export any project from the web editor, or email us for anything else. If you're unhappy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Security
HTTPS only, OAuth with PKCE for connected clients and an access check on every project for every request.
Changes
We'll post changes here and update the date above.