Last updated 2026-10-03. This policy describes exactly what the TradeStar Insider service — the website www.tradestarinsider.com, the REST API at api.tradestarinsider.com, and the MCP server at mcp.tradestarinsider.com/mcp — does with request data. It describes what the code actually does. If any statement here is wrong, it is a bug; report it (see Contact) and it will be fixed.
Each request to the API or MCP server appends one line to a server-side request log. The purpose is strictly operational: keeping the service up, enforcing the per-IP rate limit, and measuring aggregate demand. Each line contains only these fields:
| Field | What it is |
|---|---|
ts | UTC timestamp of the request (to the second). |
surface | Which service handled it: api, mcp, app, or status. |
route | The request path (e.g. /mcp or an API route). Not the query arguments. |
tool | For MCP, the name of the tool called (e.g. insider_cluster_buys) — never its arguments. |
kind | The coarse request type (a real tool call vs. a handshake/discovery message). |
status | The HTTP status code returned. |
ip_hash | A salted hash of your IP address, not the address itself. The salt rotates every day, so the same IP produces a different, non-linkable hash on a different day. Used only to enforce the per-IP daily rate limit. |
consumer | For the RapidAPI paid tier only, the RapidAPI-supplied user identifier that accompanies the request. Absent (null) for direct/free and MCP traffic. |
via | The channel: rapidapi, direct, or internal (our own machinery). |
channel | For MCP, the client name a connector advertises in its handshake (e.g. insider-signals-mcp for the optional local proxy, or a connector name such as Claude or Cursor). To attribute later tool calls in the same session, the server issues a random per-session id on the handshake (an Mcp-Session-Id header) and, for calls that echo it, records the same handshake client name — used only to see which listing brings usage. The value is sanitized before storage: reduced to a short, single-line label (control characters and any URL removed, length capped), and it is never interpreted as an instruction. Absent for a direct MCP client that sends no client name or session id. |
agg | A coarse label for the egress network a request arrived from, when that network is a known AI aggregator/host (for example a request relayed by a hosted assistant from its published server-side IP range). It is derived from the raw IP before hashing and stored as a short label (e.g. a provider name), never the IP itself. Its only purpose is to tell aggregated, relayed traffic apart from ordinary per-user traffic when measuring demand. Absent (null) for ordinary clients outside any known aggregator range. |
sid_hash | For MCP, a salted hash of the per-session id (above) — using the same daily-rotating salt as ip_hash, so like the IP hash it is non-linkable across calendar days and is never the raw session id. Used only to count distinct sessions within a day. Absent (null) for non-MCP requests and for clients that carry no session id. |
What is not logged: your raw IP address, the arguments/parameters you pass to any tool, request or response bodies, browser fingerprints, and any personal identifier. There is no cross-day tracking — the daily-rotating salt makes the IP hash deliberately un-linkable across calendar days.
The request log lives on the server that runs the service (a single self-hosted origin behind a Cloudflare tunnel). It is not sent to any third-party logging or analytics service. Log files are pruned automatically: entries older than 45 days are deleted, along with the daily salt for those days.
The website, the API, and the MCP server set no cookies. They use no client-side storage, no analytics, and no third-party trackers. There are no accounts to sign in to, so there is no session cookie.
We do not share, rent, or sell request data. But two infrastructure providers necessarily process requests in transit to deliver the service:
We use no other third parties on these surfaces — no analytics, no error-tracking, no ad networks. The underlying data we serve is public information from SEC EDGAR and USAspending.gov; we add no personal data to it.
We do not sell personal data, and there is no personal data in our logs to sell — only salted, daily-rotating IP hashes and coarse operational metadata.
TradeStar Insider is operated from Austria and processes the limited request data described above in line with the EU General Data Protection Regulation (GDPR). This section covers the public website, REST API, and MCP server.
TradeStar Insider
Linz, Austria
[email protected]
For the public website, REST API, and MCP server we process only the operational request log described above. The only field that can relate to you is a salted, daily-rotated hash of your IP address — not your IP address itself, and not linkable across days.
As described above, Cloudflare (network/CDN, all surfaces) and RapidAPI (paid API tier only) process requests in transit under their own privacy policies. Both may process data outside the EU/EEA; where they do, they rely on their own GDPR transfer mechanisms (e.g. EU Standard Contractual Clauses). We add no other processors.
Under the GDPR you have the right to request access to, rectification of, or erasure of your personal data; to restrict or object to processing; and to data portability, to the extent these apply to the minimal data we hold. Because our log contains only a salted, daily-rotating IP hash with no account or identifier, we usually cannot single out or link a request to you, which may limit our ability to action a request (Art. 11 GDPR) — we will explain this if it applies. To exercise a right, contact [email protected].
If you believe our processing infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. Austria's authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, [email protected], www.dsb.gv.at. You may also complain to the authority in your own EU country of residence.
Questions, corrections, or privacy requests: email [email protected]. For bug reports you can also open an issue at github.com/TradestarV5/insider-signals/issues. If you believe any statement in this policy does not match what the service actually does, please report it so it can be fixed.