# MA Commander Privacy Policy

Last updated: 2026-10-01

MA Commander connects a user-authorized computer to compatible AI clients through MCP and an optional self-hosted relay. MA Commander is designed to process only the information needed to perform operations explicitly requested by the user. MA Commander does not sell personal data, use command content for advertising, or perform behavioral profiling.

## Data processed

Depending on the tools the user explicitly invokes, MA Commander may process:

- file and directory paths, file metadata, and file contents selected by the requested operation;
- process, disk, operating-system, WSL, and device metadata;
- command arguments and command output for allow-listed developer operations;
- screenshots and pointer/GUI information only when the corresponding tool is explicitly invoked and permitted by local policy;
- temporary developer-session input and output;
- transfer metadata and file chunks when a transfer is explicitly requested;
- device identifiers, pairing records, granted scopes, and relay job/request results needed to connect the authorized computer;
- technical audit and diagnostic records produced by the locally installed agent.

MA Commander is not designed to collect payment-card data, protected health information, government identifiers, passwords, API keys, MFA/OTP codes, or other authentication secrets. Users should not intentionally provide such data to MA Commander tools.

## Purposes of processing

MA Commander processes data only to:

1. authenticate and authorize a user-selected computer and enforce granted scopes;
2. execute the specific file, system, developer, WSL, transfer, screenshot, or GUI operation requested by the user;
3. return the requested result to the authorized client;
4. deliver and recover relay jobs when remote connectivity is used;
5. enforce safety controls, diagnose failures, and maintain the security and reliability of the service.

MA Commander does not use processed content to build advertising profiles or for unrelated marketing.

## Where processing occurs and recipients

Most computer operations execute on the user's authorized device. When remote connectivity is enabled, the MA Commander relay may receive the minimum device, pairing, job, and result data necessary to route the requested operation.

Data may therefore be received by:

- the user's authorized device running MA Commander;
- the MA Commander relay selected/configured for that installation;
- the compatible AI client through which the user requested the operation, including ChatGPT when MA Commander is used as a ChatGPT plugin;
- infrastructure providers used to host the configured relay, solely as necessary to provide that infrastructure.

MA Commander does not sell or rent user data to data brokers or advertisers.

## Retention

Retention follows the behavior of the current MA Commander implementation:

- pending pairing codes expire automatically after 10 minutes;
- pairing access grants are stored as token hashes and remain until revoked by the user or administrator; they do not currently have an automatic expiration;
- relay job persistence is bounded to the most recent 1,000 job records rather than a fixed number of days; older records fall outside the persisted set as newer jobs are stored;
- interactive developer sessions and their bounded output buffers are held in memory and are removed when cleaned up or when the process restarts;
- the isolated OpenAI review demo uses session-memory-only synthetic data and does not access a real user device;
- local configuration and audit/log information remain on the user's computer until removed by the user, overwritten by normal operation, or removed with the installation/state data.

Operators of a self-hosted relay are responsible for their own backups, infrastructure logs, and any additional retention they configure.

## User controls

Users control which computer is paired and which scopes are granted. Users can revoke pairing grants, disable GUI input locally, stop or clean up developer sessions, abort pending transfers, stop the local agent, and uninstall MA Commander or remove its local state.

High-risk, sensitive-read, and write capabilities remain separately permission-gated. A reviewer/demo account is isolated from real devices and cannot use WSL, GUI, screenshots, transfers, broker operations, or other high-risk capabilities.

## Data minimization and security

MA Commander uses scoped authorization and local policy checks to limit operations. Pairing access tokens are not stored in plaintext by the pairing store; token hashes are stored for grant resolution. Tool responses are intended to return only information relevant to the requested operation.

Users remain responsible for choosing files, commands, and content appropriate for processing and for securing the computers and relay infrastructure they authorize.

## Privacy requests and support

For privacy questions, access/revocation assistance, or requests concerning MA Commander-operated relay data, use the support contact published at:

https://commander.cineworld-studios.it/support

The public privacy policy is available at:

https://commander.cineworld-studios.it/privacy