Privacy Policy — EstimateGuard MCP Server

Last updated: September 19, 2026

This policy describes what the EstimateGuard MCP server (https://estimateguard-mcp.onrender.com) does with information you send it. It is written to match the server's actual behavior.

1. What you send, and what happens to it

The server offers two functions. When you use them, you transmit:

Cost-range lookup: a trade (e.g. "roofing"), a short job description, and a 5-digit US ZIP code. This input is used only to answer the lookup. It is not stored.
Estimate evaluation: the text of a contractor estimate, a 5-digit US ZIP code, and optionally the trade and the total printed on the estimate. The text is processed in memory to produce the evaluation result that is returned to you.

2. Personal information is stripped before anything is stored

Before the server builds any stored record from an estimate, it scans the text and removes:

email addresses,
phone numbers,
contractor license numbers,
street addresses (including city / state / ZIP when attached),
contractor or business names appearing in the estimate header,
person names — both labeled ones (e.g. "Prepared for: Jane Doe") and standalone name lines in the header block before the first priced line.

Email addresses, phone numbers, license numbers, and street addresses are removed everywhere in the text, including inside line-item descriptions. Names and business names are removed from the header block (everything before the first priced line item). Worker names are removed from line descriptions when they appear next to a crew, labor, foreman, or installer word — "J. Martinez" in "Labor, J. Martinez crew", for example — and initial-plus-surname forms are removed wherever they appear. Names in other positions in a description may remain; brand and material names are never removed.

The server logs only counts per category (for example, email=1 phone=0) for auditing. These counts contain no personal information.

3. What is stored

From each evaluated estimate, the server stores one row per priced line item containing only these fields:

Field	What it holds
`observed_at`	timestamp of the evaluation
`zip3`	first 3 digits only of the ZIP code you sent (e.g. `100` from `10001`)
`trade`	trade name, e.g. `roofing`
`scope`	pricing basis derived from the unit, e.g. `per_square`
`line_description`	line-item description after the stripping in §2
`quantity`	quantity as a number
`unit`	unit as written, e.g. `squares`
`unit_price`	unit price recomputed by the server
`computed_line_total`	quantity × unit price, recomputed by the server
`source`	provenance stamp: `production`, `test`, or `verification`

These rows contain no email address, phone number, license number, street address, full ZIP code, or account identifier, and no name from the estimate header. As noted in §2, a name appearing inside a line-item description is not removed and may be stored. No row carries an identifier that would permit it to be linked to the person who submitted the estimate.

4. What is never stored

The raw estimate text is never persisted — not in the database and not in application files. It exists only in memory while your evaluation is computed, then is discarded.
Full 5-digit ZIP codes are never stored; only the 3-digit prefix.
Anything the stripping step in §2 removes is never stored.

5. How it is stored

Stored rows live in a PostgreSQL database hosted by Render in the United States (Oregon region). Render takes automatic encrypted backups of that database for disaster recovery, retained on a rolling 7-day window (Render's published point-in-time recovery window for Pro workspaces); stored rows therefore also exist in those backups until they age out. There are no other copies: no data warehouse, no exports, no analytics store.

6. Retention

Two tiers:

PII-stripped line-item observations (§3) are retained indefinitely. They are kept because they are aggregated into regional cost benchmarks — plainly: many stripped-down line items from many people are combined to show what kinds of jobs typically cost in an area. Because each row carries no contact details, addresses, or account identifiers, keeping them does not track anyone.
Raw estimate text is never persisted (see §4), so there is nothing to retain or delete.
Request logs (standard web-server access logs: timestamp, requested path, response status, client IP address — they do not contain estimate text) are retained for 14 days (Render's published log retention for Pro workspaces) and then purged.

7. Sharing

Your estimate text is never sent anywhere. Parsing and all arithmetic run entirely inside this server using pattern matching and exact decimal calculation. No language model, no external API, and no third-party service is involved in evaluating your estimate. The server makes no outbound network calls during evaluation other than to its own database.

The only third party involved is Render, which hosts the server and its PostgreSQL database in the United States. Render holds the stored rows described in §3 and their backups (§5) as our infrastructure provider; it does not receive estimate text, and it does not use this data for its own purposes.

Data is not sold, rented, or shared with advertisers, analytics providers, data brokers, or anyone else.

8. Security

Traffic to the server is encrypted with HTTPS. Database credentials are held server-side and never exposed to clients. The public endpoints require no account, so there are no passwords to protect.

9. Your choices

Because stored observations carry no identifier linking them to you, there is no individual record to correct or delete on request. If you do not want a line item recorded at all, do not submit the estimate — the cost-range lookup (§1) stores nothing.

10. Changes to this policy

If this policy changes, the updated version will be posted at this URL with a new "Last updated" date.

11. Contact

Questions about this policy: estimateguard.contact@gmail.com (operated by Joe Yuschak, New York, USA).