LIAM · PRIVACY POLICY

Privacy Policy

Liam is a tool you run against your own advertising accounts. It has no user accounts and no database. Your credentials and your ad data stay on your machine. Last updated 4 August 2026.

Scope

Three things this covers.

  • This website, liam-mcp.vercel.app, which is documentation.
  • The tool you run locally, the liam CLI and the MCP server, on your own computer.
  • The hosted MCP endpoint at /api/mcp, which relays requests to LinkedIn on behalf of whoever calls it.

Liam is operated by Default (default.com). There is no sign-up, no user account, and no profile. We do not know who you are unless you email us.

The website

Anonymous, aggregate page analytics.

This site uses Vercel Analytics to count page views. It records the page visited, the referrer, and coarse device and country information. It does not use cookies, does not fingerprint visitors, and does not build a profile that identifies you. That is the only analytics on the site, and there is no advertising or tracking pixel of any kind.

The local tool

Nothing leaves your machine except calls to the ad platform.

When you run Liam locally, it talks directly from your computer to LinkedIn and Google. Nothing is sent to us. There is no telemetry, no usage reporting, and no phone-home of any kind in the CLI or the local MCP server.

Everything it stores, it stores on your own disk, in the ~/.liads directory:

  • Application credentials and OAuth tokens for each platform, written with owner-only file permissions. These never leave your machine.
  • A change journal, a local log of the campaign changes Liam has made, used to compare performance before and after a change. It records entity ids and the fields that changed. It is a plain file you can read or delete at any time.

To revoke Liam’s access entirely, delete that directory and remove the application’s access in your Google account permissions or LinkedIn settings.

The hosted endpoint

Credentials live for the length of one request.

The hosted MCP endpoint accepts LinkedIn application credentials as request headers and uses them to call LinkedIn on your behalf. Those credentials are held in memory only for as long as the request needs them. They are never written to disk, never stored in a database, and never logged.

No campaign data, audience data, or report data passes through storage: results are returned to the caller and discarded. We record anonymous request counts for the endpoint, specifically the API method name and which tool was called, so we can see whether it is working. We never record the arguments to a call or any credential.

The Google Ads tools are deliberately not available on the hosted endpoint. Google functionality runs only in the local tool, against credentials on your own machine.

Google user data

What we access from Google, and what we do with it.

When you connect a Google account, Liam requests a single scope, https://www.googleapis.com/auth/adwords, which grants access to the Google Ads accounts your Google user can already reach. We request nothing else: no email, profile, contacts, Drive, or Gmail access.

That access is used for exactly three things, all initiated by you:

  • Creating paused campaigns, ad groups, keywords, and ads in your own ad accounts.
  • Reading performance figures for those campaigns so they can be shown back to you.
  • Requesting keyword volume and bid estimates before you commit budget.

Data obtained from Google APIs is used only to provide these features to you, in the session in which you asked for them. It is not stored on any server we control, not sold, not shared with third parties, not used for advertising, and not used to train any machine-learning or artificial-intelligence model. Liam’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

LinkedIn data

The same rules, with one thing to know about audiences.

LinkedIn access is used to create campaigns and read reporting on your own ad accounts, on the same terms as above.

One case deserves naming. If you upload a contact list as a matched audience, Liam reads that file on your machine, hashes the email addresses with SHA-256 as LinkedIn requires, and uploads the hashes directly to LinkedIn. The list is never sent to us, and the unhashed addresses never leave your computer. You are responsible for having a lawful basis to use that list for advertising.

Third parties

Who else is involved.

  • LinkedIn and Google, because that is what the tool calls. Their handling of your data is governed by their own privacy policies.
  • Vercel, which hosts this website and the MCP endpoint and processes the request logs and analytics described above.

We do not sell data, and there is no advertising network on this site.

Contact

Questions, or a request about your data.

Email stan@default.com. Because we hold no user accounts and no stored personal data, most requests resolve to deleting your local ~/.liads directory and revoking the OAuth grant, both of which are entirely in your hands. If this policy changes, the date at the top of the page changes with it, and the full history is public in the repository.