# Transparency note — what the Fluxx Open Exchange collects

There are no accounts, no cookies, no API keys and no per-user state, so there is no identity here to harvest — this is an architectural fact, not a policy.

**We log every request and every tool call, including the values you send.** Method, route, HTTP status, latency; the MCP tool, prompt or resource name; the arguments of the call — the EIN, the organization name, the opportunity id, the search text — with long strings truncated; the number of records returned, whether the call was answered and, for a call that failed, the error code it returned; the client software name and version an MCP client declares when it connects; interactions with the landing page (which snippet was copied, which link was followed); and a random per-request id. We log the values because the only way to improve a public register service is to know which records people ask for and which questions come back empty — and key names alone cannot tell us that.

**Treat a query as public.** Arguments are recorded, so do not put personal information about yourself or anyone else into one. Every question this service answers is a question about a public register.

**Requests are grouped by an opaque token, not by you.** So that a sequence of calls can be read as one conversation, each request carries a token derived from the caller by a keyed hash. The key is random, lives only in the memory of the server process, is never written anywhere, and is replaced on a timer (60 minutes). The token therefore cannot be turned back into an address — by us or by anyone who obtains the logs — and cannot be joined across time windows or across server instances. It says "these calls arrived together" and nothing else.

**Fluxx's own clients are labelled.** A request from one of Fluxx's own servers or staff tools carries the name of that client: the id of the client key a Fluxx server sends in a header, or a label for a connection made through a connector URL Fluxx gives its own staff (Fluxx's claude.ai connector, for example). That is how Fluxx counts its own use apart from everyone else's. Only the name is recorded, never a key. The connector URL holds no key, and a label unlocks nothing. Requests from anyone else carry no name.

**The application does not retain:** client IP addresses (used only in memory for the fair-use limiter and discarded), user agents, referrers, cookies, or anything that names the person or organization asking.

**Google Cloud's request logs do record IPs.** The service runs on Cloud Run behind Google Cloud's load balancer and Cloud Armor. The load balancer and Cloud Run each keep a standard request log with the client IP, the full request URL and the user agent, so a lookup such as /organizations/{ein} is logged with the address that made it. Fluxx uses these logs only to operate the service and act on abuse.

**Where it goes and for how long.** These request logs and the application's events are kept in Google Cloud Logging for 12 months. Both are also forwarded to Datadog, our monitoring provider, which processes them on Fluxx's behalf. Application events are exported to a private Fluxx BigQuery dataset, readable only by Fluxx staff who operate the service, and deleted automatically after 400 days. The events are used to run and improve the Exchange. None of these logs is sold, and the events are never used to profile a person — there is no person in them to profile.

**Data-issue reports** you submit through report_data_issue are recorded for review with the text you provide, and logged like any other call. Do not include personal data in them.

**The data served** is drawn from public registers (IRS, Grants.gov, state grant portals, the Federal Audit Clearinghouse, community foundation websites). People appear only as officers and directors named on public filings — name and title, never compensation or contact details. The publisher, legal basis, terms and review status of every source are published at https://open.fluxx.io/sources/register.

The Exchange is offered as-is, with no support channel; report a wrong record with report_data_issue. This note is versioned with the code at https://open.fluxx.io/version and is intended to match it exactly.