Your information

Privacy policy

Last updated: 1 November 2026

This policy explains how Universal MCP for Android, developed by Rupak Banerjee, handles information. Contact: rupakbanerjee@gmail.com.

Information stored on your device

The app stores server profile names, endpoint addresses, authentication settings, cached tool catalogs and app preferences. Saved credentials and OAuth tokens are encrypted using keys protected by Android Keystore. Profile metadata and ordinary activity metadata are stored in the app's private local storage; they are not all individually encrypted.

Execution history records profile identifiers, tool names, timestamps, duration and outcome. By default, history retention is 30 days with a maximum of 500 records. You can choose shorter retention and a lower record limit. Retention is enforced when the app initializes or processes history; it is not a background deletion service.

Argument and result retention is off by default. If you enable it for a profile, the app stores bounded, redacted and encrypted payloads on your device. Redaction cannot guarantee removal of every sensitive value; avoid retaining information you do not want saved.

Information sent to servers and sign-in providers

When you connect to an MCP server, the app sends protocol requests and client information to that server. When you invoke a tool, its name and supplied arguments are sent to the selected server, together with credentials required for that connection. Servers receive normal network information such as your IP address and may send your inputs to other services as part of a tool's operation.

OAuth sign-in opens your browser and communicates with the authentication provider you approve. That provider handles your sign-in information under its own policies. The app stores the resulting grant locally and sends tokens where required for the authorized connection. The developer does not operate an intermediary service for these connections.

Requests to the included Microsoft Learn example go to Microsoft when you choose to connect. Other server and authentication providers have their own privacy, security and retention practices. Review those practices before connecting.

Device authentication

The app uses Android's device authentication to unlock access. Android manages biometric or device-credential verification. The app does not receive your fingerprint, face template or device PIN.

Analytics, advertising and backups

The app has no advertising SDK, analytics SDK or automatic remote crash reporting. Local app data is excluded from Android backup and device transfer through the app's backup configuration. This does not control copies you export yourself or information stored by connected providers.

Exports and support

Information leaves the app when you explicitly copy, save or share an export. Diagnostic exports omit endpoint URLs, session identifiers, credentials, arguments and result bodies. Other exports may contain information you choose to include. Review exports before sharing them.

If you email support, the developer receives your email address and whatever information or attachments you send. These are used to respond to your request and troubleshoot issues. Support correspondence is handled through Gmail and retained as needed to resolve the request and maintain related support records. You can request deletion by email, subject to any applicable legal retention duties. Never send passwords, tokens or private tool payloads.

Deletion and your choices

You can delete saved profiles, clear history, change history retention and disable payload retention in the app. Disabling payload retention removes stored payloads for that profile. Deleting a profile removes its associated local records. You can remove the app's local data through Android's app storage controls or by uninstalling it.

Local deletion does not delete files you exported or information already received by a server, authentication provider or support mailbox. Contact those recipients separately. To revoke a server grant, use the provider's account settings. Universal MCP does not create a developer-hosted user account.

Security

The app requires HTTPS server endpoints and protects saved credentials using Android Keystore encryption. No storage or transmission system can guarantee complete security. Choose trusted servers and keep your device protected.

Changes and contact

This policy will be updated when the app's data practices change. The date above identifies the latest revision. For privacy questions or support-data deletion requests, email Rupak Banerjee at rupakbanerjee@gmail.com.