Service: https://flights.flightpowers.com/mcp Registry name: com.flightpowers/google-flights Effective date: 2026-08-17 Contact: mtnrabi@gmail.com
This policy describes exactly what the hosted MCP server at flights.flightpowers.com does with data. It is written from the server's source, not from a template. Where the server collects nothing, this policy says nothing is collected rather than reserving a right we do not use.
A hosted Model Context Protocol (MCP) server exposing two tools:
search_oneway_flightssearch_roundtrip_flightsBoth accept a date range and a list of destinations, expand them internally into individual searches (30 per call by default; a per-call max_searches argument can lower that figure for a single call but cannot raise it, and 60 is the hard ceiling the deployment-wide setting itself cannot exceed), and forward each search to the Google Flights Live API on RapidAPI. Search results are returned to the caller in the tool response and are not retained.
Non-affiliation. This is an independent service that returns publicly available flight pricing. It is not affiliated with, endorsed by, or sponsored by Google.
Every search on this server is billed to the caller's own RapidAPI subscription. The key is supplied per request, and this is what happens to it:
x-rapidapi-key request header(preferred), an authorization: Bearer or x-api-key header, a query parameter on the connector URL (rapidapi_key, rapidapi-key, rapidapikey, api_key, apikey, or key), a Smithery-style config. parameter or base64 config= blob, or — last, and normally unset — a RAPIDAPI_KEY value in the server's own environment.
request and sent to RapidAPI as the x-rapidapi-key header on each upstream search request that the call makes.
log, never included in an error message, never returned in a tool response, and never cached or reused for a later request. There is no database of keys because there is no database of anything per-caller.
literal values recorded are strings such as header:x-rapidapi-key, query:rapidapi_key, env:RAPIDAPI_KEY, or none. This field exists so that "users cannot work out how to pass a key" is distinguishable from "users are not trying". It contains no part of the key value.
If a key is absent, the server returns instructions instead of running a search, and spends nothing.
One JSON line per tool call (never one per upstream request) is written to the server's standard output, prefixed MCP_CALL . It contains exactly these fields and nothing else:
| Field | Meaning |
|---|---|
ts, iso | Time of the call (epoch seconds and UTC timestamp) |
tool | one of search_oneway_flights or search_roundtrip_flights |
requested_combinations | How many date/destination combinations the call asked for (a number) |
upstream_calls | How many RapidAPI requests the call actually made |
upstream_failures | How many of those failed |
results_returned | How many results were returned (a number) |
duration_ms | How long the call took |
truncated | Whether the fan-out cap trimmed the search |
credential_source | Which mechanism supplied the key (see section 2) |
error | An error label such as no_api_key, auth or quota; a validation message when the request was rejected before any search ran; otherwise null. A validation message quotes the value that failed validation — an unparseable date or trip length, for example |
If the deployment is configured with a writable log path, the same line is also appended to a local file. On the current hosting platform that path is not writable, so standard output is the record.
Aggregate integer counters are incremented per call: tool_calls, upstream_calls, upstream_failures, results_returned, truncated_calls, errored_calls, unauthenticated_calls, plus per-UTC-hour totals of tool_calls and upstream_calls.
These are plain numbers with no per-caller dimension — there is no key, no identifier, and no way to attribute a counter to anyone. By default they live in process memory and reset when the process recycles. If an Upstash Redis store is configured, they are stored there as integers under the key prefix gfpaid; hourly buckets expire automatically after 35 days, and lifetime totals are running integers.
The server does not collect, log, store, or transmit any of the following:
appears in any record it writes, and none is sent upstream. (The hosting platform terminates the network connection and keeps its own request logs — see section 6.)
email address, no device or client identifier.
cabin class, price limits and airline filters are used to perform the search and are then discarded. Only the *count* of requested combinations is recorded, not the values — with one exception: when a request is rejected as invalid before any search runs, the validation message goes into the error field described in section 3, and that message quotes the single value that failed (a malformed date or trip length, for example).
within minutes, so nothing is cached or reused.
server serves no ads and embeds no third-party tracking of any kind.
There is no profiling, no automated decision-making, and no sale or sharing of data. There is no personal data to sell.
with your key so that it is billed to your own subscription. RapidAPI and the API provider handle that request under their own terms and privacy policies.
integer counters described in section 4.
standard-output lines described in section 3 as runtime logs and retains them under its own log retention. Like any internet host, the platform also terminates the network connection and may keep its own request-level logs under its own policy; that layer is the platform's, not this server's, and this server neither reads nor uses it.
No other processor receives anything.
GET /health — public and unauthenticated. Returns service status, thepublic MCP URL, the signup URL, whether ads are served (always false), and whether a server-side fallback key is configured. It contains no caller data.
GET /metrics and GET /metrics/calls — the aggregate counters fromsection 4, protected by a x-metrics-token header when a token is configured. They contain no caller data.
GET /.well-known/openai-apps-challenge — a domain-verification token, or404 when unconfigured.
MCP_CALL log lines: retained by the hosting platform under its runtime logretention. They contain no personal data, so there is nothing in them to attribute to, or delete for, an individual.
integers with no personal dimension.
Because no personal data is collected, there is no account to close and no per-user deletion or access request that can be meaningfully fulfilled — there is no record keyed to you to find. If you believe otherwise, write to the contact address above and we will investigate.
The service is a developer API tool and is not directed to children.
Material changes to this policy will be published at this URL with an updated effective date. The version in force is the one published here.
mtnrabi@gmail.com