Mechanic Bot ("Service", "we", "us") is operated by Mountain Grown Media LLC. This policy explains what data we collect, why we collect it, and what we do with it.
Short version: We collect the minimum data needed to operate the service. We don't sell your data. We don't read your bot conversations.
| Data | Why we collect it | Retention |
|---|---|---|
| Email address | To send repair alerts, account notifications, and billing receipts | While your account is active + 30 days after cancellation |
| Telegram chat ID | To send repair alerts to your personal Telegram account (if you link it) | While your account is active |
| Billing data | Managed by Stripe. We store only your Stripe Customer ID and subscription status. | As required by Stripe's retention policy |
| Repair logs | To show your repair history and help debug issues | 90 days |
| System diagnostics | CPU, memory, disk usage — collected during repairs only | Not stored long-term; used transiently during repair sessions |
| Agent audit trail | Record of all commands sent to your agent (what Mechanic did and when) | 90 days |
| Bot name / hostname | To identify your agent in dashboard and notifications | While your account is active |
| IP address | Rate limiting, abuse prevention. Not logged to permanent storage. | Session only (not persisted) |
| Analytics (if enabled) | Aggregate page analytics via GA4. No personally identifying info sent to Google. | Per Google's retention settings (26 months default) |
We do not sell, rent, or share your personal data with third parties for marketing purposes.
We host our hub server on Hetzner Cloud (Germany/Finland). Data may transit through Hetzner's infrastructure in the EU.
All agent-to-hub communication is encrypted with TLS. PTY sessions use Ed25519 signatures (the agent rejects unsigned commands). Signing keys are stored in a secrets manager, not on disk. Our hub runs on hardened Linux with fail2ban, UFW, and unattended security updates.
You have the right to:
To exercise these rights, email privacy@mechanicbot.io.
We use localStorage (not cookies) to store your session token in the dashboard. We do not use third-party tracking cookies. Analytics use anonymized identifiers only.
The Service is not directed at users under 16. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us for immediate deletion.
We may update this policy. Material changes will be communicated via email. The "Last updated" date at the top always reflects the current version.
Privacy questions: privacy@mechanicbot.io · General contact: contact form
Mountain Grown Media LLC · mechanicbot.io