Effective 15 October 2026

StateDock Privacy Policy

This policy covers the hosted StateDock website, web app and Remote MCP service at statedock.dev and app.statedock.dev. It also explains how StateDock plugin workflows use that service. Independently self-hosted copies have their own operators.

1. Who operates StateDock

StateDock is operated by Gang Huang, an individual operating under the ByteYellow brand (StateDock by ByteYellow). For this hosted service, the data controller is Gang Huang. For privacy questions or requests, contact support@statedock.dev.

2. Information processed and why

• Account and authentication: email address, login-code hashes, sessions, authorized MCP clients, OAuth grants and Agent Identity assignments, to sign you in and enforce access.
• Project content: projects, goals, plans, tasks, discussion, progress, handoffs, notes, attachments, collaborator permissions and timestamps that you or an authorized client submit, to provide shared project state.
• Connected services: notification destinations, integration settings and credentials you configure, to deliver requested notifications and integrations.
• Billing: subscription state, customer identifiers and payment events, to manage paid access. Stripe handles checkout and payment details; StateDock does not receive full card numbers through its checkout integration.
• Operational data: requests, errors and security-related metadata may be processed by StateDock and its hosting provider to operate, diagnose and protect the service.

3. Plugins and AI hosts

An authorized host sends tool arguments to StateDock and receives the requested records. This may include project content that you ask the host to save or retrieve. StateDock does not need your entire chat history or source repository to provide these workflows; do not place secrets in task text. What an AI host processes is governed separately by that host’s policies. StateDock’s shared Skills record state and restore context; they do not themselves execute code, launch agents or schedule work.

4. Recipients and infrastructure

Cloudflare provides hosting, database, object storage, authentication-related storage and email infrastructure. Stripe processes payments. Collaborators can access records according to project permissions. Hosts and notification providers receive data when you authorize or configure those connections. Providers may process information internationally under their applicable service and data-protection arrangements. We may disclose information when legally required or necessary to investigate abuse and protect rights.

5. Cookies and device storage

We use authentication cookies and browser storage for sign-in, language, workspace preferences, notification settings and offline app functionality. Login codes expire after 10 minutes and web sessions after 30 days unless revoked earlier; expiration of access does not by itself delete every related database record. Clearing browser storage removes local app data but does not delete server-side records.

6. Retention

Project content is kept while it is part of your workspace until deleted or a deletion request is processed. Archived or soft-deleted records may remain recoverable and are not necessarily immediately erased. Authentication and integration records are retained as needed to operate and secure access. Operational logs, backups and billing records follow their operational or legally required retention criteria. We do not promise immediate removal from backups or a fixed automatic erasure period that the service does not implement. Contact us to request an account-specific retention or deletion explanation.

7. Your controls and rights

You can edit project records, manage collaborators, revoke MCP credentials or OAuth access, and disable integrations. Disconnecting a host stops its future authorized access but does not erase records already stored. Contact us for access, correction, export or deletion requests and to exercise applicable rights of objection, restriction or consent withdrawal. We may need to verify account ownership. Where applicable, you may complain to your data-protection authority. Processing needed to provide the service relies on the service relationship; security and reliability rely on legitimate interests, optional consent-based features on consent, and required records on legal obligations.

8. Security and changes

We use access controls and encrypted HTTPS transport. No service can guarantee absolute security. Do not submit credentials or sensitive information unnecessary for project coordination. We will update this page when these practices change and display the effective date above.