Privacy Policy — Rabbyt Comms MCP

Last updated: August 27, 2026

Rabbyt Comms MCP ("the Service") is a private, internal communications connector operated by the Rabbyt team. It allows a closed set of authorized team members to access their own Gmail and Telegram accounts through Claude AI clients. The Service is not offered to the public.

What data the Service accesses

• Gmail: with your explicit OAuth consent, the Service reads, searches, composes, and sends email in your Gmail account (Google scope gmail.modify), and reads your basic profile (email address, name) to identify your account.
• Telegram: with your explicit login (phone + one-time code), the Service reads and sends messages in your Telegram account via Telegram's MTProto API.

What the Service stores

• OAuth refresh tokens and Telegram session strings, encrypted at rest with AES-256-GCM, in a private MongoDB Atlas database.
• An audit log of tool invocations (which tool ran, when, for which user, and whether it succeeded). Message bodies are not persisted.

Email and message content is processed transiently to answer the authenticated user's own requests and is never stored, shared, or used for any other purpose.

What the Service does NOT do

• No sale, rental, or sharing of personal data with third parties.
• No advertising, profiling, or analytics on user content.
• No access to any account without that user's own credentials and consent.
• Google user data is used only as described here and in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

Data isolation

The Service is multi-tenant: every request is authenticated per user, and each user can only ever reach accounts they connected themselves.

Revoking access

• Gmail: remove "Rabbyt Comms MCP" at myaccount.google.com/permissions.
• Telegram: terminate the Service's session in Telegram → Settings → Devices.
• Or ask the operator to delete your stored credentials entirely.

Contact

Operator: Mazuki Lopez — mazuki@rabbyt.ai