Privacy

Written from the code of this site, not from a template. Where something has not been decided, it says so.

In short

You can browse this site without an account. If you create one, we store your email address and the things you make here — favourites, generated sections, saved builds — so they are there the next time you sign in. We do not run advertising, we do not set tracking cookies, and we do not sell anything to anyone.

This page describes what the code does today. It is deliberately specific: if something is not listed here, the site does not do it.

What we store when you have an account

Your account itself lives in the authentication system of our backend provider (see 'Third parties'). It holds your email address, an encrypted password, and the timestamps of sign-up and confirmation. On top of that, these tables exist in our database:

  • profiles — your user id, email address, display name, avatar URL, created/updated timestamps.
  • user_roles — your user id plus a role, used only to recognise an administrator.
  • favorites — your user id and the slug of a block you saved.
  • favourite_folders and favourite_folder_items — folder names you create and which saved blocks are in them.
  • generations — sections you generated: your user id, the title, the prompt and the generated result.
  • lab_projects — projects you keep in the Sections lab: your user id, title and content.
  • plan_interest — your user id and which plan or feature you asked to be notified about.
  • admin_actions — an audit trail of administrator actions: which admin, which action, on what.
  • rate_limit_events — one row per rate-limited request: a bucket name, a timestamp, and a subject. For signed-in users the subject is your user id; for anonymous requests it is a SHA-256 hash of your IP address. We never store the IP address itself, and the hash cannot be turned back into it.
  • project_prompts and project_stats — these are about the library, not about you. project_stats holds a slug and how many people saved it (a count, no user ids).

Cookies and browser storage

We do not set any tracking or analytics cookies, so there is no cookie banner on this site — there is nothing to consent to. Your sign-in session is kept in your browser's localStorage rather than in a cookie, under a key that starts with 'sb-' and ends with '-auth-token'.

Besides the session, the site stores these keys in localStorage, purely so the interface remembers your own work and preferences. They stay in your browser, and clearing your browser data removes them:

  • sparks:favourites and sparks:favourite-folders — a local copy of your saved blocks and folders.
  • sparks:generations — a local copy of sections you generated.
  • sparks:custom-sections, sparks:custom-sections-retitled-v5, sparks:custom-sections-recategorized-v4 — cached sections and flags marking one-off clean-ups as done.
  • sparks:lab-projects and sparks:lab-intro-dismissed — your lab projects and whether you closed the intro.
  • sparks:design-systems — design tokens you edited on the Design.md page.
  • sparks:pending-plan — the plan you clicked on before signing in, so it can be attached to your account afterwards.
  • sections-category-filter — which category filter you last used.

Third parties that are actually involved

  • Supabase — our backend provider: database, authentication and the account emails (confirmation and password reset). Your account data lives there, and it sees the IP address of requests as any host does. TODO (owner): confirm and publish the hosting region.
  • Google Fonts — no longer used. The typeface is served from this site itself, so your browser makes no request to Google when loading a page.
  • Media hosts — preview images and videos are loaded directly from the hosts they live on, including Cloudflare R2 (pub-*.r2.dev), images.higgs.ai, image.mux.com and motionsites.ai. Loading an image means your browser contacts that host, which sees your IP address and user agent.
  • Lovable AI Gateway — when you generate a section or a live preview, the prompt is sent to this gateway and on to the AI model that answers. Do not put confidential information in a prompt.
  • No analytics, advertising, tracking pixels or social embeds are loaded anywhere on this site.

How long we keep things

Honestly: no retention periods have been decided yet, and there is no automatic clean-up job. Your account data stays until it is deleted, and the audit and rate-limit rows currently stay indefinitely. Rather than print a number we do not honour, we are stating this openly. TODO (owner): decide and publish a retention period per table, at minimum for admin_actions and rate_limit_events.

Deleting your account is not self-service in the interface yet. Until it is, that is a manual request — see 'Contact' below.

Your rights

You can see and change your display name and avatar on your account page, and you can remove favourites, folders, generations and lab projects yourself at any time. For access to, correction of, or deletion of everything else, you need to reach us — and that is where the honest gap is, see below.

Contact

There is no support channel yet — no support email address has been published for this site. That means there is currently no address to send a privacy request to, which we are not going to paper over with an address that does not work. As soon as one exists it will appear here and in the site footer.