Color Picker

1) Scope

This policy explains how we process data through the Color Picker App when it is used inside ChatGPT. The App opens an interactive widget that can start from an optional color value, show optional suggested swatches, let you refine hue, saturation, value, transparency, hex, and RGB values, and then place the chosen color back into the ChatGPT conversation. This policy covers Spheric Admin Ltd's processing through the App, its MCP server, and related hosting, logging, and analytics services. It does not replace OpenAI's policies for ChatGPT platform processing.

Important: Our current MCP server utilities log full MCP request bodies to the server console and send HTTP and MCP request telemetry to Mixpanel. That telemetry can include tool arguments such as selectedColor and suggestedColors, request IDs, IP address, user agent, and an OpenAI subject identifier if the platform provides one.

2) Current tool contract and app behavior covered by this policy

• Tool input fields: selectedColor (optional hex color) and suggestedColors (optional array of 1 to 16 hex colors).
• Tool output field returned by our MCP server: selectedColor (optional hex color, initially reflecting the incoming starting color if one is provided).
• Tool response metadata: timestamp (ISO datetime).
• In-widget state: while you interact with the widget, it stores the current selection as modelContent.selectedColor in temporary ChatGPT widget state.
• Follow-up chat action: when you press Done, the widget asks the ChatGPT host to send a follow-up message in the form I have chosen RRGGBBAA, using an eight-character hex value without a leading #.
• Local browser actions: on the selected-color screen, copy buttons can write the color name, hex value, RGBA value, or HSVA value to your device clipboard.

Subsequent user adjustments made inside the widget are not posted back to our MCP server by this widget code. Instead, the final chosen color is handled through ChatGPT widget state and the follow-up chat action described above.

3) Data categories, purposes, recipients, retention, and controls

3.1 Tool invocation data and initial tool response

What: The tool input fields selectedColor and suggestedColors, the returned tool output field selectedColor, and response metadata timestamp.
Why: To validate the tool request, render the widget with the requested starting color and suggested swatches, and return the initial structured tool response.
Recipients: Our MCP server and OpenAI/ChatGPT as part of the tool invocation flow. Our current logging and analytics configuration described in Section 3.3 can also capture tool input parameters from the request. The initial tool output and response metadata are returned to the ChatGPT runtime and widget.
Retention by us: We do not use a separate app database to keep a persistent color-selection history. However, tool input parameters may appear in server console logs and Mixpanel telemetry under our current server configuration.
Your controls: You can choose whether to use the App and can avoid placing personal or sensitive information in tool arguments or surrounding prompts.

3.2 In-session widget state, follow-up content, and clipboard actions

What: The current selected color stored in temporary widget state, the follow-up message triggered when you press Done, and any color values you choose to copy to your clipboard.
Why: To keep the widget responsive during the session, show the final selected color view, place the chosen color back into the ChatGPT conversation, and let you copy displayed values locally.
Recipients: OpenAI/ChatGPT and its widget runtime for in-session state and follow-up message handling; your browser and device clipboard for local copy actions.
Retention by us: We do not intentionally store clipboard contents in our own systems. The in-session widget state and follow-up message are primarily handled by the ChatGPT/OpenAI platform and are subject to OpenAI's retention and account controls rather than our own app database.
Your controls: You decide whether to press Done and whether to use copy actions. You can also manage ChatGPT conversation data through OpenAI controls.

3.3 Technical delivery data, server logs, and analytics telemetry

What: Technical data generated when the App is used or delivered, including HTTP method, request path and URL, IP address, user agent, response status, response time, JSON-RPC request ID, MCP method, MCP request params (which can include tool input values), and, for tool calls, an OpenAI subject identifier if supplied in request metadata.
Why: Security, abuse prevention, service reliability, performance monitoring, debugging, and understanding how the App is being used.
Recipients: Our hosting, CDN, and infrastructure providers, personnel who need access for operations or security, and Mixpanel using the EU Mixpanel endpoint for server-side analytics telemetry.
Retention: We aim to minimize server-side operational logs and generally retain them for no longer than 30 days unless a longer period is reasonably necessary for security investigations, abuse prevention, or legal obligations. Mixpanel telemetry is retained in our analytics workspace until deleted by us or until any applicable Mixpanel or account retention setting removes it.
Your controls: You can avoid submitting unnecessary data through the App, choose not to use the App, and contact us with rights requests or questions.

3.4 Contact data if you email us

What: Your email address and the contents of your message.
Why: To respond to privacy, support, or legal requests and maintain a record of the request.
Recipients: Spheric Admin Ltd and our email/service providers acting on our behalf.
Retention: Up to 24 months after final resolution unless a longer period is required by law or reasonably needed to establish, exercise, or defend legal claims.

4) What we do not do

• No account creation or sign-in through this App.
• No advertising SDKs or ad-personalization profiling through the widget.
• No sale of personal information.
• No third-party color-processing API calls to calculate color values or color names; those calculations are performed locally in the widget code.

5) Cookies and similar technologies

We do not intentionally set advertising or analytics cookies through the Color Picker widget. ChatGPT/OpenAI, your browser, and our hosting providers may use their own cookies or similar technologies for platform operation, security, or delivery, and those practices are governed by their own policies.

6) Sharing and disclosure

We do not sell personal information. We share data only when needed to:

• Operate, host, monitor, and secure the App through service providers such as hosting, CDN, logging, analytics, and email providers.
• Comply with law, regulation, legal process, or enforceable government request.
• Protect the rights, safety, and security of users, us, and the service.

7) User rights and controls

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or object to processing of personal data we hold.

To exercise rights or ask questions, contact privacy.widgets@olutely.com. We may need to verify your identity before fulfilling a request.

Because the App runs inside ChatGPT, you can also manage conversation and account data through OpenAI controls. OpenAI's privacy policy: https://openai.com/policies/privacy-policy.

8) International transfers

The App may be accessed globally and processed in countries where we or our service providers operate. Where required, we use appropriate safeguards for international data transfers.

9) Security

We implement reasonable technical and organizational safeguards designed to protect data processed through the App. No system is guaranteed to be completely secure.

10) Children's privacy

The App is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children through this App.

11) ChatGPT / OpenAI platform notice

ChatGPT/OpenAI independently processes chat content, account information, in-session widget state, follow-up messages, and platform telemetry under OpenAI's own terms and privacy practices. This policy does not replace OpenAI's policies; it describes Spheric Admin Ltd's processing through this App.

12) Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the effective date above and ensure the policy continues to reflect the App's current tool inputs, outputs, and disclosed data uses.

13) Contact

Questions about this policy or App privacy practices: privacy.widgets@olutely.com (Spheric Admin Ltd).