Ottto MCP Apps - Privacy Policy

Last updated: 2026-09-22

This policy describes the data the Ottto MCP Apps for ChatGPT and Claude ("the Apps") access, why, how long it is kept, and the controls you have. It covers the Apps only. Your use of the Ottto product and website is governed by the Ottto Terms of Service; this document is the cross-host MCP Apps privacy policy, including the policy used for OpenAI App Directory review. It supplements the site-wide Ottto Privacy Policy, which covers everything else.

The Apps are read-only and strictly data-minimized. They can show you aggregated cost, usage, source-health, interactive Custom Report results, reviewed recommendation, and configured MCP context information about your own Ottto account inside a compatible assistant host. They cannot change anything in your account, and they never expose the raw content Ottto observes.

Who this applies to

The Apps are available, free, to any signed-in Ottto user who chooses to connect Ottto in a supported ChatGPT or Claude host. Connecting is entirely optional and requires an explicit OAuth consent step.

What the Apps can access

When you connect Ottto and approve the consent screen, the selected host can call a small set of read-only tools on your behalf. Those tools return aggregated, sanitized figures derived from the data already in your Ottto account:

Every figure above is computed by a mandatory minimization step (the "projector") at the Apps boundary before it is returned to the host. The same hard floor is enforced on every response.

What the Apps never share

The Apps never return, and a defense-in-depth scrub guard actively blocks:

• Raw prompts, completions, transcripts, or any model input/output content
• File paths, local filesystem locations, or working directories
• API keys, key prefixes, secrets, tokens, or passwords
• Machine names, device identifiers, or device UUIDs
• Email addresses or user/account identifiers
• Internal IDs (organization IDs, user IDs, session/trace/request IDs, payload hashes)
• Cloud credentials (e.g. AWS access keys) or JWTs

If any of these were ever to appear in a projected response, the response is blocked rather than returned - this is treated as a launch-blocking privacy regression and is monitored continuously (the guardrail target is zero such events).

How the data is accessed and authorized

• OAuth 2.1 with PKCE. Connecting an App runs a standard authorization-code flow. You sign in to Ottto and approve a consent screen that lists, in plain language, exactly which read-only scopes the host is requesting.
• Scopes are read-only and narrow. The available scopes are ottto.account.read, ottto.costs.read, ottto.sources.read, ottto.apps.read, and ottto.reports.read, ottto.custom_reports.interactive.read, and ottto.advisor.read. The existing reports scope reads saved report definitions but does not expose report contents. The separate interactive Custom Reports scope authorizes bounded aggregate results from report choices you make or review in the connected AI host, including machine and subscription display names and, when your Ottto role permits it, organization cloud billing. The host card also receives opaque filter selector IDs to present exact choices, but model-visible report results omit those IDs. No write, delete, or administrative scope can be granted to the Apps.
• Tokens are scoped, audience-bound, and revocable. Access tokens are issued only for the Apps' endpoint and expire. They can be revoked immediately (see "Your controls" below).
• Your data only. The Apps can only read data belonging to your own Ottto account, gated by your authenticated session at consent time. Interactive report choices are validated server-side against your selected organization and role. Cloud billing appears only when your role grants organization-scope access.

What is logged

Two minimal, non-content records are kept so the service can be operated and audited:

• Product analytics (aggregated): which read tool was called, the result status (ok / partial), a confidence level, a coarse error category, and tool latency. These never include account data, prompts, or identifiers beyond your Ottto user/organization association used for aggregation.
• Security audit trail: durable records of security-relevant lifecycle events - when an App was connected, each successful read, and any revocation - so a reviewer can reconstruct what a connection did. These records carry only coarse, non-sensitive fields (tool name, requested scopes, a status/confidence value, a revocation reason). They never carry a token, prompt, path, machine name, email, or raw datum.

Neither record stores the content an App returned to you or any raw observed data. Custom Report titles, rows, totals, filters, report IDs, and result payloads are not persisted in these records or in the production verifier.

Data retention

• Aggregated analytics are retained to operate and improve the service and are moved to lower-cost cold storage after 90 days.
• Security audit records are retained as the integrity trail for connections and revocations.
• MCP activity rollups retain only positive hourly call counts for eight days. They contain an internal account, agent, device, and safe server key so Ottto can answer whether a configured server was positively observed in the last seven days. The Apps return only the safe server label and aggregate count; missing evidence is reported as unavailable, never as zero use.
• The Apps introduce no new store of raw content: they read existing, already-minimized Ottto data at request time and return an aggregated answer. Retention of the underlying Ottto telemetry is governed by your Ottto account settings and the Ottto Privacy Policy, unchanged by the Apps.

Data residency

The Apps' data is processed in Ottto's existing production region (non-EU). The Apps do not introduce a separate data-residency surface; they reuse the same backend, storage, and processing as the Ottto product.

Your controls

• Consent: the Apps access nothing until you complete the OAuth consent screen and approve the specific read-only scopes shown.
• Revoke at any time: you can disconnect an App from its host, and you can revoke all Ottto connections from your Ottto account settings. Revocation takes effect immediately - outstanding tokens stop working at once.
• Token expiry: access tokens expire and must be refreshed, so access does not persist indefinitely without your continued connection.
• Account-level controls: because the Apps read only your existing Ottto data, the data-management and deletion controls in your Ottto account also govern what the Apps can ever surface.

Changes to this policy

If the Apps' data practices change - for example, if a new scope or capability is introduced - this policy will be updated before that change ships, and material changes will be reflected in the consent screen.

Contact

For privacy questions about Ottto's MCP Apps, contact hello@ottto.net.