Effective 3 August 2026 · Last updated 3 August 2026
Pion has no accounts, no database, no analytics, and no advertising. The MCP server runs entirely on your own machine and sends nothing to us — we operate no server it talks to. This website sets no cookies and does not track you.
The parts worth reading are the ones where somebody else receives data: Pi Network, our hosting provider, and Google Fonts. Those are set out in sections 3 and 5.
Pion is an unofficial, open-source community project operated by Justin Black, an individual, in the State of Texas, USA (“we”, “us”). It is not affiliated with, endorsed by, or operated by Pi Network, the Pi Community Company, or SocialChain.
Contact for any privacy question or request: contact@pionmcp.com.
Pion is three separate things, and they handle data differently:
| Component | Where it runs |
|---|---|
The MCP serverpion-mcp on npm |
On your own computer, inside your own AI client. We never see it run. |
| The website pionmcp.com |
Static pages on Netlify. No cookies, no analytics. |
| The payment test page /pay.html and its two functions |
A developer test harness using the Pi SDK and two serverless endpoints. |
This policy does not cover Pi Network itself, your AI client (Claude, Cursor, or any other), or any third-party site we link to. Those have their own policies and we have no control over them.
Nothing. The pion-mcp package runs locally under your control.
It contains no telemetry, no analytics, no crash reporting, and no
phone-home of any kind. It never transmits data to us, because there is no
“us” for it to transmit to — we run no backend service for the MCP server.
When your agent calls a Pion tool, Pion makes an outbound request to a Pi Network endpoint. Whatever you asked about is in that request:
get_wallet_balance, get_account_payments, and
query_transaction send the wallet address or transaction hash
you supplied to Pi Testnet Horizon at api.testnet.minepi.com.verify_user sends a Pi user access token — which
you supply — to the Pi Platform API at api.minepi.com,
and returns the uid and username Pi replies with. Pion does not store,
cache, or log that token.send_payment, only if you have deliberately armed it, sends
payment details and uses credentials you configured yourself in your own
environment. Those credentials stay on your machine and are never
transmitted to us.Those requests are governed by Pi Network's privacy policy, not this one. Your AI client may also retain a record of the conversation, including tool inputs and outputs, under its own policy.
Blockchain data is public and permanent. Anything recorded on the Pi ledger — addresses, amounts, memos, timestamps — is visible to anyone and cannot be edited or deleted by us, by you, or by Pi Network. Do not put anything in a payment memo that you would not publish. No right of erasure can reach data already written to a blockchain.
pionmcp.com sets no cookies, uses no local or session storage for tracking, and runs no analytics, advertising, pixels, session recording, or fingerprinting. There is no consent banner because there is nothing to consent to.
The site is hosted by Netlify, which automatically records standard web server request data — IP address, timestamp, requested URL, referrer, and user-agent string — as part of delivering the site and protecting it from abuse. This is handled under Netlify's own retention practices; we do not export, analyse, enrich, or build profiles from it. Our legal basis, where the GDPR applies, is legitimate interest in operating and securing the site.
These pages load typefaces from Google Fonts
(fonts.googleapis.com and fonts.gstatic.com). Your
browser therefore contacts Google's servers, which receive your IP address
and user-agent as a consequence. We receive nothing from this and set no
Google cookie, but you should know the request happens. It is subject to
Google's privacy policy.
/pay.html is a developer harness for verifying a User-to-App
payment on Pi Testnet. It moves Test-Pi, which has no monetary value. If you
never open it, none of this section applies to you.
The page loads the Pi SDK from Pi Network and calls
Pi.authenticate requesting the payments and
wallet_address scopes. Pi asks you to approve that. If you do,
the page receives your Pi uid and the list of granted scopes, and displays
your uid on screen so you can confirm the right account is connected.
That uid is held in the page's memory for the length of your visit and is gone when you close the tab. It is not stored, not sent to our servers, and not shared. The Pi access token is a credential: the page deliberately never displays it, never stores it, and never sends it to our backend.
Completing a Pi payment requires the app's server to approve it. Two Netlify functions do this and nothing else:
/approve receives a payment ID, asks Pi for that payment's
real details, refuses it unless it matches the exact test payment this
page offers, and then approves it./complete receives a payment ID and a blockchain transaction
ID and asks Pi to mark the payment complete.These endpoints receive payment identifiers and transaction hashes — no names, no emails, no wallet secrets, no access tokens. We store none of it. There is no database behind this site. The identifiers pass through to Pi and the function forgets them when it returns. Netlify may retain transient function execution logs under its own practices.
A Pi server API key is used to authenticate to Pi from the server side. It lives only in server environment variables, is never sent to your browser, and is deliberately excluded from every error message the endpoints return.
We hold no personal data ourselves, so there is nothing on our side to retain or delete. Hosting-level records (server logs, function logs) are retained by Netlify under its own schedule and expire automatically. Data recorded on the Pi blockchain is permanent and outside anyone's control, including ours.
Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, or to object to it — under the GDPR, the UK GDPR, the CCPA/CPRA, and comparable laws. You also have the right not to be discriminated against for exercising them.
Write to contact@pionmcp.com and we will respond within the period the applicable law requires. Be aware of the honest limit: because we maintain no user records, in most cases the accurate answer to an access or deletion request will be that we hold nothing about you. For data held by Pi Network or written to the Pi blockchain, you will need to approach Pi Network directly — we cannot reach it.
If you are in the EEA or UK you may also complain to your national data protection authority.
The website and its serverless functions are hosted on infrastructure located in the United States. If you access Pion from outside the US, the limited request data described above is processed there.
Pion is developer tooling and is not directed to children. We do not knowingly collect personal information from anyone under 13 (or under 16 where local law sets that threshold). If you believe a child has provided us with personal information, contact us and we will address it.
The best security property of this project is architectural: we hold almost nothing, so there is almost nothing to breach. Server-side secrets are kept in environment variables and excluded from responses and logs; the default MCP install has no credentials at all and cannot move value.
No system is perfectly secure. If you find a vulnerability, please report it to contact@pionmcp.com rather than disclosing it publicly, and give us a reasonable chance to fix it.
If this policy changes, the updated version will be posted here with a new “last updated” date, and its full revision history is public in the project repository. For material changes we will note the change prominently on the site. Continuing to use Pion after a change means you accept the revised policy.
Justin Black — Pion
contact@pionmcp.com
github.com/jleeblack/pion-mcp