Privacy policy — hosaka connector (ono-sendai)
This policy covers the hosaka connector that ChatGPT, Claude and other MCP clients use to query hosaka's music data. The data controller is hosaka-fm (contact: support). hosaka.fm's own site and the crate API have their own notices at crate.hosaka.fm/legal/privacy.
What we process
- Anonymous use. A small preview (resolving an artist, a summary card) works without an account. We keep no record of what you asked. To share capacity fairly we count requests per hour against a daily-rotating keyed hash derived from the network address your request arrived from; the address itself is never stored or logged.
- Linked account. If you sign in with hosaka, our authorization server issues tokens (lifetimes in the table are our policy values, enforced by the identity provider that runs sign-in) and we create an account record holding your sign-in identifier, a 26-character opaque profile id derived from it, and — once hosaka's customer hook exists — your hosaka customer mapping. Your e-mail address is held by the identity provider, not by the connector.
- Metering. Every tool call by a linked account produces one usage record: tool name, number of upstream calls, success/failure, timing, cache/replay flags — never the text of your request or the data returned. We use it to apply the temporary monthly allowance, to report usage back to you (
get_usage) and, when hosaka billing is connected, to bill the hosaka customer. Shadow reports aggregate it per day. - Abuse limiting. Anonymous capacity, per-account bursts and account-creation rates are limited automatically (a "protection ladder"). These limits use counters only; no profile is built and no content is inspected.
- Third-party text. Artist biographies and similar prose returned from hosaka's sources are passed to your assistant for display only and are never stored by the connector.
Recipients
hosaka's data substrate (crate) receives your tool arguments — an artist name, an identifier — to answer them, under hosaka's own policy. The connector runs on Amazon Web Services in the US East (N. Virginia) region, us-east-1. We do not sell or share personal data; the ChatGPT or Claude host you use is governed by its own privacy policy.
Retention
| Artifact | Retention | Legal basis | Deletion |
|---|---|---|---|
| Authorization codes (sign-in) | 60 seconds | contract | expire |
| Access tokens | 1 hour | contract | expire; revoked when you unlink or we suspend |
| Refresh tokens | 30 days sliding / 90 days absolute | contract | rotated; the family is revoked on reuse or unlink |
| Account record (your sign-in identifier, an opaque profile id, your hosaka customer mapping) | life of the account; tombstoned when you ask for deletion, tombstone expires after 13 months | contract | deletion request → the record becomes a tombstone (no usage), the identity provider user is deleted |
| Usage records (one row per tool call: tool name, counts, timing — never the content of your request) | 13 months | legitimate interest (metering, abuse limiting) | on deletion every row is re-keyed to a shared 'deleted' bucket with your profile id removed |
| Daily aggregates and shadow reports | 25 months; after deletion your rows are removed and only totals remain | legitimate interest | removed on deletion |
| Operator audit log (control-plane changes, ladder transitions) | 24 months | legitimate interest | scheduled expiry; carries no user identifiers |
| Request logs | 7 days; no tool arguments, no IP addresses, no tokens | legitimate interest (debugging) | scheduled expiry |
| Anonymous rate-limit counters (a daily-rotating keyed hash of the network address, never the address) | ≤ 2 hours (hourly window plus one hour of grace) | legitimate interest | window expiry |
Your controls
- Unlink the connector in your assistant or at hosaka: tokens stop being issued; existing access tokens expire within an hour.
- Export: ask support for a JSON export of your account record, monthly counters and daily usage (it contains your opaque profile id, never your sign-in identifier).
- Delete: ask support; within 30 days the account is tombstoned, the identity-provider user deleted, and every usage row re-keyed to a shared "deleted" bucket with your profile id removed and your daily rows dropped. The remaining aggregates carry no identifier.
- Limits you hit (
quota_exceeded,rate_limited,anonymous_capacity_exhausted) are temporary and explained in the response; nothing is sold inside the assistant.
Changes
We change this page together with the retention matrix it describes; the date in the footer is the version.
hosaka-fm · ono-sendai (the hosaka connector for ChatGPT, Claude and other MCP clients) · updated 2026-10-03
Provenance
This text is the hosaka connector’s own legal copy, reproduced word for word from ono-sendai src/http/legal.ts at commit a447f2b on 2026-10-13, with two rule-based changes and no others: the connector’s own navigation line is not shown (this site has its own), and its links to the connector’s /legal/* pages point at these pages. ono-sendai is the source of truth: its tests hold this copy to the connector’s code constants, and a test here fails if this page and the pinned source disagree.
Version: the connector’s footer reads “hosaka-fm · ono-sendai (the hosaka connector for ChatGPT, Claude and other MCP clients) · updated 2026-10-03” — that date is the version of this text, as the text itself says. The connector serves the same text at mcp-staging.hosaka.fm/legal/privacy, the host its own documentation lists as live.
The three connector documents: privacy policy, terms of use, support.
This website — hosaka.fm
The policy above is the hosaka connector’s. Where it says hosaka.fm’s own site has its own notice, this section is that notice: it covers the website you are reading it on, hosaka.fm and dev.hosaka.fm, published by hosaka-fm.
The site is static. It has no accounts and no comments, and it sets no cookies. It has one form: the artist query box on the front page. What you type there is sent to hosaka’s own data API — crate’s keyless preview endpoint, https://crate.hosaka.fm/api/v2/preview/artist?q= — and nowhere else; that request is covered by crate’s notice, linked below.
Site analytics
hosaka.fm counts page views with a self-hosted Umami instance owned and run by hosaka-fm (umami.hosaka.fm). The tracker script is served from this site itself, first-party, so no third-party code runs in your browser and no third party receives your visit.
It is cookieless and stores nothing in your browser. The only thing it reads is an opt-out flag (umami.disabled) if you have set one.
It honours Do-Not-Track: when your browser sends that signal, no page view is recorded at all.
What a page view sends: the page URL and title, the referring page, your browser’s language and screen size, and the site hostname. No account, no cross-site tracking, no advertising.
Like every web request, a page view reaches umami.hosaka.fm carrying your IP address and browser identification (the user-agent). This notice does not yet state what the server keeps of those two; hosaka-fm will confirm it against the running instance and add that sentence here.
The data API
hosaka’s public data API, crate, has its own notices: crate.hosaka.fm/legal/privacy and crate.hosaka.fm/legal/terms.
Contact for the website
Questions about hosaka.fm itself: hello@hosaka.fm. Questions about the connector: the support address in the policy above.