Trakt MCP stores your Trakt access and refresh tokens in Cloudflare Durable Objects and a Workers KV cache to provide the requested read-only API tools. Each connection has isolated credentials. Data tools forward your requests to Trakt. Tokens are never returned to other users. Disconnect by revoking the application in Trakt settings; local data deletion is available via DELETE /auth/session with your plugin bearer token. See the deployment documentation for support. Durable Object records are not automatically deleted when credentials expire. The KV token copy has a 30-day expiry from its last write. Local deletion does not revoke the upstream Trakt grant; revoke it separately in Trakt settings. Application code does not store viewing history, but requested results pass through this service and the connected AI client. Cloudflare handles infrastructure telemetry under its own policies. Request/response bodies and authorization credentials are not logged by application code.