Command Center ("CC", "the Service") is an AI-powered ideation and development management platform. This Privacy Policy explains what data CC collects, how it is used, and your rights regarding that data.
Summary: CC collects minimal data needed to operate. Your ideation content belongs to you. We don't sell data, run analytics trackers, or serve ads. API keys you provide are stored locally on your device and are never transmitted to CC servers.
1. Information We Collect
1.1 Account Information
CC uses Firebase Authentication via Google Sign-In. When you authenticate, we receive and store:
- Google account email address
- Display name
- Firebase User ID (UID)
- Authentication tokens (managed by Firebase)
We do not access your Google password or any Google account data beyond what is provided through the standard sign-in flow.
1.2 User-Created Content
CC stores the ideation and development management content you create, including:
- Ideas, concepts (OPENs, Decisions, Rules, Constraints), and their metadata
- Session records (goals, summaries, configuration, timestamps)
- Job records (instructions, status, events, completion data)
- App and project configuration
- Documents queued for delivery between agents
All user-created content is stored in Firebase Realtime Database under user-scoped paths (command-center/{your-uid}/), isolated from other users' data.
1.3 API Keys and Credentials
CC allows you to configure API keys for third-party services. These are stored exclusively in your browser's localStorage and are never transmitted to CC servers or Firebase:
- GitHub Personal Access Token
- Firebase Service Account JSON
- Domain provider credentials (Porkbun, GoDaddy)
- Anthropic API key
These credentials are used by your browser to make direct API calls to the respective services. CC's servers have no access to them.
1.4 MCP Server Request Data
CC includes an MCP (Model Context Protocol) server hosted on Google Cloud Run that processes tool calls from AI assistants (Claude Chat and Claude Code). When tool calls are made:
- Request parameters are processed to read/write your Firebase data
- Standard Cloud Run infrastructure logs may include request metadata (timestamps, HTTP headers, response codes)
- Request content is not logged or stored beyond what is needed to process the request
1.5 Information We Do Not Collect
- No analytics or tracking scripts
- No cookies beyond Firebase authentication
- No advertising identifiers
- No device fingerprinting
- No usage telemetry
2. How We Use Your Information
Your information is used solely to operate the Service:
- Authentication: To verify your identity and scope data access to your account
- Service delivery: To store, retrieve, and display your ideation content
- MCP tool processing: To execute tool calls that read and write your data on your behalf
We do not use your data for advertising, profiling, training AI models, or any purpose beyond operating the Service as described.
3. Data Storage and Security
3.1 Where Data Is Stored
- Firebase Realtime Database: User content, hosted on Google Cloud infrastructure
- Google Cloud Run: MCP server processing (stateless — no persistent storage)
- GitHub: Document delivery to repositories you configure
- Your browser (localStorage): API keys and credentials
3.2 Data Isolation
User data in Firebase is scoped to your authenticated user ID. Firebase security rules enforce that users can only read and write data under their own path. Shared configuration paths have restricted write access.
3.3 Security Measures
- All data in transit is encrypted via HTTPS/TLS
- Firebase Authentication handles session management and token security
- The MCP server authenticates requests via Firebase tokens
- API keys in localStorage are accessible only to the CC application running in your browser
4. Third-Party Services
CC integrates with the following third-party services, each governed by their own privacy policies:
When you provide API keys for these services, your browser communicates directly with them. CC does not proxy, intercept, or log these communications.
5. Data Retention and Deletion
5.1 Active Accounts
Your data is retained as long as your account is active. Some data types have automatic lifecycle management (e.g., ephemeral messages are deleted after delivery, short-lived documents expire after 7 days).
5.2 Data Deletion
You may request deletion of your account and all associated data by contacting us. Upon request:
- All data under your Firebase user path will be deleted
- Your Firebase Authentication account will be removed
- Documents delivered to GitHub repositories are under your control and must be deleted separately by you
- API keys in localStorage can be cleared by you at any time through browser settings or the CC Settings page
6. Your Rights
You have the right to:
- Access your data — all your content is visible through the CC interface and can be queried via the MCP tools
- Export your data — you can retrieve your content through the CC interface or Firebase directly
- Delete your data — contact us or use the CC interface to remove specific content; full account deletion is available on request
- Withdraw consent — you may stop using the Service at any time
7. Children's Privacy
CC is not intended for use by anyone under the age of 13. We do not knowingly collect data from children. If you believe a child has provided us with data, please contact us and we will delete it promptly.
8. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the Service after changes constitutes acceptance of the revised policy.
9. Contact
For questions about this Privacy Policy or to exercise your data rights, contact:
Dave Stewart
Email: privacy@commandcenter.dev