Privacy at fovub
Palo Alto Data Group runs fovub: the website at fovub.com, and the MCP server at https://fovub.com/mcp, which you connect to from Claude or any other app that supports MCP.
Your account. You sign in with Google. fovub receives your email address, whether Google has verified it, your name, and Google's identifier for your account. It keeps these with the dates of your first and last sign-in. It also keeps whether your account began on fovub.com or through the MCP server, and which app connected. An account that Palo Alto Data Group makes with a fovub password keeps its email address and a hash of the password in place of Google's details.
Your projections. fovub keeps the seat you choose, the two names you enter, your answers to the projection's questions, and the result.
Your searches. fovub keeps no history of your seat searches. An operator alert email about a seat search made without sign-in carries the search words and a visitor code in place of your IP address.
Your balance and payments. fovub keeps every change to your balance: the starting credit, each purchase, and each hold, spend, release, refund, and dispute. Stripe takes your card on its own payment page, and fovub never receives your card details. fovub keeps Stripe's identifiers for you and for your payments, and it keeps the amounts.
Cookies. fovub sets three cookies on fovub.com. One keeps you signed in for 30 days, one ties a sign-in to the browser that started it, and one carries an app's connection request through the sign-in. fovub's database stores only a SHA-256 hash of the cookie that keeps you signed in. The site carries no advertising or analytics tags.
Your IP address. fovub uses your IP address to enforce its hourly limits on searches, sign-ins, and Claude calls. It keeps those counts in memory for an hour and stores no address.
App connections. When you connect an app to fovub's MCP server, fovub keeps the app's registration, your permission for it, and SHA-256 hashes of its codes and tokens. An access token lasts one hour, and a refresh token lasts 30 days. fovub receives only what each tool call carries: the seat words, the two names, and your answers. It reads no chat history, memory, or files from the app.
What a projection gathers. A projection gathers public information about the seat and the two people named, such as campaign finance filings, news, and election results. fovub keeps each projection's run archive and report PDF. fovub keeps the public documents a projection fetches, such as filings and web pages, with no end date.
Who else receives data.
- Anthropic's Claude API runs the seat search, each projection's search of the public record, the questions that fovub's own list leaves to Claude, and the full report. fovub's own code asks the other questions, matches each campaign to its frame, and scores the race. fovub sends Anthropic the seat words, the two names, your answers, and the public information a projection gathers. fovub keeps each projection's usage and cost under your account's identifier.
- Google Cloud hosts fovub in its us-west1 region in Oregon, which holds the database, the run archives, the report PDFs, the documents projections fetch, and the database backups.
- Stripe processes every payment.
- Postmark carries Palo Alto Data Group's alert emails to its operator, which list new accounts and seat searches made without sign-in. Palo Alto Data Group learns of each new account from these emails and may email the account a one-use demo code, which fovub keeps as a hash with the account it was made for.
How long fovub keeps data. fovub keeps accounts, balance entries, projections, answers, run archives, report PDFs, and the documents projections fetch with no end date. It deletes each database backup 30 days after the backup is made, and Google Cloud holds a deleted backup 7 more days before it is gone. A sign-in cookie lasts 30 days, a sign-in attempt ten minutes, an app's connection request 15 minutes, a one-use code ten minutes, an access token one hour, and a refresh token 30 days.
Deleting your data. The Delete my data button, beside Sign out on fovub.com, removes your email address, your name, and Google's identifier from your account. It also deletes your sign-in entries, signs you out everywhere, and disconnects every app. The account stays as an identifier marked deleted, with the date of deletion. Your balance entries, payments, projections, answers, run archives, and report PDFs stay with that identifier, and the two names and the answers in each projection stay as you entered them. A balance left on the account can no longer be spent. fovub keeps a keyed hash of Google's identifier, so a new account opened with the same Google account receives no new-account credit. Database backups made before the deletion keep the earlier copy for up to 37 days: fovub deletes each backup 30 days after it was made, and Google Cloud holds a deleted backup 7 more days. Alert emails sent before the deletion stay in Palo Alto Data Group's mailbox, and Stripe keeps its own payment records.
Security. Every fovub page and the MCP endpoint use HTTPS. The MCP endpoint refuses requests from any web origin other than fovub.com, claude.ai, and claude.com. fovub's database keeps only SHA-256 hashes of sign-in cookies, codes, and tokens, and an scrypt hash of a fovub password. A code or refresh token presented a second time ends that app's connection.
Contact. Write to information@paloaltodatagroup.com with any question about your data.
fovub, brought to you by Palo Alto Data Group. Documentation.