How Realy handles data.

Information and purposes

Realy processes account identifiers and authentication information to sign users in and enforce access permissions; uploaded CSV files and their table names, columns and values to provide table analysis; and questions, results and operation traces to answer requests. Hosting and authentication services may process IP addresses, request times, status codes and security diagnostics. Support messages are used to resolve requests.

Service providers and sharing

Vercel hosts the MCP service and policy website. Supabase provides authentication, database and file storage. These providers process information needed to operate and secure those services. The connected MCP client, such as ChatGPT, receives requested results and traces and handles them under its own policies.

The MCP executes structured read-only table operations supplied by the connected client. It does not call a backend model API or send table samples to a separate planning model. The connected client receives the requested results and applies its own data handling policies. Users should not upload sensitive or regulated data to this review-stage service.

Retention and deletion

Account records and uploaded CSV files are retained while the account is in use and until deletion is requested and processed. There is no automatic inactivity-deletion schedule. After verifying a deletion request, our target is to delete the requested data from active systems within 30 days. Requests are handled manually. We will explain any delay or applicable retention exception to the requester.

Support correspondence is retained for up to 90 days after the issue is closed, with manual periodic cleanup, unless it is still needed for an ongoing dispute or legal obligation.

Temporary query files are cleaned up when the query worker finishes. A timed-out request may continue until that worker finishes. Result and trace access expires after five minutes in an owner-scoped memory cache; entries are removed on subsequent cache activity or process shutdown. This is an access limit, not a guarantee of physical erasure at exactly five minutes.

Hosting and authentication logs and provider-managed backups follow the configured provider retention cycles. We do not promise a fixed deletion deadline for these independent systems. Residual backup records may remain until the applicable backup expires; deletion requests must be reapplied if data is restored. Contact us for the applicable retention details. Data already sent to ChatGPT or another MCP client must also be managed through that provider.

Disconnecting the MCP, deleting a conversation, or marking a table inactive does not by itself establish that the original uploaded file has been erased.

Your choices and requests

You can decline or revoke MCP authorization and request access, correction, account deletion or deletion of specific uploaded files by emailing guang.cheng.stat@gmail.com. Identify the account and the requested action. We verify ownership before disclosing or deleting data. Never send passwords, API keys or a private dataset by email.

Access protection

The MCP checks OAuth authorization and ownership and uses the signed-in user's access permissions. Its tools read source tables without modifying their records. No system can guarantee absolute security.

Policy website and changes

The static policy website contains no analytics scripts or contact forms. Its hosting provider may process network and access records. This statement does not describe all tracking in the separate Realy application or connected MCP client. Changes will be published on this page with an updated date.