Privacy Policy
What EconDash collects on the website, API and MCP server, why, who receives it, and how long we keep it
Privacy Policy
Last updated: October 31, 2026
EconDash ("we", "our", "us") runs the website econdash.org, the data API at econdash.org/api/v1, and the MCP server at mcp.econdash.org used by AI assistants such as ChatGPT, Claude, Grok and Gemini. This policy explains what data each of them collects, why, who receives it, how long we keep it, and what you can do about it.
You can read and query our economic data without an account. Most visitors never give us any personal data except the technical data every web request carries.
1. What we collect
Technical request data (everyone). Every request to the website, the API or the MCP server reaches our server with your IP address, the time, the requested URL, and the User-Agent and other HTTP headers your browser or client sends. We use them to serve the request, enforce free-tier and rate limits, block abusive bots, and investigate errors.
Website analytics. We run Umami on our own server. It uses no cookies and does not store your IP address. It records the page you open, the referring site, browser, operating system, device type, screen size, language, the country, region and city derived from the IP at the moment of the visit, and a few events such as how far you scroll an article. Nothing is shared with advertising or analytics companies.
Account data (only if you sign in). Sign-in goes through Dynamic.xyz. We store your email address, your wallet address(es), and the user identifier Dynamic assigns. If you sign in with Google, GitHub or Discord, Dynamic receives the profile data that provider shares, and we store only the email and identifier above. We also store your saved charts, API keys (hashed), and subscription status.
Subscription payments. Crypto subscriptions are processed by NOWPayments. We store the invoice ID, amount, currency, payment status and transaction hash. We never receive card numbers, bank details or private keys.
API key usage. For each API key we keep a monthly request count to apply your quota.
Agent payments (x402 and MPP). When an agent pays per call, we record the payer wallet address, the transaction reference, the amount, the endpoint, the time and the client IP. Wallet addresses and transactions are public on the blockchain by nature. We keep this record to prove delivery, prevent a payment from being used twice, and reconcile income.
MCP server. When you ask an AI assistant a question and it calls our MCP server, we receive only the tool name and its arguments: an indicator name, country codes, a year, or a search word. We never receive your conversation, your name or your account with the AI platform. Our MCP log records the tool, these arguments, whether the call succeeded, how long it took, whether the request came from a known AI platform's servers, and which client application made it (for example ChatGPT, Claude or Cursor), as named by the client and its User-Agent. It does not record IP addresses. From the same log we keep daily totals of calls by tool, client application and result, with the indicators and countries asked for; the totals contain no IP addresses and no search words. The request itself still carries the technical data described above, usually the IP address of the AI platform, not yours.
Signing in from an AI assistant. One MCP tool, the full history of a series, needs your EconDash account. If you connect it, you sign in on econdash.org as on the site, and we store a token that links that assistant to your account: only a one-way hash of it, with the account, the assistant's client identifier and an expiry date. The AI platform gets the token, never your password or login. If the assistant asks for it (ChatGPT does), it also gets an identifier of your EconDash account and the email address of the account, with whether that address was verified at sign-in. The consent page says so before you allow. ChatGPT uses the email so that a company workspace can allow only work addresses. The MCP log then records whether the call came from a signed-in account and whether that account has full access, not who you are.
Site chat. If you use the chat assistant on econdash.org, your messages are sent to OpenRouter to generate the answer. We do not store chat messages.
Support email. If you write to us, we keep the email thread to help you.
Browser storage. Your language, theme and some interface choices are stored in your browser's localStorage and never sent to us.
2. Why we use it
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Serve pages, API and MCP responses | Technical request data, tool arguments | Legitimate interest in running the service |
| Free-tier limits, rate limits, bot and abuse protection | IP address, User-Agent, request counts | Legitimate interest in security and fair use |
| Understand which pages and tools are useful | Umami analytics, MCP log | Legitimate interest in improving the service |
| Sign-in, saved charts, API keys | Account data | Contract with you |
| Subscriptions and per-call payments | Payment records | Contract with you; legal obligation for financial records |
| Answer your questions | Support email | Contract or legitimate interest |
We do not sell your data, use it for advertising, or build profiles of individual users.
3. Who receives it
| Recipient | What it processes | Why |
|---|---|---|
| Dynamic.xyz | Email, wallet addresses, login sessions | Sign-in and embedded wallets |
| NOWPayments | Invoice, amount, currency, wallet address | Crypto subscription payments |
| Payment facilitator (xpay.sh) and blockchain networks (Base, Tempo, Solana, via RPC providers) | Signed payment, payer wallet, amount | Verifying and settling per-call payments |
| OpenRouter | Chat messages you type on our site | Generating chat answers |
| Our email provider | Support emails | Receiving and answering mail |
| Our server hosting provider | All data above, stored on our rented server | Hosting |
Each of them handles data under its own privacy policy. Some of them are outside the European Economic Area. AI platforms that call our MCP server (OpenAI, Anthropic, xAI, Google and others) handle your conversation under their own policies; we only see the tool calls described in section 1. If you sign in to EconDash from an assistant that asks for it, that platform also receives your account identifier and email address, as described in section 1.
4. How long we keep it
| Data | Kept for |
|---|---|
| Web server logs (IP, URL, User-Agent) | 14 days |
| Application logs, including the MCP log | Up to 90 days |
| Free-tier and rate-limit counters by IP | 2 days |
| Sign-in tokens of AI assistants | Until they expire: an hour, renewable for up to 30 days |
| Per-call payment log (wallet, transaction, IP) | About 14 weeks; payment records needed for accounting are kept as the law requires |
| Subscription payment records | As long as the law requires for financial records |
| Account data, saved charts, API keys, monthly usage counts | While your account exists |
| Umami analytics (no IP addresses) | While the service runs |
| Support emails | Up to 2 years |
5. Security
All traffic uses HTTPS. API keys are stored hashed, so we cannot show a key again after it is created. Sign-in tokens and payment notifications are verified on the server. Access to the server and its secrets is restricted.
6. Cookies
We set no advertising or analytics cookies. Dynamic.xyz sets the cookies and storage it needs to keep you signed in. Umami works without cookies.
7. Your rights and choices
You can ask us to:
- show you the personal data we hold about you;
- correct it;
- delete your account and personal data;
- export it in a machine-readable format;
- stop processing based on our legitimate interest, where the law allows.
Write to support@econdash.org from the email linked to your account, or include the wallet address or API key prefix it concerns. We answer within 30 days. You can also complain to your local data protection authority.
You can use the site, the API's free tier and the MCP server without an account. You can block Umami with any content blocker; the site works the same. To stop an AI assistant from calling EconDash, disconnect the EconDash connector or app in that assistant's settings.
We cannot delete transactions from a blockchain; they are public and permanent.
8. Children
EconDash is not intended for anyone under 16. We do not knowingly collect personal data from children.
9. Changes
We will update this page when our practices change and change the date at the top. If you have an account, we will email you about material changes.
10. Contact
- Email: support@econdash.org
- Website: econdash.org