Privacy Policy

Last updated: September 13, 2026 — Version 1.0

This policy describes the invitation-only MVP of PlanBefore, including the public website, PlanBefore Auth, PlanBefore Hub, PlanBefore Node and the MCP resource at https://mcp.kvnlabs.xyz/repoflow. It describes current technical behavior; formal operator and commercial details will be completed before general availability.

What PlanBefore processes

PlanBefore processes only information needed to provide, secure and operate the service:

• Account data: user ID, username, display name, role, status, creation and update timestamps.
• Passkey data: the cryptographic WebAuthn credential information needed to verify a passkey. PlanBefore does not receive or store your fingerprint, face scan or biometric template.
• OAuth data: client ID and name, redirect URIs, resource, scope, authorization metadata and hashed refresh tokens. Access tokens last one hour, refresh tokens 30 days and authorization codes two minutes.
• Node data: Node UID, display name, public Ed25519 key, owner, approval or revocation timestamps, operating system, architecture and PlanBefore version when reported. PlanBefore does not collect hardware serials, MAC addresses, CPU identifiers or a full hardware fingerprint by default.
• Project metadata explicitly exposed by you: project UID, project ID or slug, display name and Node relationship.
• Operational and audit metadata: timestamp, user UUID, Node UID, project UID, method, path and line range, status, error, duration, response size, operating system, architecture and request ID. Audit and usage retention is initially 30 days.
• Network information such as IP address may be processed for network delivery, rate limiting, security and abuse prevention. PlanBefore does not add permanent IP storage solely for statistics.

Why it is processed

Account and security data authenticate users, authorize MCP clients, protect sessions and connect approved Nodes. Project metadata routes authorized requests. Operational metadata helps detect abuse, troubleshoot failures, maintain reliability and measure aggregated usage. PlanBefore is invitation-only: there is no public registration, advertising, profiling or data-based monetization in this MVP.

Your repository and requested content

Your repository stays on your machine.

You explicitly expose a project with pbnode expose. The Node reads requested information locally, the Hub transports the result transiently and the authorized MCP client receives it:

Repository stays local
  → authorized MCP request
  → PlanBefore Node reads the requested information locally
  → PlanBefore Hub transports the result
  → authorized MCP client

The repository is not replicated in PlanBefore Hub. Content requested by file.read, code.search or git.diff may be transmitted to the authorized MCP client for that request. PlanBefore Hub does not persist that content in its database, audit log, usage metrics or security logs.

External MCP clients

If you authorize ChatGPT, Claude, Gemini or another MCP client, requested content may be returned to that client. That client is a third-party service explicitly authorized by you, not automatically a PlanBefore infrastructure processor. Its subsequent use of the information is also governed by that provider’s policies and terms.

Security

PlanBefore uses passkeys and WebAuthn, Secure and HttpOnly cookies, CSRF protection, OAuth PKCE, resource-bound short-lived access tokens, refresh-token rotation, Ed25519 Node identity, read-only MCP operations, explicit project exposure, tenant isolation, sensitive-file restrictions, rate limiting, CSP and metadata-only audit logging. PlanBefore blocks known sensitive file patterns by default. No system can guarantee that secrets can never be exposed; you are responsible for choosing what to expose and which MCP client to authorize.

Retention and deletion

Short-lived sessions, OAuth codes, tokens and setup flows expire at the periods described in the Cookie Policy and Terms. Accounts and registered passkeys remain while the account is active. Audit logs and usage metrics are retained for 30 days. A deletion request first disables the account, revokes sessions and OAuth refresh tokens, and revokes Nodes; persistent information is then deleted according to the retention policy, subject to necessary security records.

Disabling an account is different from deleting it. To request access, correction or deletion, email privacy@kvnlabs.xyz. We may request enough information to verify the request and will not use that verification for unrelated purposes.

Third parties

Vercel hosts and delivers the static public website and may process technical request metadata. Cloudflare provides the reverse proxy, tunnel and network/security layer for Auth and Hub. GitHub provides Actions, Releases and software distribution; the public website normally uses build-time release metadata and does not call GitHub automatically during a visit.

Changes

PlanBefore may update this policy as the MVP evolves. The version and effective date will change with material updates. New accounts record the Terms and Privacy Policy versions accepted during invitation registration. Existing accounts may temporarily have no recorded version while the migration strategy is completed.