Privacy Policy
Last Updated: November 1, 2026
Implementation Accuracy Disclosure
This Privacy Policy precisely documents how falheim handles developer credentials, application targets, and test execution artifacts across our actual infrastructure stack: Supabase (PostgreSQL), Vercel hosting, and ephemeral headless test workers.
1. Overview & Architecture
falheim ("falheim", "we", "us") provides autonomous software testing infrastructure through the Model Context Protocol (MCP). Unlike traditional SaaS platforms with bloated web analytics portals, falheim operates on a MCP-First, Zero-Dashboard philosophy: developers interact with falheim directly through AI assistants (such as Claude Code) via secure HTTP/SSE endpoints.
This policy explains what information we collect, how it is processed by our testing engines, and our data retention standards.
2. Information We Collect and Process
A. Account & Authentication Data
When you create an account or generate MCP access credentials, we store your email address and cryptographic hashes of your API tokens in Supabase (PostgreSQL). We never store plaintext API tokens in our persistent databases after initial generation.
B. Target Application Parameters
When your AI assistant dispatches a test run (e.g. via start_test_run), falheim receives:
- Target domain or base URL (e.g.
https://staging.example.com); - Specified test categories (Browser, API, Auth, Logic, Accessibility, Performance);
- Optional test credentials or mock authentication tokens supplied by the developer for authenticated journeys.
C. Execution Traces & Finding Reports
During test execution, our automated engines generate:
- Console logs, network status codes, and HTTP timing metrics;
- Structured finding descriptions and reproduction steps;
- DOM mutation snapshots and temporary screenshot artifacts taken upon assertion failure.
3. Third-Party Infrastructure & Service Providers
falheim relies on established infrastructure partners to deliver the Service. We do not maintain unverified self-hosted edge servers:
Supabase
Managed PostgreSQL database with Row Level Security (RLS) for storing accounts, token hashes, and structured test metadata.
Vercel
Global serverless hosting provider serving our Next.js web application and streamable MCP HTTP endpoints.
AI Inference Engine (Optional)
Autonomous inference engine for synthesizing raw test assertion logs into structured reproduction steps. Customer logs are not used to train models.
Google Analytics
Aggregated website traffic analysis (Measurement ID: G-YYHE2M2J5K). Subject to explicit user cookie consent.
Google Analytics & Cookies Disclosure
Analytics Configuration & User Consent
falheim utilizes Google tag (gtag.js) and Google Analytics 4 under Measurement ID G-YYHE2M2J5K to collect aggregated, pseudo-anonymized telemetry on website visits, documentation engagement, and error frequencies.
A. What Google Analytics Collects
When analytical cookies are enabled, Google Analytics sets first-party cookies (such as _ga and _ga_YYHE2M2J5K) to capture:
- Pages visited, navigation sequence, and time spent on each section;
- Device specifications, operating system version, browser user agent, and screen resolution;
- Referral URLs and campaign parameters;
- Anonymized IP addresses (IP masking is applied by default in GA4).
B. What is NEVER Sent to Google Analytics
We enforce strict data boundaries between our public marketing pages and the autonomous testing engine:
- No API Credentials: Your falheim tokens (
fal_live_...) and Supabase session tokens are never shared with or logged in Google Analytics; - No Target Endpoints or Test Data: URLs tested by your AI assistant, test findings, logs, and assertion reports are handled strictly through MCP endpoints and are excluded from Google Analytics;
- No Personally Identifiable Information (PII): Passwords, payment data, and sensitive parameters are never tracked.
C. Consent Management & Opt-Out
Upon visiting falheim, a cookie consent pop-up appears allowing you to Accept Analytics or Decline. If you decline, Google Analytics tracking is disabled (window['ga-disable-G-YYHE2M2J5K'] = true), and no analytics cookies are stored.
You may also permanently disable Google Analytics across all websites by installing the official Google Analytics Opt-out Browser Add-on.
4. Data Retention & Deletion
Ephemeral Execution Workers: All headless browser processes (Chromium, Firefox, WebKit) run in isolated container environments. These environments are completely destroyed upon completion of each test run, terminating all volatile RAM, cookies, and local session caches.
Test Metadata & Logs: Structured findings, run logs, and execution histories are retained in your Supabase project partition. You have the right to request deletion of historical test runs or account data at any time by contacting medisummarize@gmail.com.
Token Revocation: When you revoke an API token via the /connect interface, it is marked as revoked immediately and rejected across all subsequent MCP requests.
5. How We Protect Your Data
- All network communication with falheim MCP endpoints is encrypted in transit using TLS 1.3;
- Target URL validation with strict SSRF (Server-Side Request Forgery) safeguards prevents test workers from probing unauthorized cloud metadata endpoints;
- Persistent databases utilize encryption at rest (AES-256);
- We strictly restrict administrative access to production systems using multi-factor authentication and role-based access control.
6. Your Rights & Regulatory Inquiries
Depending on your jurisdiction (such as GDPR in the European Union or CCPA in California), you may have statutory rights to access, rectify, or erase personal data held by falheim.
To exercise these rights, please email your request to medisummarize@gmail.com. We respond to all verified requests within standard statutory timelines.
7. Contact Us
If you have questions, comments, or concerns regarding our privacy practices, please contact our Data Protection Officer at: