Privacy policy

No tracking

There are no analytics, no ads and no third-party trackers here. Like any website, our host receives your IP address and browser details with each request in order to serve the page.

Your account

Signing in needs only an email address: we email you a one-time link instead of asking for a password. Each link works once, expires after 5 minutes, and is deleted when used.

Where Google or GitHub sign-in is offered and you choose it, that service shares your name, email address and profile picture link with us. We store them with your account, along with the account ID and sign-in tokens it issues.

For each signed-in session we store when it expires, and the IP address and browser (user agent) it started from.

Your saves and collections are stored with your account so they follow you to every device.

Email

Sign-in links are sent through Resend, an email delivery service. We don't send newsletters or marketing email.

Takedown requests

The takedown form asks for your name, email address, whether you run the site or act for whoever does, and any details you add. It isn't stored in our database: it's delivered to us by email (through Resend), to a private team chat, or both, so we can act on it and reply.

Where it's kept

The site is hosted on Vercel. Accounts, sessions, saves and pending sign-in links are kept in a Postgres database run by Supabase. These services, and Resend, process data for us to run the site; we don't sell it or share it with anyone else.

In your browser

Cookies: one that keeps you signed in (only once you sign in), a short-lived one while you sign in with Google or GitHub, uiv.lang for the language you switched to, and uiv.cols for the number of feed columns you picked. All are ours; none follow you to other sites.

Local storage keeps your saves while you're signed out (and, signed in, a copy of your account's saves so pages paint quickly), the getting-started guide's progress, your light or dark theme, and how many prompts you've generated this month. It stays on your device; clearing this site's data removes it.

Abuse limits

Sign-in, takedown requests and the agent API (/api/mcp) count requests per IP address to stop abuse. Those counts are held briefly in server memory and never written to the database.

Deleting your data

You can delete your account from your profile page. That removes your account, any linked Google or GitHub login, your sessions, saves, collections and unused sign-in links from our database, straight away. The copies in that browser are cleared too.

Websites shown here

Uiverse shows screenshots of public websites. If you run one of them, you can have everything from your domain removed, and kept out of future captures, through the takedown page.

Changes

If this policy changes, we'll update this page and the date at the top.