Data access stays bounded to the work you authorize.

Last updated: 1 November 2026

Data Connector is operated by Loam, a product of Ship It! Software Limited.

Browser-local input handoff

Choosing a local file stores a temporary original input copy in this browser’s IndexedDB so the marketing page can open the app without another file selection. The copy may remain after this tab closes. It expires for app access after 30 minutes; physical cleanup runs on later app-entry use, rather than at a guaranteed deletion time. Clear this site’s browser data to remove retained local copies. When storage is unavailable, the handoff stays in memory for same-tab navigation. SQLite edits and SQL drafts stay in the open tab and are lost on reload or close. Download your result first. File contents and credentials are never placed in the URL.

Input handoffs above 64 MiB in total stay in the current tab without copying the whole source into browser storage. This recovery-storage threshold is separate from each tool’s file-size limits. Reopen the original after refreshing, and download changes before closing the tab.

Account and session data

Data Connector uses Loam identity and authorization infrastructure. This site stores an encrypted, HttpOnly, host-only session containing delegated access credentials. Browser code receives only a limited identity view. The cookie is not shared with other domains.

Connection and import data

Endpoint settings, encrypted database and supported connector credentials, connection policy, test state and discovery metadata are processed by Loam infrastructure in the selected service region. Explicit saved imports and queryable tables belong to Data; saved files belong to Files. Connector does not retain provider rows, reports or query results as a data store. Passwords, tokens, API keys, and custom CA material are write-only and are not returned by APIs or Data Connector MCP tools.

Google Search Console service-account JSON keys and Stripe restricted API keys are encrypted in the Data Connector-owned credential vault. These connections read provider reports or records and import copies into your workspace. Refreshing a connection updates those managed tables.

Google Search Console OAuth

When you connect a Google account, Data Connector requests read-only Search Console access and the account identity needed to bind that authorization. We store encrypted access and refresh tokens, the provider account identity, selected property identifiers and connection/security settings. Provider tokens are not returned to browser code or your MCP client.

We use Google API data to provide the Search Console features you request: search-performance reports, property and sitemap information, and indexed URL inspection. Direct results pass through Connector to the MCP client or product session you authorize without creating a saved provider dataset in Connector. The receiving AI provider handles those results under its own privacy policy and settings. Saving an import, analysis result or file is a separate action through Data or Files and its resource permissions.

Google authorization does not automatically grant workspace members or AI clients access. An MCP client needs its own selected connection, property and read-action consent. This release does not enable sitemap or property changes. Data Connector does not use Google API data for advertising profiles or sell that data.

Query processing

For direct live PostgreSQL or MySQL, permitted SQL is sent to the connected database and results pass through Data Connector to the requesting MCP client. Queries against imported files or supported connector data run against the resulting managed Loam tables. The service applies read-only policy, time and result limits, and current workspace permissions. Query diagnostics exclude SQL, credentials, schema identifiers, and results.

When you authorize an MCP client, results requested by that client are shared with it and handled under its provider's privacy policy. Choose which clients and workspace data you authorize.

Web requests and providers

Cloudflare processes ordinary request information, including network and browser request data, needed to host and protect this site. Loam infrastructure providers process account, encrypted connection, import, and query traffic to operate Data Connector. Data Connector does not use that traffic to build advertising profiles or sell personal information.

Cookies and measurement

The encrypted, host-only session cookie is used for sign-in and security. Data Connector does not currently set a separate analytics cookie. Hosting, security, and service providers may retain bounded operational records under their own security and retention controls.

S3 Explorer desktop diagnostics and measurement

The separately installed S3 Explorer desktop host is a local client. Desktop releases incorporating the 25 October 2026 reliability update send bounded app-start and successfully accepted object-preview view events to PostHog and lifecycle and unexpected error diagnostics to Sentry. Read-only previews do not report a document edit or source save, and provider downloads are separate transfers rather than saved document edits. Reports identify the app as S3 Explorer and include installed version, platform, build environment and fixed diagnostic categories. They exclude endpoint addresses, bucket and object names, provider credentials, file names and paths, file contents, SQL and arbitrary error text. Provider traffic needed for your requested operations remains separate from this measurement.

Routine measurement uses a random app-scoped installation identifier in local app storage and a fresh session identifier per launch. Unavailable storage uses a session identifier instead. Identifiers are not derived from an account, hardware, operating-system identity or provider resources, and person-profile creation is disabled. Debug builds suppress routine remote telemetry; locally built release packages can report development-tagged activity. Updated hosts also keep bounded local lifecycle and panic-category logs.

Sentry and PostHog receive ordinary network information, including IP addresses, when reports are sent. Their configured collection endpoints are in the United States. Reports and local logs are used to measure use and investigate reliability and remain subject to provider retention controls; no fixed remote retention period is promised here. There is no in-app routine-analytics switch. You can clear local app data or restrict telemetry connections using your device controls; local provider operations do not require telemetry delivery. Clearing local data does not delete reports already received.

Retention and security

Account and workspace records, imported tables, connection configuration, and encrypted credentials are retained while needed to provide the service or meet legal and security obligations. Disconnecting a source stops future use of its credential but does not delete previously imported tables. Delete imported data through the applicable Loam workspace controls. We use encryption, access controls, bounded queries, and redacted diagnostics, but no hosted service can guarantee absolute security.

OAuth state and temporary security workflows expire through bounded cleanup. Terminal operation records expire after 24 hours and sanitized audit metadata after 30 days. Encrypted command arguments for an unresolved provider operation remain until explicit resolution so an uncertain effect is not blindly repeated; they are recovery inputs, not stored provider reports. These records are distinct from encrypted credentials and explicit Data/Files content.

Your choices

For live database connections, you can pause or remove a connection and narrow allowed schemas. For business app connections, you can replace credentials or disconnect the source. For Google OAuth, disconnecting a profile stops that connection without automatically revoking Google project authorization. You can revoke the application in your Google account; project-wide revocation may affect other grants and connections. You can also revoke an MCP client's authorization, sign out, or remove workspace access. See the Terms and Support.

Policy changes

We may update this policy as Data Connector changes. The revision date above identifies the current version.