ShadowTMSPrivacy statement
The hosted ShadowTMS service at mcp.shadowtms.ai stores hashes, identifiers and your sign-in email. It never stores your text.
Last changed: 2026-10-25.
Summary
- Your plugin sends your source text and your model's translations to the service. The service checks them in memory during that request and then discards the text.
- The service keeps a SHA-256 hash of each segment and of each accepted translation. A hash cannot be turned back into text.
- A server setting (
SHADOWTMS_CONTENT_STORAGE=locked) prevents the hosted service from storing content. No user, organization or operator command can turn content storage on while the lock is set. - Jobs expire after 30 days. You can delete your account and all its records at any time.
What the service stores
| Record | Fields |
|---|---|
| Account | A random user id; your email address, in plain text; the issuer and the user id that your identity provider gives; the version of the terms that you accepted; the organization id, if an operator added you to one; the creation and change times. We do not collect your name or your company. |
| Email index | A SHA-256 hash of your email address and your user id, so that one email holds one account. |
| Pipeline | A random pipeline id; your user id; the connector name (for example google_drive); a source key, which is a SHA-256 hash of the connector name and the source id (the service discards the source id); the target language tags; the pipeline settings (true or false values and a batch size); the creation and change times. |
| Job | A random job id; your user id and the pipeline id; the status, the revision and the times; the target language tags and the source word count; the name and version of your harness and the name of its model; a hash of each file and of its structure; the file, unit and segment identifiers that your connector gives (for a local file, this can be its path); for each segment, a hash of the source, a hash of the accepted translation, and its shape (the ids, counts and lengths of its inline codes, the names of its ICU arguments, its plural categories and its word count; no text); the result of each write (status, new version id and a fixed reason code, for example unchanged or permission_denied; no message); for each new target document that you confirm, your decision only, not its name; the codes of validation issues. |
| Reuse fingerprint | The pipeline id, a file id, a unit id and a target language tag; for each segment of the unit, a hash of the source and a hash of the translation; the job id and the time of the last confirmed write. |
The service writes request logs with the path, the status code and the time. It does not log request bodies, segment text, guidance or document names.
What the service never stores
- Your source text.
- Your translations.
- Your guidance: the instructions that you give for a translation.
- Your glossaries and do-not-translate lists.
- The source ids of your documents, and the locations where your translations go.
- The names of the new target documents that you confirm.
- The messages that your plugin sends with a write result. The service keeps a fixed reason code instead.
- Your password or your identity provider tokens. Your identity provider keeps your sign-in.
The service does not read or write your documents. Your harness does that through its own connectors, under its own terms.
How long the service keeps each record
| Record | Kept until |
|---|---|
| Job | 30 days after the job is created. Then the service deletes its segment records and keeps only the job header as a tombstone. |
| Job tombstone | 180 days after the job expires. Then the service deletes it. The tombstone lets the service tell your plugin that a job expired, instead of that it never existed. |
| Account, pipelines and reuse fingerprints | Until you delete them or delete your account. A fingerprint is replaced on each confirmed write and deleted with its unit. |
How to delete your account
Ask your agent to delete your ShadowTMS account. The plugin calls the delete_my_account tool. If you cannot use the tool, ask the operator; the operator runs scripts/user.py delete with your email address.
Deletion removes your account, your identities, your pipelines, your reuse fingerprints and your jobs, and every other record that carries your user id. It also deletes your user at our identity provider.
Service providers
- WorkOS runs the sign-in page and keeps your sign-in identity.
- Google Cloud runs the service (Cloud Run) and the database (Firestore).
- Cloudflare serves this website and the DNS for
shadowtms.ai.
We do not sell data, show ads, or use tracking cookies. This website has no scripts and no analytics.
Contact
For a question about this statement, open an issue on GitHub. Do not put personal data in a public issue.