# Privacy Policy

`tmdb-mcp` is a local [Model Context Protocol](https://modelcontextprotocol.io)
server: it runs as a process on your own machine (via `npx` or a local clone),
speaking stdio to your MCP client (Claude Desktop, Claude Code, etc.). It has
no server component of its own, no telemetry, and no analytics, so there isn't
much for this policy to cover.

## Data collection

`tmdb-mcp` collects no data of its own. It has no database, no accounts, and
sends nothing to its maintainer or to any analytics/telemetry service.

The only inputs it handles are:

- **Credentials you supply**, via environment variables in your MCP client's
  own config (e.g. `claude_desktop_config.json`): `TMDB_API_TOKEN` (required),
  `OMDB_API_KEY` (optional), plus non-secret preferences `TMDB_LANGUAGE`/
  `TMDB_REGION`. These stay in your client's local config file; `tmdb-mcp`
  never transmits them anywhere except as described below.
- **Tool call arguments**, generated by the AI model you're using (e.g. a
  movie title, a person's name, a TMDB/IMDb id) as it calls one of this
  server's tools on your behalf.

## Usage and third-party sharing

Each tool call results in outbound HTTPS requests to TMDB, OMDb, or both
(`get_movie`/`get_tv` and the batch tools add OMDb ratings to TMDB data), or
to neither when the answer is already cached. Each request carries only what
that specific call needs:

- **TMDB** (`api.themoviedb.org`): `TMDB_API_TOKEN` as an `Authorization:
Bearer` header, plus the search/lookup parameters the tool call supplies.
  Used by almost every tool. Governed by
  [TMDB's own Privacy Policy](https://www.themoviedb.org/privacy-policy) and
  [API Terms of Use](https://www.themoviedb.org/api-terms-of-use) once your
  request reaches them.
- **OMDb** (`omdbapi.com`): `OMDB_API_KEY` as an `apikey` query parameter,
  plus an IMDb id or title/year. Only reached when `OMDB_API_KEY` is set and
  a ratings-enrichment path is used (`get_movie`/`get_tv`'s ratings, or the
  standalone `get_ratings`). OMDb doesn't publish a page dedicated solely to
  privacy; its combined [Terms/legal page](https://www.omdbapi.com/legal.htm)
  governs your request once it reaches them.

`tmdb-mcp` sends data to no other destination: no analytics vendor, no
logging service, and no server run by its maintainer.

## Storage and retention

- **Caching**: successful detail and reference responses (titles, people,
  credits, collections, seasons/episodes, videos, watch providers, genre and
  provider lists, IMDb-id lookups, OMDb ratings) are cached in the server
  process's own memory only (never written to disk) to cut latency and avoid hammering
  TMDB/OMDb. An entry is served as fresh for a short configurable TTL
  (`CACHE_TTL_MS`, default 5 minutes); after that it stays in memory as a
  fallback for when TMDB/OMDb is unreachable, until it's refreshed, evicted
  (at most 500 entries per upstream, oldest first) or the process exits. The
  cache is cleared entirely when the process exits and is never shared across
  machines or users. Search, discover, similar/recommendations, reviews,
  trending and cinema-release lists are never cached; each call fetches them
  fresh.
- **Logging**: operational logs go to stderr only (never a file, never a
  remote endpoint), with credentials stripped before anything is written.
  Log verbosity is controlled by `LOG_LEVEL` (default `info`); logs live only
  as long as your MCP client keeps that stderr stream around.
- Beyond that in-memory cache and the running process's lifetime, `tmdb-mcp`
  retains nothing. There is no persistent storage layer of any kind.

## Changes to this policy

Material changes will be noted in [CHANGELOG.md](CHANGELOG.md) and reflected
here, at the same URL, with the effective date below updated.

_Last updated: 2026-10-20._

## Contact

Questions about this policy or `tmdb-mcp`'s data handling:
[open a GitHub issue](https://github.com/Grinv/tmdb-mcp/issues) or email
[4070730+Grinv@users.noreply.github.com](mailto:4070730+Grinv@users.noreply.github.com).