Privacy

This page says what is collected, why, and what is not. It is short because very little is collected.

What is stored

• Your email address. It is the account. Nothing else identifies you.
• A password, hashed. Only for accounts that use one (not Google or GitHub sign-in). It is stored with scrypt and a salt, never in a form anyone can read, and never logged.
• A name and username, if you choose to set them on your profile, and your email notification preferences.
• A line per copy. Which component, and when. That is what the counter counts and what the account page shows you.
• A session cookie once you sign in, so you stay signed in. It holds a random token, nothing about you. See the cookies page.
• Your language choice. Kept in your own browser, not on a server.

What is not stored

• No plain-text password. What is kept is a one-way hash, useless to anyone who reads it.
• No payment card. If and when payment is taken, it is handled by the payment provider and the card never reaches this site.
• No tracking pixels, no advertising identifiers, no third-party analytics, no session recording.
• No profile assembled from anything you do elsewhere.

Who else sees it

Nobody. It is not sold, rented, shared with advertisers, or handed to anyone for any purpose other than running the account you asked for.

What leaves your browser to third parties

Two things, and both are worth knowing about:

• Google Fonts. The typeface is loaded from Google's servers, which means Google sees the request.
• esm.sh and jsDelivr. Live previews compile in your browser and fetch the packages a component needs from these CDNs. They see which packages were requested.

Neither is sent your address or anything about your account.

Your rights

Ask and your account and its copy log are deleted, in full, and that is the end of it. Ask and you get a copy of everything held about you, which will be a short file. There is no retention period being run down behind your back.

Cookies

None are set. The account and the language choice live in localStorage, which stays in your browser and is never sent anywhere on its own.

Where the data is

Until the hosted backend is live, everything described here is stored in your own browser and has never left your machine. When it moves to a server, this page will say where that server is before it happens.