Privacy Policy

Metakip is operated by Atharva Verma, an individual operator based in India. This policy describes how information is handled when you use metakip.com, the hosted Metakip app, its API, or its connected services. It does not govern independently operated self-hosted installations.

Last updated: October 10, 2026

Information we handle

We process information needed to provide and protect the hosted service. Metakip does not ask users to provide sensitive personal information or restrict the kinds of content they can store. Users can add arbitrary content, which may include personal or sensitive information.

  • Account and sign-in information, including your name, email address, profile image when provided by your identity provider, account records, session identifiers, IP address, and browser user-agent. Google and GitHub provide sign-in for the hosted service.
  • Workspace content you create, import, upload, or share, including pages, folders, properties, files, comments, replies, page history, guest-contributor details, and sharing and permission settings.
  • Operational and usage information, including API request method and route, response status and timing, content length, errors, page visits, favorites, and API-token audit events.
  • Invitation information, including invitee email addresses, invitation status, and email delivery attempts. Invitation emails are sent using Resend.
  • Information you include in support or privacy-request emails.

How we use information

We use information to create and secure accounts; host, synchronize, display, search, and share workspace content according to your permissions; deliver invitations; operate and maintain the service; prevent abuse; diagnose errors; and respond to support and privacy requests. We do not sell personal information or share it for cross-context behavioral advertising.

When you access Metakip through a third-party client, assistant, or integration, that service sends Metakip the request you authorize and receives the information needed to fulfill it. The third party may process your prompts and the information it receives under its own terms and privacy policy. Metakip does not control those services or use workspace content to train its own AI models.

Where the GDPR or UK GDPR applies, we generally process account information and workspace content as necessary to provide the service you request (contract); operational and security information for our legitimate interests in operating and protecting Metakip; and information where processing is required by law. Where a different law applies, we use the legal grounds available under that law and provide additional notice or obtain consent where required.

Sharing and service providers

Your content is available to people you invite or share it with, according to the permissions you set. We use service providers to run the hosted service and disclose information to them only as needed for their services. We may also disclose information when required by law or when reasonably necessary to protect users, the service, or our rights.

The hosted service uses Microsoft Azure for the application and PostgreSQL database in Central India Zone 1; Cloudflare for DNS, reverse proxy/web delivery, Cloudflare Pages, and R2 object storage (bucket location: APAC); Google and GitHub for sign-in; and Resend for invitation email delivery. The Cloudflare proxy handles requests to the website, app, and MCP host. Third-party clients and assistants that you choose to connect receive the information needed to fulfill your requests, as described above.

Service providers may process information in other countries under their own service terms. See the international transfers section. We do not currently use Azure Monitor for centralized collection of application logs.

Metakip is open source and can also be self-hosted. A self-hosted installation is operated by its administrator, and that administrator is responsible for its privacy practices and infrastructure.

International transfers

The hosted database is on an Azure virtual machine in Central India Zone 1, and uploaded files are stored in a Cloudflare R2 bucket located in APAC. Cloudflare, Google, GitHub, and Resend may process information in other locations as part of the services you use. A third-party client or assistant you choose may also process information in its own systems. Where applicable law requires a transfer mechanism or additional safeguards, we will use the mechanism required by that law. We are still documenting the specific transfer safeguards for each service provider and destination.

Cookies and browser storage

The app uses authentication cookies to keep you signed in. For guest interactions, it can store a randomly generated guest identifier in a cookie for up to one year. The app and website use browser local storage for preferences such as theme, sidebar state, and page layout. The application code does not include advertising or analytics trackers. Cloudflare may process request data and may use security features according to the zone configuration.

Retention and deletion

Workspace content remains until you delete it. Items in Trash remain until restored or permanently deleted. Permanently deleted pages and folders are removed from the active database; unreferenced uploaded files are queued for deletion and failed cleanup attempts are retried. Account deletion is currently handled manually after a request to the privacy email; there is no self-service account-deletion control.

Support and privacy-request emails are retained for up to 12 months after the request is resolved, unless a longer period is needed for a legal, security, or dispute matter. API-token audit events are deleted after 90 days. Invitation email-attempt records are deleted after 25 hours, and expired or resolved invitations after 7 days. Unreferenced guest identities are eligible for deletion after 90 days of inactivity; anti-reuse tombstones are retained for 365 days.

Application logs are emitted to the VM’s local container/process logging system. Azure Monitor is not configured, and a fixed local log-retention period has not been established. Backups are not currently configured. We may retain limited information longer where necessary to meet legal obligations, resolve disputes, or protect the service.

Your choices and rights

You can edit or delete workspace content, adjust sharing permissions, and revoke API tokens through Metakip. Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information. To exercise a right or request account deletion, email us. We will respond as required by applicable law. There is no self-service account-deletion control; requests are handled manually.

Children’s privacy

Metakip is a general-purpose knowledge and collaboration service, not a service designed or marketed to children. Under the Terms, users must have reached the age of majority where they live and be able to enter a binding contract. We do not ask for or verify a user’s date of birth. If you believe someone who is not eligible has provided personal information to the hosted service, contact us so we can review and take appropriate action.

Security and policy changes

Public service traffic is protected with HTTPS/TLS. We use access controls and other safeguards intended to protect information, but no online service can guarantee absolute security. We will notify affected users or authorities when required by applicable law. This policy may change as Metakip evolves; the date above shows when it was last updated.

Contact

For privacy questions or requests, contact Atharva Verma, the individual operator of Metakip, at support@metakip.com. The operator is based in India. No public postal address is currently provided. If you are in the EEA or UK, you may also complain to your local supervisory authority.