Privacy Policy

1. Scope of This Policy

This Privacy Policy describes how Contradiction MCP (“we”, “us”, or “our project”) handles data through the Contradiction MCP server software, documentation, and the project website hosted at this domain. As an open-source tool distributed under the MIT license, Contradiction is designed to prioritize data sovereignty and minimal telemetry.

When you run Contradiction MCP on your device or server, the application processes data locally:

• Source Code & Documents: Files parsed via connectors (GitHub repositories, Markdown files, PDFs, CSVs, YAML, JSON) are read directly by your local process. Extracted claims and contradiction graphs are stored in a local SQLite file (defaulting to data/contradiction.db).
• Zero Central Transmission: The MCP server does not send your documents, code snippets, claim comparisons, or audit logs to any remote servers operated by the Contradiction maintainers.
• Immutable Local Audit Logs: Audit history, review decisions, and resolution timestamps remain strictly in your local database under your control.

If you configure connectors that require authentication (such as a GitHub Personal Access Token via GITHUB_TOKEN):

• • Tokens are loaded exclusively from your local environment or client configuration.
• • Tokens are sent directly from your runtime to the respective API endpoint (e.g., api.github.com) over encrypted TLS.
• • Tokens are never logged, proxied, or transmitted to any third party by Contradiction MCP.

Contradiction implements the standard Model Context Protocol. When an AI client (such as Claude Desktop, Cursor, or Antigravity) queries Contradiction tools or resources:

Communications take place across local standard input/output (stdio) or your configured streamable HTTP endpoint. Any prompts or claim summaries forwarded by your AI client to an LLM provider (Anthropic, OpenAI, Google, etc.) are subject to your direct agreement and privacy policy with that model provider.

5. Website Telemetry & Cookies

Our public website is hosted on high-performance static infrastructure (Vercel).

• • No Invasive Cookies: We do not use third-party advertising cookies or cross-site tracking trackers.
• • Privacy-Preserving Analytics: We may use aggregate, privacy-focused analytics (such as Vercel Web Analytics) to monitor page performance, visitor counts, and referring sites without capturing personally identifiable information (PII) or storing persistent device fingerprints.
• • Do Not Track: Our website respects Do Not Track (DNT) and Global Privacy Control (GPC) browser signals.

6. Data Retention & Erasure

Because all server data is stored in your local SQLite file, you have unrestricted control over retention and deletion:

• • You can purge individual claims, sources, or contradictions at any time using MCP tools.
• • Deleting the SQLite database file permanently destroys all extracted claims, source references, and audit logs. No remnants exist on any remote server.

7. Your Rights (GDPR, CCPA/CPRA, and Global Laws)

Applicable privacy legislation (including the EU GDPR and California Consumer Privacy Act) grants individuals rights regarding access, portability, and erasure of personal information. Because the Contradiction project does not collect or centralize your operational or personal data, you exercise full autonomy directly over your self-hosted instance.

8. Security Disclosures & Contact

We take security seriously. If you discover a potential vulnerability or have questions regarding our privacy practices, please consult our Security Policy or open a security advisory on GitHub .