Last updated: May 2026

Last revised for Milestone v1.1 (Shared Savings v2): Cost Coach will store aggregated efficiency metrics once the new pricing model is active for your tenant — see “Aggregate Efficiency Metrics” and “Data Retention and Deletion” below for the full disclosure.

Privacy Policy

Cost Coach ("we", "us", "our") is an AI-powered AWS cost optimization service delivered as an MCP App through ChatGPT and Claude. This privacy policy explains what data we collect, what we store, what we do not store, and how we protect your information.

Data We Store

We are transparent about the data our systems retain. The following information is stored in our infrastructure:

Tenant Metadata (Amazon DynamoDB)

  • Tenant ID and AWS Account ID
  • IAM Role ARN and External ID for cross-account access
  • Onboarding state and optimization score
  • Subscription status and plan tier
  • Last connected timestamp (last_connected_at)
  • Billing baselines: last reported spend (cents), last reported savings (cents), and last reported billing period
  • Dismissed recommendation IDs (so dismissed items stay dismissed across sessions)

Authentication Data (AWS Cognito)

  • Email address
  • Hashed password (managed by AWS Cognito, not accessible to us)
  • MFA settings (managed by AWS Cognito)

We use AWS Cognito as our identity provider. Your password is hashed and managed entirely by Cognito's infrastructure — our application code never sees or stores your plaintext password.

Billing Data (Stripe)

  • Stripe Customer ID and Subscription ID
  • Payment method references (managed by Stripe's PCI-compliant infrastructure)

Payment card details are handled exclusively by Stripe. We never store credit card numbers, CVVs, or other sensitive payment information in our systems.

Data We Do NOT Store

This is our key privacy differentiator. Cost Coach operates as a stateless intelligence layer — we query your AWS data in real time and never persist it:

  • AWS cost data: Queried in real time via the AWS Cost Explorer API. Each request fetches fresh data directly from AWS. We do not store cost reports, historical snapshots, or spending data.
  • AWS resource inventory: Queried in real time via EC2, ELB, and CloudWatch APIs. Instance details, EBS volumes, Elastic IPs, and load balancer data are never persisted.
  • AWS tag data: Queried in real time via the Resource Groups Tagging API. Tag keys, values, and coverage metrics are never stored.
  • Conversation history: Your conversations are stored by your AI assistant (ChatGPT or Claude) according to their privacy policies, not by Cost Coach.
  • No cost reports, no CSV exports, no S3 data lakes of your AWS cost data exist in our infrastructure.

Aggregate Efficiency Metrics

What is changing in Milestone v1.1 (Shared Savings v2): Cost Coach will store aggregated efficiency metrics for Shared Savings v2 once this model is active for your tenant. When this model is active, Cost Coach stores aggregated efficiency metrics only — no resource IDs, no workload names, no raw logs. The previous “stateless intelligence layer” promise still holds for everything except these aggregates. Existing tenants will be notified before the new model is activated for them.

What we will store as aggregates:

  • Weekly organization-level efficiency aggregates: one row per measured dimension per week, computed from your AWS Cost Explorer data and default CloudWatch metrics
  • A workload-type label: a single high-level classification per tenant inferred from your service-mix percentages

What we still do NOT store:

  • No resource IDs: we do not record EC2 instance IDs, EBS volume IDs, RDS DB identifiers, S3 bucket names, or any other resource identifier
  • No workload names: we do not record tag values that name applications, services, environments, or owners
  • No raw logs: we do not record CloudTrail events, CloudWatch log streams, VPC flow logs, or any other event-level data
  • No conversation history: your AI assistant (ChatGPT or Claude) stores conversations, not Cost Coach

The aggregates are designed so an outside observer reading our database cannot tell which workloads run in your account, only how efficient your organization-level resource usage is over time.

How We Access Your AWS Account

Cost Coach uses the industry-standard cross-account IAM role pattern to access your AWS billing data:

  • Read-only access: The IAM role grants read-only permissions scoped to four areas: cost & billing (ce:Get*, budgets:Describe*), account inventory (organizations:List*, tag:Get*), resource describes (ec2:Describe*, rds:Describe*, elasticache:Describe*, redshift:Describe*, elasticloadbalancing:Describe*, s3:ListAllMyBuckets), and utilization metrics (cloudwatch:GetMetricStatistics, cloudwatch:ListMetrics). Read operations only — no resources can be created, modified, or deleted.
  • Temporary credentials: We use AWS STS AssumeRole to obtain temporary credentials that expire after 1 hour. No long-lived access keys are stored.
  • External ID protection: Each tenant has a unique External ID that prevents confused deputy attacks.
  • Revocable at any time: You can revoke access instantly by deleting the CloudFormation stack in your AWS account or by using the disconnect_aws_account tool.

Third-Party Services

Cost Coach integrates with the following third-party services:

  • Amazon Web Services (AWS): Infrastructure hosting, Cognito authentication, and the APIs we query on your behalf.
  • Stripe: Payment processing. Stripe is PCI DSS Level 1 compliant. Their privacy policy applies to payment data they process.
  • ChatGPT / Claude: Conversation interface. Their respective privacy policies apply to conversation data stored in their platforms.

Data Retention and Deletion

Active accounts — tenant configuration: tenant metadata, IAM role references, and billing baselines are retained while your account is active.

Active accounts — aggregate efficiency metrics (when the v1.1 model is active for your tenant): weekly aggregate records are retained on a 5-year rolling window. Records older than 5 years are automatically deleted via DynamoDB Time-To-Live; AWS performs the deletion within ~48 hours of the 5-year anniversary. We do not extend, copy, or archive aggregates beyond the rolling window.

Disconnecting your AWS account: revoking AWS access removes IAM role references from our database but preserves your subscription record and (when the v1.1 model is active) your existing aggregate history so you can reconnect later. Aggregate collection pauses while disconnected.

Account closure (full deletion): you can close your account at any time, either from inside Cost Coach or by canceling your subscription via the Stripe customer portal. Either path stamps a closure timestamp on your tenant record. When you close your account, your aggregate records are deleted on the next scheduled monthly sweep after a 30-day grace period — typically 30 to 60 days from the closure date. This deletion covers all weekly aggregate records (when the v1.1 model has been active), your tenant configuration, and any baseline/savings persistence. Your Stripe customer record remains in Stripe's control under their independent retention policy.

During the 30-day grace window your account is in a closing state. If you change your mind, contact us at the email below before the window expires and we can reverse the closure.

Security

All data in transit is encrypted via TLS. Data at rest in DynamoDB is encrypted using AWS-managed keys. Our infrastructure runs on AWS Lambda with no persistent servers, reducing the attack surface.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected in the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

Contact

For questions about this privacy policy or to request data deletion, contact us at: guy@mlguy.us