TMA plugin privacy

Effective October 13, 2026. This notice supplements Tweet Media Archive’s privacy policy for this hosted MCP connection.

Public use without a TMA login

Public media lookup and temporary preparation do not require a TMA account. No per-person lifetime allowance, verified user identifier or sign-in tracking is maintained. Shared request, concurrency, processing-time and daily capacity limits apply. There is no guest file-size cap. Public use cannot access the private Local library or connected storage.

Random selection and file references are bearer capabilities: anyone with one can access its permitted operation until expiry, so keep them private. Picker metadata expires within 15 minutes. Temporary file access ends 20 minutes after preparation starts, including time spent processing; refreshing a link never extends that deadline. Download and playback links last at most five minutes and cannot outlive the file. There is no browsable public library. Automatic cleanup removes expired bytes and job metadata, but storage or infrastructure outages can delay physical deletion. Access remains expired during cleanup retries. Opaque retry records remain for at most 24 hours; daily operation aggregates remain for 90 days. These aggregates contain no source URLs, filenames, user identifiers, chat contents or credentials, and count observed operations rather than unique people. Already delivered bytes cannot be recalled.

Book reader

Opening a private library book loads its contents into the reader in ChatGPT. The book text is not returned to the model by the reader tools. TMA stores your reading position, appearance and bookmarks (including a short page excerpt) in Convex under your account and library file. These remain when you reconnect that account and are removed when you delete the library file. The reader does not use browser-local storage for this data. Book scripts and external network requests are disabled. Reading-state writes require your existing Downloads permission.

Optional paid connection data

For account features, you sign in to TMA with Google and approve the requesting client. TMA creates a dedicated connector key without displaying it or requiring you to paste it. Manual connector-key consent remains available for existing integrations. The OAuth service stores the approved key encrypted in Cloudflare KV so it can call TMA on your behalf. A pending connection is bound to its original browser, TMA account and login session for ten minutes. Convex temporarily stores an encrypted key and callback to prevent duplicate grants and support safe retries; those encrypted values are cleared on return, cancellation or cleanup. Pending browser references contain no Google token, connector key or client callback. OAuth access tokens and authorization codes are stored as hashes. Connection metadata includes the client identifier, approved permissions, and an opaque key-derived identifier. The plugin does not receive your Google password or browsing history. Download-only grants do not access the Local library or storage accounts. Separately approved Downloads workspace grants can read and manage the Local library, read activity and connected storage/folders, and start or cancel saves. Provider credentials remain server-side in TMA; this permission can be removed in Agent connections.

Media requests

Public URLs you submit are processed by TMA’s media services and contacted source websites. Selected media, filenames, preparation status, and expiring file links are returned to your agent. If the agent downloads a file, it receives the media bytes. OpenAI or another agent provider handles that data under its own policies. We do not request unrelated conversation history.

Retention and removal

TMA connector keys expire after 90 days. OAuth grants last at most 30 days and can be renewed by reconnecting; registration metadata can persist to support reconnection. Owner-bound picker snapshots retain returned media metadata and opaque IDs in Cloudflare KV for at most 15 minutes, without source URLs or credentials. Owner-bound save-batch references retain opaque job IDs for at most five hours. Selection and operation references may persist in conversation/tool context under the host’s policies. For paid connections, temporary prepared files expire after five hours and file links after at most 30 minutes. Revoke a key in Agent connections to block new requests and existing download links. Accepted work may finish before automatic expiry. Already delivered bytes cannot be recalled. Contact support for removal of connection metadata.

Infrastructure and diagnostics

The service runs on Cloudflare. Application request logging is disabled for this Worker. Cloudflare and TMA may process network and operational metadata to deliver the service, prevent abuse, and apply request limits. Credentials are not included in the public plugin package or tool responses.

Contact

For access, deletion, or support requests, contact TMA support. TMA does not sell personal information.