Privacy policy

Who runs this

Obsidian MCP is run by Digital Vibes (David Mohl). For questions about your data, or to ask for a copy, a correction or deletion, write to obsidian-mcp@d.pn.

Obsidian MCP isn't affiliated with Obsidian.

What we store

Your Google account

When you sign in with Google, Google sends us your account ID, email address and name. We keep the account ID and email address, together with your vault's name, your server's address and how far its setup has got. We don't keep your name.

Your Obsidian credentials

To connect your vault, you enter your Obsidian email and password on our site. We pass them to Obsidian once to get an access token and don't store the password. If your vault has an end-to-end encryption password, your browser turns it into the vault key and sends us only the key.

The access token, the vault key and your vault's details go into a single encrypted secret in Google Cloud Secret Manager, which only your server can read. They never go into our database or our logs.

Your notes

Your server downloads your vault from Obsidian Sync and keeps it in memory while it runs. It reads and changes notes when your MCP client asks it to, and Obsidian Sync carries the changes to your devices.

So that it can start quickly after a pause, your server saves a snapshot of the vault to Google Cloud Storage. The snapshot is encrypted with a key that's kept in your secret.

Your MCP clients

The relay at mcp.obsidian.d.sh keeps the tokens it issues to Claude, ChatGPT and other MCP clients, so they stay connected.

Cookies

We set a session cookie that keeps you signed in for up to 7 days. Signing in and connecting Obsidian each use a cookie that lasts 10 minutes. The one used while connecting holds your Obsidian access token, encrypted. We use no analytics or advertising cookies, and our pages load no third-party scripts.

Logs

Our services log errors and details about requests, such as status codes and timings. A log line can include your account ID or the path of a note, but never the contents of a note, a password, a token or a key. Google Cloud keeps these logs for 30 days and Cloudflare for 7.

How we use it

Only to run the service: to sign you in, set up your server and pass your MCP client's requests to it. We don't sell your data, show ads or use your notes to train AI models.

Where it lives

Your server, your secret and your snapshot are in Google Cloud in Tokyo. Cloudflare runs this site and the relay on its global network, and stores our user database and the relay's data.

Your vault stays on Obsidian Sync, under Obsidian's own terms. Notes your AI client reads are sent to that client's provider, such as Anthropic or OpenAI, and their privacy policies apply to them.

How long we keep it

We keep your data while you have a server. Delete server on the dashboard removes the server, its snapshot, your secret, the relay's link to your server and your row in our database. Logs expire on their own as described above. A snapshot that hasn't been updated for 90 days is deleted automatically.

We can't read your Obsidian access token back, so we can't sign it out for you. It stays valid until you revoke it in your Obsidian account settings. You can remove our access to your Google account at myaccount.google.com/permissions.

Changes

When this policy changes, the date at the top changes with it.