Exotool Privacy Policy

Last updated: Oct 15, 2026

1. Who we are and what this Policy covers

a. Exotool, LLC, a Delaware limited liability company (“Exotool”, “we” and its derivatives), is the controller of the personal data described in this Privacy Policy (the “Policy”), except where Section 2(f) says otherwise. Our address is 28 Old Rudnick Lane, Dover, Delaware 19901, and our e-mail address for privacy matters is info@exotool.com.

b. This Policy describes what information we collect, how we use and share it, how long we keep it, and the choices and rights you have. It covers our website at https://www.exotool.com (the “Site”); the Exotool platform, that is the editor, the compiler and the hosting of the applications built with it (the “Platform”); the applications and previews built by our users and hosted by us (“Exotool Sites”); the connector that lets an AI assistant act on an Exotool account (the “MCP server”, Section 6); and the e-mails we send.

c. This Policy is incorporated by reference into the Exotool Terms of Service (the “Terms”), which define some of the words used here. A “Direct User” is a person who has an Exotool account (an “Account”) and builds Exotool Sites. An “End User” is a person who uses an Exotool Site, or visits the Site, without an Account. “Personal Data” is information that identifies you or can reasonably be linked to you, such as a name, an e-mail address or an IP address.

d. When you create an Account you check a box to say that you agree to the Terms and to this Policy, and we record when you did. If you do not agree, do not create an Account or use the Platform.

2. The information we collect

a. Account information. To create an Account you give us an e-mail address and choose a password. We store the password only in hashed form; nobody at Exotool can read it. We record the date of sign-up and the plan you are on. If you sign in to the MCP server through our sign-in service (Section 6), that service holds your e-mail address and the password hash as well.

b. Your content. Everything you make or upload on the Platform is stored with your Account: the designs, pages, code and settings of your projects, the images and files you upload, the compiled applications and their previews, and backups of your designs. The Terms call this “Direct User Content”. If you configure a resource for one of your projects, such as a database, a mail account, a payment account or a web server, the credentials you enter are stored encrypted and are used only to make your Exotool Sites work.

c. Payment information. Paid plans are billed through our billing provider, Recurly, which uses Stripe to process cards. Your card details are entered on Recurly's forms and go directly to Recurly and Stripe; Exotool never receives or stores a card number. We keep the account identifier that Recurly assigns to you, your plan, its status and your invoice history, so that we can run your Account and answer billing questions.

d. What you send us. When you write to us through the Site's contact, sales, developer or mailing-list forms, or by e-mail, we receive what you send: typically your name, your e-mail address and your message. The forms are protected by Google reCAPTCHA, which means Google receives the technical data described in Section 2(e) for that page. The form content is delivered to our mailbox and kept there.

e. Information collected automatically. Like every web service we keep logs of the requests made to our servers: the IP address, the date and time, the page or service requested, the response, and the browser's self-description. The Platform also keeps an activity record of each sign-in, each save of a project, each deployment and each call made through the MCP server: which Account, when, which project, and in the case of the MCP server which tool was used. Our mail provider records when an e-mail we sent was delivered, bounced or marked as spam. We do not use advertising or analytics trackers, fingerprinting or pixel tags, and we do not follow you across other websites. The cookies we use are listed in Section 7.

f. Information in your Exotool Sites. Each Exotool Site is built by a Direct User, who decides what information it asks of its End Users and what it does with it. That information, which the Terms call “End User Personal Data”, is stored on our infrastructure in the Direct User's cloud objects and cloud sets, but the Direct User is its controller and we are its processor: we handle it only to run the Exotool Site, on the Direct User's instructions, under the commitments in Section 5(f) of the Terms. If you are an End User and have a question about an Exotool Site, please contact the person or organization that operates it. If you contact us instead, we will help you reach them.

g. What we do not collect. We do not ask for or knowingly collect sensitive Personal Data about you, such as health, religion, political opinions or government identifiers, and we ask you not to send it to us. We do not buy information about you from others, and we do not draw inferences about you for profiling. We do not use any of your information to train artificial-intelligence models, and we do not allow others to do so.

h. What you must give us. An e-mail address and a password are needed to have an Account; without them we cannot provide the Platform. Everything else you give us is your choice, except the payment details a paid plan needs. We make no decision about you by automated means that has a legal or similarly significant effect.

i. In the terms of the U.S. state privacy laws, the categories of Personal Data we have collected in the past twelve months are identifiers (e-mail address, Account name, IP address), commercial information (plan and payment history), internet activity (the logs and activity record of Section 2(e)), and the content you create (Section 2(b)). We collected them from you and from your use of the Platform, for the purposes in Section 3, and disclosed them only to the service providers in Section 5(a).

3. How we use the information

a. To provide the Platform: to create and secure your Account, to recognize you when you sign in, to store, compile and host your projects and Exotool Sites, to keep the backups that let you undo a change, and to deliver the e-mail your Exotool Sites send.

b. To bill you, when you are on a paid plan, and to keep the records that tax and accounting law require.

c. To support you: to answer the messages you send us and to look into a problem you report, which may mean looking at the project concerned.

d. To keep the service safe and fair: to detect and stop abuse, to enforce the quotas of the free and paid plans, to investigate security incidents, and to enforce the Terms, including the Acceptable Use Policy.

e. To tell you about your Account: welcome messages, security notices, changes to the Terms or to this Policy, and notices about your plan or your payments. These are not marketing and you cannot opt out of them while you have an Account.

f. To send you news about Exotool, only if you have asked for it by joining our mailing list. Every such message tells you how to stop receiving them.

g. To produce Usage Information, as the Terms call it: statistics about how the Platform is used that do not identify anyone, which we use to run and improve the Platform.

h. To comply with the law and to protect our rights, as described in Section 5(e) of the Terms.

4. Our legal bases

Where the law of the European Economic Area, the United Kingdom or Switzerland applies, we rely on the following bases. Performance of our contract with you, for Sections 3(a), 3(b), 3(c) and 3(e). Our legitimate interests in running a secure and reliable service, for Sections 3(d) and 3(g), and in understanding how the Platform is used. Your consent, for Section 3(f) and for anything else we ask your permission for; you may withdraw it at any time. Our legal obligations, for Section 3(h) and for the records in Section 3(b).

5. How we share the information

a. Service providers. We use a small number of companies to run Exotool. They act on our instructions, may use the information only to provide their service to us, and are bound by contract to protect it. They are:

Amazon Web Services, Inc., which hosts the Site, the Platform and the Exotool Sites in its US West (Oregon) region, runs the sign-in service used by the MCP server (Amazon Cognito), and delivers the e-mail we and your Exotool Sites send (Amazon SES).
Recurly, Inc., our billing provider, and Stripe, Inc., which processes card payments for Recurly. Their own privacy policies govern what they do with your payment details.
Google LLC, whose reCAPTCHA service protects our forms and whose font service supplies the Site's typefaces. Both load from Google's servers, so Google receives your IP address and browser details when such a page loads and may use them under its own privacy policy, including to recognize your browser across the sites that use these services. We do not receive anything from Google about you except whether the form check passed.

b. At your direction. When you connect an AI assistant to your Account through the MCP server, the results of the requests it makes on your behalf are sent to that assistant and so to its provider (Section 6). When you configure a resource for a project, your Exotool Site talks to that database, mail, payment or web-server provider as you have set it up. When you publish an Exotool Site, whatever it shows is visible to its users.

c. Legal requirements. We may disclose information if we believe in good faith that the law requires it, or that it is reasonably necessary to comply with legal process, to enforce the Terms, to respond to a claim that content infringes someone's rights, or to protect the rights, property or safety of Exotool, our users or the public.

d. Business transfers. If Exotool is involved in a merger, acquisition, financing, reorganization or sale of assets, your information may be transferred as part of that transaction, under this Policy or a policy at least as protective, and we will tell you before another policy applies to you.

e. We do not sell your Personal Data, we do not share it for cross-context behavioral advertising, and we do not give it to anyone else for their own purposes. In particular we do not disclose Personal Data to third parties for their direct marketing, so there is nothing to report under California's “Shine the Light” law.

6. The Exotool MCP server for AI assistants

a. What it is. Exotool offers a connector (an “MCP server”) that lets an AI assistant such as Anthropic's Claude act on your Account at your request: read and change your projects, check and compile them, and upload files into them. You connect it yourself, in the assistant's settings, and you can disconnect it at any time. The connector is listed in Claude's connector directory and can also be added by its address.

b. What it can reach. When connected, the assistant can reach what your own Account reaches: your projects (their designs, settings, compiled previews and uploaded files), the names and kinds of the resources you have set up (never their credentials), the presets of your projects, and Exotool's reference documentation. It cannot create or change a resource, delete a project, or read another user's data. The sample projects we provide can be read and copied, not changed.

c. Sign-in. Connecting uses Exotool's sign-in service. You enter your password on that service, not in the assistant and not on a page the assistant can read. The assistant receives a token that identifies you to Exotool for this purpose. You end it by disconnecting in the assistant or, for a token made on the editor's MCP Tokens page, by revoking it there.

d. What goes to the assistant. The result of each request is sent to the assistant, and so to the assistant's provider: for example the design of a project it asked for, the errors of a compilation, or the address of a preview. What the provider does with it is governed by its own terms and privacy policy, not by this Policy. Exotool receives only the requests the assistant makes on your behalf and the content you ask it to upload. Exotool does not receive, store or use the rest of your conversation with the assistant.

e. Files given by link. When you give the assistant a download link for a file to upload, Exotool's server fetches that address itself, so the host of the file sees a request from Exotool rather than from you. Only direct download links are accepted, from the services named in the Help Center, and the file is treated like any other upload to your project.

f. What we record. As for the editor, we record which Account made each call, when, for which project and with which tool, and we keep the ordinary web-server logs of each request (Section 2(e)). Before each save made through the connector we back up the design it replaces; the newest four backups of a project are kept. Beyond carrying out your requests and keeping these records, nothing that passes through the connector is kept or used: not to improve the service, not to train any model, and not for any other purpose.

g. Where to read more. The Help Center at https://www.exotool.com/help/mcp/ describes the connector, each of its tools and its limits.

7. Cookies

a. We use only the cookies the Platform needs to work, and none for advertising or analytics:

A session cookie on the Site, set by the web server, which expires when you close your browser.
The editor's session identifier, which keeps you signed in to the editor and expires after 24 hours without activity or when you sign out.
The cookies of our sign-in service (Amazon Cognito) while you sign in to the MCP server.
Cookies set by Recurly on its own billing forms, under its own policy.

b. An Exotool Site may set cookies of its own, as its Direct User has built it. Those are the Direct User's cookies, described in that Exotool Site's own privacy policy.

c. You can delete or block cookies in your browser's settings. The Site can be read without cookies; the editor and the billing forms cannot work without them.

d. Because we do not track you across sites or sell your information, there is nothing for a “Do Not Track” or Global Privacy Control signal to switch off; we honor the opt-out they express by not doing those things in the first place.

8. How long we keep information

a. Account information and your content: for as long as your Account exists. When your Account is closed, by you or by us, we keep your content in an archive for one year, as Section 10(e) of the Terms says, and then delete it, unless the law requires us to keep it longer.

b. Backups of a project's design: the newest four, replaced as you save. Backups of our databases, which also hold the data of your Exotool Sites: seven days.

c. Web-server logs and the logs of the Platform's services: 30 days. Server start-up logs: 14 days. E-mail delivery records: 90 days. The activity record of sign-ins, saves, deployments and MCP calls: while your Account exists and no longer than one year after it closes.

d. Billing records: for as long as tax and accounting law require, normally seven years.

e. Messages you send us: for as long as we need them to deal with your request and for a reasonable time afterwards.

9. Security

a. We protect the Platform with industry-standard technical and organizational measures, as Section 4(b) of the Terms promises. Connections to the Site, the editor, the MCP server and Exotool Sites are encrypted in transit. Passwords are stored hashed, resource credentials are stored encrypted, and the servers that run your Exotool Sites are isolated from one another and from the editor. Access to production systems is limited to the people who operate them.

b. No system is perfectly secure. If we learn of a breach that affects your Personal Data, we will notify you by e-mail, or by a notice on the Site or in the editor, without undue delay and within the time the applicable law sets (60 days under Delaware law, 72 hours to the supervisory authority under the GDPR where it applies). If you think your Account has been compromised, write to info@exotool.com at once.

10. International transfers

a. Exotool is in the United States and the Platform is hosted there. If you use it from elsewhere, your information is transferred to and processed in the United States, whose privacy laws may differ from those of your country.

b. Where the law of the European Economic Area, the United Kingdom or Switzerland applies, we rely on the European Commission's standard contractual clauses and their UK and Swiss equivalents for these transfers, with our service providers bound by the same. You can ask us for a copy of the clauses at info@exotool.com. Exotool does not participate in the EU-U.S. Data Privacy Framework.

11. Your rights and choices

a. You may ask us to tell you what Personal Data we hold about you, to correct it, to give you a copy in a usable form, to delete it, to restrict or object to a use of it, or to withdraw a consent you gave us. Residents of California and other U.S. states with privacy laws have the corresponding rights under those laws, including the right not to be discriminated against for exercising them. Since we do not sell or share Personal Data for advertising, there is nothing to opt out of in that respect.

b. You can change your e-mail address and password yourself in the editor. To close your Account, or to exercise any of the rights above, write to info@exotool.com from the e-mail address of your Account, or from the address you used when you wrote to us, and say what information is concerned and what you want done. We may ask you to confirm your identity. We answer within one month, or within the shorter time a law sets.

c. Closing your Account deletes your projects and takes your Exotool Sites offline, subject to the archive period in Section 8(a). If you want to keep your projects, download them before you ask.

d. You may authorize someone else to make a request for you. We will ask for proof that you did.

e. If we refuse a request, we tell you why. You may appeal by writing to info@exotool.com with “appeal” in the subject; we answer within 45 days and, where your state's law provides it, tell you how to complain to your state's Attorney General.

f. If you are in the European Economic Area, the United Kingdom or Switzerland and are not satisfied with our answer, you may complain to your data-protection authority. If you are an End User of an Exotool Site, the Direct User who operates it is responsible for your request; we will pass it on if you send it to us.

12. Children

The Platform is not for children. As the Terms say, you must be 18, or 16 with a parent's or guardian's consent, to have an Account, and we do not knowingly collect Personal Data from anyone under 16. If you believe a child has given us Personal Data, write to info@exotool.com and we will delete it.

13. Changes to this Policy

We may change this Policy as the Platform changes. We post the new version on this page with a new “Last updated” date. For a material change we also e-mail Direct Users at the address of their Account and post a notice in the editor, before the change takes effect.

14. How to contact us

Exotool, LLC
28 Old Rudnick Lane
Dover, Delaware 19901
United States
info@exotool.com