What we store, and what we don't

Page views

When a page of this site has loaded, your browser sends us its address. For each view we store only:

• the page's path, such as /templates/launch, without any query string except the templates page's stack and category filters;
• the website that linked you here, as a hostname only (for example github.com), never the full address;
• whether the screen is a desktop, phone or tablet;
• your country, as reported by our host (Vercel), never your city or IP address;
• a visitor code that lets us count how many different people visited on one day. It is a one-way hash of your IP address and browser, mixed with a secret and that day's date, so it changes every day and can't be turned back into either. The IP address and browser details themselves are never stored.
• a flood-control code, so one address can't send us thousands of fake views: a one-way hash of your IP address, mixed with a secret and the current hour. It changes every hour and is erased from stored views soon after its hour is over.

Opening a live demo in a tab of its own is counted the same way. The counter uses no cookies, no browser storage and no fingerprinting, and nothing from it is shared with anyone. (The only thing this site keeps in your browser, unless you sign in, is your light or dark theme choice.) We don't count admin and account pages, visits from search-engine crawlers and other bots, or pages loaded in advance by the browser.

If your browser sends Do Not Track or Global Privacy Control, nothing is sent or stored at all. Individual views are kept for 90 days; after that only daily totals per page remain.

Vercel Web Analytics

We also use Vercel Web Analytics, from the company that hosts this site, to see page views and where visitors come from. It uses no cookies; Vercel tells visits apart with a hash that changes every day and doesn't keep your IP address. We send it the page's address without anything after a ? or #, and nothing at all if your browser sends Do Not Track or Global Privacy Control. It also counts some actions, such as downloads, demo opens, sign-ups and purchases, with details like which template, but never your name, email address or account.

Downloads

Each download records the template, the stack, the time, your country and a keyed hash of your IP address (used to ignore repeated clicks and scripted downloads, never the address itself), plus whether it came from a browser or a bot and from this site or a link elsewhere (worked out from the request; your browser details aren't kept). If you're signed in, it's also linked to your account so you can see your download history.

Accounts

An account is optional. It stores your name, email address, a hash of your password (or the GitHub or Google account you sign in with), your favourites, votes and requests, and any purchases. A profile photo you upload is resized in your browser (which also removes its location and camera details) and stored with Vercel Blob at a public but unguessable address; changing or removing it deletes the old one. Signing in sets one session cookie; each session records the IP address and browser it was started from, which you can see and end in your settings. Deleting your account deletes all of this; downloads and requests are kept without any link to you, and contact messages are kept as sent unless you ask us to delete them.

Payments

Paid templates are bought through Stripe Checkout. Card details go to Stripe, never to us; we keep the amount, the template and Stripe's reference for the payment.

Contact messages

Messages sent through the contact form keep the name, email address and message you write, and a keyed hash of your IP address to limit spam.

Newsletter

Signing up for the newsletter stores your email address as unconfirmed and sends one email with a confirmation link; nothing else is sent unless you click it. We keep the address, when you signed up, confirmed or unsubscribed, the page you signed up from, and keyed hashes of the IP addresses used (to limit spam and as a record of your consent). Confirmed addresses are also kept by Resend, which sends the newsletter for us. Every newsletter has an unsubscribe link, and unsubscribing stops all of them.

Questions

Ask us anything about your data, or ask us to delete it, through the contact form.