hosaka · privacy · terms · support

Privacy policy — hosaka connector (ono-sendai)

This policy covers the hosaka connector that ChatGPT, Claude and other MCP clients use to query hosaka's music data. The data controller is hosaka-fm (contact: support). hosaka.fm's own site publishes its notice at hosaka.fm/legal/privacy; the crate API's is at crate.hosaka.fm/legal/privacy.

What we process

Anonymous use. A small preview (resolving an artist, a summary card) works without an account. We keep no record of what you asked. To share capacity fairly we count requests per hour against a daily-rotating keyed hash derived from the network address your request arrived from; the address itself is never stored or logged.
Linked account. If you sign in with hosaka, our authorization server issues tokens (lifetimes in the table are our policy values, enforced by the identity provider that runs sign-in) and we create an account record holding your sign-in identifier, a 26-character opaque profile id derived from it, and — once hosaka's customer hook exists — your hosaka customer mapping. Your e-mail address is held by the identity provider, not by the connector.
Metering. Every tool call by a linked account produces one usage record: tool name, number of upstream calls, success/failure, timing, cache/replay flags — never the text of your request or the data returned. We use it to apply the temporary monthly allowance, to report usage back to you (get_usage) and, when hosaka billing is connected, to bill the hosaka customer. Shadow reports aggregate it per day.
Abuse limiting. Anonymous capacity, per-account bursts and account-creation rates are limited automatically (a "protection ladder"). These limits use counters only; no profile is built and no content is inspected.
Third-party text. Artist biographies and similar prose returned from hosaka's sources are passed to your assistant for display only and are never stored by the connector.

Recipients

hosaka's data substrate (crate) receives your tool arguments — an artist name, an identifier — to answer them, under hosaka's own policy. The connector runs on Amazon Web Services in the US East (N. Virginia) region, us-east-1. We do not sell or share personal data; the ChatGPT or Claude host you use is governed by its own privacy policy.

Retention

Artifact	Retention	Legal basis	Deletion
Authorization codes (sign-in)	60 seconds	contract	expire
Access tokens	1 hour	contract	expire; revoked when you unlink or we suspend
Refresh tokens	30 days sliding / 90 days absolute	contract	rotated; the family is revoked on reuse or unlink
Account record (your sign-in identifier, an opaque profile id, your hosaka customer mapping)	life of the account; tombstoned when you ask for deletion, tombstone expires after 13 months	contract	deletion request → the record becomes a tombstone (no usage), the identity provider user is deleted
Usage records (one row per tool call: tool name, counts, timing — never the content of your request)	13 months	legitimate interest (metering, abuse limiting)	on deletion every row is re-keyed to a shared 'deleted' bucket with your profile id removed
Daily aggregates and shadow reports	25 months; after deletion your rows are removed and only totals remain	legitimate interest	removed on deletion
Operator audit log (control-plane changes, ladder transitions)	24 months	legitimate interest	scheduled expiry; carries no user identifiers
Request logs	7 days; no tool arguments, no IP addresses, no tokens	legitimate interest (debugging)	scheduled expiry
Anonymous rate-limit counters (a daily-rotating keyed hash of the network address, never the address)	≤ 2 hours (hourly window plus one hour of grace)	legitimate interest	window expiry

Your controls

Unlink the connector in your assistant or at hosaka: tokens stop being issued; existing access tokens expire within an hour.
Export: ask support for a JSON export of your account record, monthly counters and daily usage (it contains your opaque profile id, never your sign-in identifier).
Delete: ask support; within 30 days the account is tombstoned, the identity-provider user deleted, and every usage row re-keyed to a shared "deleted" bucket with your profile id removed and your daily rows dropped. The remaining aggregates carry no identifier.
Limits you hit (quota_exceeded, rate_limited, anonymous_capacity_exhausted) are temporary and explained in the response; nothing is sold inside the assistant.

Changes

We change this page together with the retention matrix it describes; the date in the footer is the version.