Skip to main content

Privacy

What this site stores, and what it does not.

You can browse, copy an install command and install any component without an account, and nothing on this page applies to you. Everything below describes what happens only if you sign in, save a component, submit one, leave a testimonial, or subscribe to the email list.

Browsing without an account

No sign-in, no session cookie, no personal data. The site records anonymous, aggregate page analytics through Vercel Web Analytics and Vercel Speed Insights — page views and Core Web Vitals timings, no cross-site tracking cookie and no advertising profile. Those two scripts do not load inside component preview iframes.

If you sign in

Accounts are handled by Convex Auth: GitHub, Google, or a one-time code emailed to you. No passwords are stored. What is stored is your email address (or the provider identity you signed in with) and the session and refresh token records needed to keep you signed in. If you fill in a profile: a display name, an optional bio and link, and up to three category tags. If you save components: which ones, and which collections you put them in.

Two additional records exist only to rate-limit abuse and hold no personal data on their own: a salted, non-reversible hash of any email address that requests a sign-in code, and a per-account counter for save requests.

Everything you create is private until you publish it. A profile, a save or a collection is invisible to everyone but you from the moment it is created — that default is enforced in the database, not just in the interface.

Cookies

Only session cookies, only after you sign in: __Host-__convexAuthJWT and __Host-__convexAuthRefreshToken, both HttpOnly, Secure and SameSite=Lax. There are no advertising or analytics cookies. Session tokens are deliberately kept out of localStorage so that component code running on the page cannot read them. Your theme and sidebar preferences are stored in your own browser and never sent anywhere.

Third parties that process data

  • Vercel — hosting; serves every request, and provides the anonymous analytics and performance timings described above.
  • Convex — the database and authentication backend that stores accounts, profiles, saves, collections, submissions and testimonials.
  • GitHub and Google — only if you choose one of them to sign in, or connect GitHub to open a submission pull request on your behalf.
  • EmailOctopus — only if you submit the email form; your address is stored on that list until you unsubscribe, using the link in any email it sends.

What is never collected

No uploaded files or avatar images, no payment details (nothing here is paid for), no cross-site tracking, and nothing sold or shared with advertisers. Provider avatars are not fetched in your browser, so viewing a page never sends your IP address to GitHub or Google.

Deleting your data

Self-service account deletion is specified but not yet built. Until it ships, email nikolas.sapalidis@gmail.com from the address on the account and every record tied to it — profile, saves, collections, submissions and testimonials — will be deleted manually. The same address handles any question about what is held about you, and any request for a copy of it.

Security issues go through the process in SECURITY.md rather than this address. More about the project is on /about.