Privacy Policy

1. Who we are

reframe/ui ("we", "us") is an independent UI component library and template gallery operated by an individual developer (@thommysart) at ui.thommysart.me.

For data-protection purposes we act as the data controller for personal data described here. Contact us at thommysart@gmail.com for any privacy request, including access, correction, deletion, or questions about this policy.

2. What we collect

We collect the minimum needed to run accounts, saved boards, paid plans, and a fast site. You provide some directly; the rest is generated when you use the product.

• Account data (via Clerk): email address, name or username, avatar image, authentication identifiers (Clerk user ID), sign-in method (email, Google, GitHub, or other OAuth provider), and account / subscription status.
• Saved content (via Convex): bookmarks, boards you create (names, timestamps), and board items (component or template IDs you save). These are tied to your Clerk user ID so they load on your devices.
• Billing status (via Clerk Billing): whether you hold the Pro plan and its renewal state. Card numbers and full payment details are processed by Clerk's payment provider — we do not store them.
• Technical and usage data: IP address, device and browser type, pages viewed, referring URLs, and coarse performance diagnostics collected through Vercel hosting, Vercel Analytics, and Speed Insights.
• Preferences: theme choice (light/dark/system) and similar interface settings stored locally or in your account.
• Communications: emails you send to thommysart@gmail.com and any support details you include.

We do not collect precise geolocation, biometric data, or sensitive categories, and we do not build advertising profiles.

3. Why we use it (purposes and legal bases)

EU/UK law requires a legal basis for each use. Our bases are:

• Provide the service (contract): sign-in, saving and syncing boards/bookmarks, gating Pro components, and customer support.
• Operate and secure the site (legitimate interests): hosting, performance monitoring, error debugging, abuse prevention, and enforcing our Terms and Usage License.
• Improve the product (legitimate interests): aggregated analytics about which docs, components, and templates are used, so we know what to build next.
• Billing (contract + legal obligation): creating and managing Pro subscriptions, invoicing records, and tax compliance.
• Marketing only with consent: we do not send marketing email today. If that changes, it will be opt-in and you can unsubscribe at any time.

4. Who we share data with

We share data only with the service providers needed to run the site. We do not sell personal information and we do not share it for cross-context behavioral advertising.

Providers process data only on our instructions under their data processing terms. We also disclose data when required by law, to protect against fraud or abuse, or to enforce our agreements. If the project is transferred (for example an acquisition), users will be notified before personal data moves to a new controller.

5. Cookies and similar technologies

We use strictly necessary cookies for sign-in (Clerk session), security and load balancing, and theme preference — plus privacy-conscious analytics from Vercel. There is no third-party advertising cookie on the site. Full details, lifetimes, and controls are in our Cookie Policy.

6. Retention

• Account and saved content: kept while your account is active. Deleting boards, bookmarks, or your Clerk account removes the associated content from our active database within a reasonable period (backups expire on their normal cycle).
• Billing records: kept as required for accounting and tax law, typically several years depending on jurisdiction.
• Analytics and logs: aggregated or deleted on a rolling basis, generally within 12–24 months.
• Support email: kept as long as needed to resolve your request and maintain a record of consent or complaints.

7. Security and international transfers

Traffic is encrypted in transit (HTTPS), access to production systems is restricted, and providers are selected for SOC 2 / ISO-aligned controls where available. No system is perfectly secure — contact us immediately if you suspect unauthorized access to your account.

Our providers may process data in the US, EU, or other regions where they operate. Where EU/UK data is transferred internationally, we rely on adequacy decisions or Standard Contractual Clauses in provider DPAs, plus supplementary safeguards.

8. Your rights (GDPR / UK GDPR)

If you are in the European Economic Area, UK, or Switzerland, you have the right to access, rectify, erase, port, restrict, or object to processing of your personal data, and to withdraw consent at any time (withdrawal does not affect prior lawful processing).

Exercise them by emailing thommysart@gmail.com from your account email. We respond within one month (extendable by two months for complex requests). You can delete boards and bookmarks directly in the product at any time. You also have the right to lodge a complaint with your local supervisory authority (for example your EU member-state DPA or the UK ICO).

9. Your rights (California / US states)

• Know, delete, correct: under the CCPA/CPRA you may request what we collected, request deletion or correction, and ask how we use it.
• No sale or sharing: we do not sell personal information and do not share it for cross-context behavioral advertising, so there is no opt-out toggle to maintain.
• No discrimination: exercising your rights will never change the price or quality of the service except as permitted by law.
• Agents: you may use an authorized agent with signed permission; we will verify both identities.

Submit requests to thommysart@gmail.com with the subject "Privacy request". We verify you via your account email and respond within 45 days (extendable once by 45 days with notice). Similar rights exist in Colorado, Connecticut, Virginia, Utah, and other states — we honor them the same way.

10. Children

reframe/ui is for developers and is not directed to children under 13 (or under 16 where GDPR requires a higher threshold). We do not knowingly collect data from children. If you believe a child provided data, contact us and we will delete it promptly.

11. Changes to this policy

We update this policy as the product and laws evolve. Material changes will be announced by updating the date above and, where appropriate, by notice in the product or email. Continued use after the effective date means you accept the updated policy.