What we store, and what we don’t

Who we are

Junkt is a hosted key/value store for AI agents, operated from junkt.io by SlashEquip OÜ, which is the data controller for everything described on this page.

SlashEquip OÜ
Sepapaja tn 6
15551 Tallinn
Harjumaa
Estonia Registry code 14800572 · VAT EE102190384

For anything here, including a request to see or delete your data, write to support@junkt.io.

What we collect

Your account

• Your name and email address, so you can log in and we can contact you.
• A hashed password. We never store the password itself and cannot recover it.
• If you use them: passkey credentials and two-factor settings, including recovery codes.
• Standard timestamps for when the account was created and last changed.

Your keys

• The keys you or your agents create, their values, their type, their size, and when they were created, last updated and due to expire.
• Every key is scoped to one account at the database query layer. No other account can list, read or write your keys.
• We do not read your values as a matter of course, and stored values are never written to application logs. We can technically access them, because they are stored in a database we operate — but we do not, other than where we genuinely have to in order to fix a fault you have reported.

Your activity

• A log of successful writes, increments and deletes: the action, the key, whether it came from an MCP client or the web dashboard, and when. Values are not recorded in the activity log.
• Reads are not logged at all.
• Activity older than 30 days is deleted automatically.

Your connectors

• OAuth clients and access tokens issued to MCP clients you have approved, and when you approved them.

Website analytics

We use Fathom Analytics on the marketing pages. Fathom does not use cookies, does not fingerprint visitors and does not collect personal data, which is why there is no cookie banner on this site. It tells us how many people visited a page, not who they were.

Server logs

Ordinary web server and application logs, which include IP addresses and request paths, are kept for a short period for security and debugging. Stored values never appear in them.

Why we hold it

To run the service you signed up for: authenticating you, storing the state you asked us to store, showing you what your agents did with it, enforcing the account limits, and keeping the whole thing secure. We do not use your data to train models, we do not profile you, and we do not sell or rent anything to anyone.

Who else sees it

No third party receives your keys or values. The suppliers involved in running Junkt are limited to our hosting provider, which stores the database, and Fathom Analytics, which sees marketing page views. We disclose data to anyone else only where the law requires it.

Approving a connector gives that MCP client — and the model behind it — the ability to read and write your keys. That is the entire point of the product, but it is worth stating plainly: whatever you connect can see everything in your keyspace.

Where it is stored

Junkt runs on servers in New York, in the United States. Your account, your keys and your activity history all live there, in a single region.

SlashEquip OÜ is an Estonian company, so if you are in the EU, the EEA or the UK your data is transferred outside it to be stored. We use a hosting provider that offers a data processing agreement covering that transfer. If you would like the detail of the arrangement, ask us and we will send it.

How long we keep it

• Keys — until you or your agent deletes them, or their TTL elapses. Expired keys are removed by an hourly job.
• Activity — 30 days.
• Account data — until you delete your account.

Your rights

You can see everything we hold about your keyspace from your dashboard, and you can delete your account from your profile settings, which removes your account, your keys and your activity history.

Because we are an EU company the GDPR applies, so you can also ask for a copy of your data, have it corrected, restrict or object to how we use it, ask us to delete it, and complain to a data protection authority. Email us and we will help rather than making you fill in a form.

Security

• The site is served over HTTPS.
• Passwords are hashed. Passkeys and two-factor authentication are both available.
• Access is granted by OAuth 2.1 with PKCE, and every token maps to a single account.
• You can revoke any connector from your dashboard, and it stops working on its next call.

No service is perfectly secure. Junkt is designed for small operational state — a timestamp, a flag, a counter — and we would gently suggest it is the wrong place for secrets, credentials or personal data about other people.

Changes

If this page changes in a way that matters, we will say so on the changelog and update the date at the top.