Privacy Policy

Last updated: October 15, 2026

This Privacy Policy describes how Rascode ("we," "us") handles information in connection with lybra.dev, the application programming interface (API) at api.lybra.dev, and the Model Context Protocol (MCP) service at mcp.lybra.dev (the "Service").

What we collect

• Account and key metadata — such as key identifiers, plan tier, contact email associated with a key, and issuance or rotation history when we issue credentials.
• Usage and metering — request counts, timestamps, endpoint or tool names, status codes, and similar logs needed to operate quotas for API and MCP.
• Technical logs — IP address, user agent, and related request metadata for security, abuse prevention, and reliability.
• Site analytics — we do not currently load third-party advertising or behavioral tracking pixels on lybra.dev. If that changes, we will update this policy.
• Lookup payloads — content you send in API or MCP tool calls (for example, a code string or rejection snippet) is processed to return reference data. Do not send secrets or personal data you do not need to include.

Purpose

We use this information to:

• Operate and secure the Service
• Enforce quotas and plan limits
• Diagnose errors and improve documentation and reliability
• Communicate about access, billing, or security issues when needed

Sharing

We may share data with infrastructure and payment processors that help us run the Service (for example, hosting, DNS, and metering storage), under agreements that limit use to providing those services. We do not sell personal data. We may disclose information if required by law or to protect the Service and users from fraud or abuse.

Retention

We retain account, metering, and security logs for as long as needed to operate the Service, meet legal obligations, and resolve disputes. Inactive keys and associated metadata may be deleted or anonymized after a reasonable period.

Security

We use industry-standard measures appropriate to the sensitivity of the data (including transport encryption and access controls on production systems). No method of transmission or storage is perfectly secure.

Cookies

The public static site does not rely on advertising cookies. Essential cookies or local storage may be used by hosting or future account surfaces if those features ship; we will describe them here if they collect personal data beyond what is needed to deliver the page.

Your rights and requests

Depending on your location, you may have rights to access, correct, or delete personal data we hold about you, or to object to certain processing. Contact us via the channels on rascode.dev or the support path for your API plan. We may need to verify your request.

Agents and API payloads

If you or your agent send invoice text, rejection messages, or codes to the Service, that content is processed to fulfill the request. Minimize personal data in those payloads. Tool outputs are reference aids — see our Terms of Service for the no-warranty-of- results language.

Changes

We may update this policy from time to time. The date at the top will change when we do. Continued use of the Service after an update means you accept the revised policy.

Contact

Privacy questions: Rascode via rascode.dev or your plan support channel.