Privacy Policy

Last updated: October 17, 2026

This Privacy Policy explains what personal data we collect when you visit shadcndesign.com, buy our products, contact us, use DS Manager at manager.shadcndesign.com or connect an AI agent to DS Manager over MCP. It also explains what we do with that data and what rights you have.

Jump to a section: Who we are · What we collect on the website · What we collect in DS Manager · Connected agents (MCP) · Figma sync · AI providers · How we use your data · Emails we send · Cookies · Service providers · How long we keep data · International transfers · Your rights · California notice · When we disclose data · Security · Customer logos and testimonials · Children · Links to other websites · Changes · Contact

Who we are

ShadcnDesign ("we", "us" or "our") is the controller of your personal data on this website and in DS Manager. You can reach us at hi@shadcndesign.com.

What we collect on the website

The website has no accounts and no login.

Purchases

Polar (polar.sh) processes our payments and acts as the merchant of record. At checkout, Polar asks for your name, email address, billing address and payment details. Polar also runs the customer portal where you manage your orders and license keys. Polar handles your data under its own privacy policy, and we don't control how it does that.

When you start a checkout, we send Polar your IP address, which Polar uses for tax and fraud checks. We also send checkout metadata: your Google Analytics client ID and session ID, and the country and code of any regional discount. We choose the currency from the country of your IP address, which our host Vercel tells us.

To show regional prices, we send your IP address to ParityDeals, which tells us your country. We cache that answer for about 10 minutes.

After a purchase, Polar sends us the product, amount, order ID, date and your email address. Your card details never reach us.

Unfinished checkouts

If you enter your email address at checkout but don't finish the purchase, Polar tells us. We keep your email address, the product and the license for 7 days, and we may send you one reminder email with an unsubscribe link. Each address gets at most one reminder every 30 days. If you unsubscribe, we keep your address on file so we don't email you again.

Help form and support emails

The help form takes two kinds of requests:

  • Upgrade requests: your email address, your current license and the license you want.
  • Student discount requests: your student email address and, if you want, a link to a photo of your student ID that you share yourself, for example from Google Drive.

The form sends your request to us by email through Resend. If you use an academic email address, you get an automatic reply with the discount link.

For anything else, you write to us by email. We receive whatever you put in the message, such as an order number or a screen recording.

License key checks

When you or your tools install Pro Blocks from our registry, we check your license key with Polar. Older keys, bought before we moved to Polar, are checked with Lemon Squeezy. We also use your IP address and license key for a short time to limit how many requests one client can make (rate limiting). We keep that data in Upstash Redis.

Analytics and bot protection

Google Analytics 4 runs on every page of the website. It sets cookies and records the pages you visit, your device and browser type and similar usage data. When you buy something or get a refund, our server also sends the event to Google Analytics: order ID, value, currency, product, discount code and your Google Analytics client ID.

Vercel BotID checks visits to the help form and the checkout to block bots.

Embedded content

Some pages show content from other services: Loom videos in the free Academy lessons and in some blog posts, Figma file embeds on component pages, and Pro Blocks previews served from our own sites on Vercel. When a page loads them, your browser connects to those services, and they can set their own cookies.

Newsletter

Matt's newsletter is hosted on Gumroad. If you subscribe, Gumroad handles your email address under its own privacy policy.

What we collect in DS Manager

Your account

You sign in to DS Manager with GitHub or Google, and you need an email address that the provider has verified. After you sign in with one, you can link the other in Settings.

We store your name, email address, whether it is verified and your profile picture URL. With GitHub, we also store your GitHub username. For each provider you sign in with, we store your account ID with that provider, the tokens it issues when you sign in (access token, refresh token and ID token) and the permissions you granted.

We ask GitHub only for access to your profile and email addresses, and DS Manager doesn't use the token to read your repositories. We store every email address that GitHub lists as verified on your account, and we update that list each time you sign in with GitHub. When you confirm that a purchase made on shadcndesign.com is yours, we use your GitHub token to ask GitHub for your verified email addresses again.

From Google we receive your name, email address, profile picture and whether Google has verified the address.

When you sign in, we set a session cookie. With each session we store your IP address and your browser's user agent.

Your design systems

We store what you create: your design systems (tokens, settings, components, custom component code, uploaded fonts, logos and custom icons), the edit history of each system, up to 20 saved versions of each system, the registries you publish and your share links.

You can also use DS Manager without an account. Your systems then stay in your browser (IndexedDB) and never reach our servers.

Files you upload

Files you upload are stored inside the design system in our database on Neon. We don't use a separate file host.

  • Fonts: woff2, ttf or otf files, up to 200 KB each. People who open your share link receive the font file, because their browser needs it to show your system. Published registries contain no font files, and a fork doesn't copy them.
  • Logos, logo marks and favicons: SVG files, up to 256 KB each. We clean each file before we store it. Your published registry contains them, and a fork copies them.
  • Custom icons: SVG files only, up to 10 KB each after cleaning, and up to 500 icons or 1 MB in total per system. We clean each file before we store it. Adding or changing custom icons needs Pro or Lifetime. After your plan ends, the icons stay in your systems and you can still remove them. People who open your share link see your icons, and your published registry contains them as components/icons.tsx. A fork keeps the icon names but not the drawings.

When you remove a file, it stays in the system's edit history, in the saved versions of the system and in the registry versions you published. Edit history and saved versions are deleted with the system. Files of a registry you published are deleted within a day after you delete the registry, the system or your account. If you only unpublish a registry, we keep its files so you can publish it again. A file with the same content as a file in another live registry stays until no registry uses it.

What other people can see

Anyone with the URL of a published registry can reach it. The URL has the form /u/<user ID>/r/<name>. The user ID is an internal ID, not your name or username, and the name at the end is made from your design system's name. Search engines don't index registry pages.

A share link shows your design system to anyone who has the link, including the fonts, images and custom icons you uploaded. It doesn't show your name. You can hide the default components, your custom components or ProBlocks from the link, and choose the theme it opens in. While forks are on, the link shows everything. If you allow forks, people with the link can copy the system into their own account, without the fonts you uploaded and without the drawings of your custom icons.

Share pages ask search engines not to index them. When someone pastes a share link into X, Facebook, LinkedIn, Slack or Discord, that service's link-preview bot can read the page to build a preview image. The image shows the system's name, fonts, colors and radius, never you, and we cache it for up to 1 hour.

Agent chats

We store your chats with the agent until you delete the chat, the design system or your account. A chat includes the files you attach and the screenshots of your canvas the agent takes. You can attach images, PDFs and text files (HTML, CSS, TXT, Markdown, JSON and SVG), up to 10 MB each.

For each AI call we keep a usage record with the model, provider, token counts and cost. We use these records for billing and to enforce limits that stop abuse.

Your API keys

On Pro and Lifetime you can add your own API key for an AI provider. We encrypt it with AES-256-GCM, using an encryption key unique to your account. After you save it, we show only its last 4 characters and never show the full key again. We decrypt it only for the request that uses it. When your Pro or Lifetime plan ends, we delete your saved keys within a day.

Billing

Polar handles DS Manager payments. We send Polar your DS Manager user ID, your email address and the product you buy. We store your plan, your subscription status, billing interval and billing period, your Polar customer, subscription and order IDs, and your AI credit balance. Your card details never reach us.

So that we can link a plan you bought to your account, we ask Polar whether it has a customer with your DS Manager user ID or your email address. We ask at each sign-in and in a nightly check, even if you never bought anything. When you buy DS Manager on shadcndesign.com with the verified email address of your account, we link the purchase to your account when it's paid or at your next sign-in, unless you told us it isn't yours or another account uses the same address. A purchase made with any other address is linked only after you confirm it's yours.

On the Plans tab you can attach a purchase made on shadcndesign.com. Your browser sends the email address you type straight to Polar, and Polar emails a code to that address. When DS Manager asks whether a purchase is yours, it shows the buyer's email address masked, for example a***@x.com. If you answer that it isn't yours, we note your user ID on that Polar customer so we don't ask you again.

Analytics and fonts

DS Manager uses Vercel Web Analytics, which counts page views without cookies. It also runs on share pages and published registry pages. We remove share-link tokens from the URLs it records. Vercel BotID protects the agent from bots.

DS Manager serves 26 featured Google Fonts families from its own servers. Other Google Fonts load from Google in your browser. Our server also fetches Google Fonts to draw share-link preview images. Fonts or stylesheets you add by URL load straight from those URLs.

Connected agents (MCP)

DS Manager has an MCP server. Through it you can connect an AI agent you use, such as Claude, ChatGPT, Codex or Cursor. The agent then acts as you in DS Manager. You sign in with your DS Manager login, GitHub or Google, and the agent gets its own tokens, never your session cookie.

The Allow screen

Before an agent connects, DS Manager shows you an Allow screen. It names the agent and says that the agent will act as you, with your name and email address. It lists what the agent can do and shows the address your browser returns to. It also says "Only allow agents you started yourself." You allow the whole list or nothing. An agent you allow can:

  • read your design systems
  • change your design systems. You can undo any change in the editor, and imports wait for your review.
  • prepare changes for your shadcndesign Figma kit, run through your own Figma connection
  • prepare a publish. You still press Publish in DS Manager.
  • stay connected until you revoke it in Settings > MCP, or until it goes unused for 30 days

What an agent can read and change

An agent can read your design systems. It can create systems and change them: set tokens, set fonts from the font catalog or from fonts you already uploaded, edit component rules, add variants, write custom component code, import a project's theme and convert a design from Figma.

With Pro or Lifetime, an agent can also add, rename or remove custom icons with the set_icons tool. The agent sends the SVG files itself. When an agent reads a system, it gets only the names of your custom icons.

Apart from removing custom icons, which you can undo, an agent can't delete anything. It can't unpublish anything, apply a review, upload a font or logo, or change your Lint locks. It can't reach other people's design systems. Its calls spend no AI credits, and DS Manager fetches no URLs for it.

We save each edit an agent makes under the agent's own name in the system's edit history. We group an agent's edits, so you can undo them in one step.

Project imports and reviews

When an agent imports a project's theme, it sends DS Manager files from that project: components.json, the global stylesheet, the Tailwind config, the root layout and the files of the components/ui folder. We store these files as text and never run them. We delete them 30 minutes after the import starts.

What an import proposes waits on a review page until you apply it. We delete a review 30 days after it's proposed.

What we store about agents

  • The agent's registration. An agent registers itself before it connects, and we store what it sends: its name, the addresses it returns to, links to its website, contacts, terms and privacy policy, and its software ID and version. We never show or fetch a logo address it sends.
  • Your consent: which agent you allowed and what it may do.
  • The agent's codes and tokens, stored as SHA-256 hashes. An access token lasts 1 hour. A refresh token lasts 30 days, and the agent gets a new one each time it uses it.
  • The IP address of each token refresh, for about 20 seconds. We use it to tell a second copy of the same agent apart from a stolen token.
  • A log of the agent's calls. For each call we record the tool, the time, the outcome, how long it took, the size of the answer, the agent's name and version, its user agent, your plan and the ID of the system it named. We never record what the agent sent or what DS Manager answered.

How we use this data

We use this data to let the agent act as you, to show you which agents you connected and what they did, to count the Free plan's allowance and the usage caps, and to stop abuse.

Who receives your data

Whatever an agent reads from DS Manager goes to that agent and to the AI provider it runs on. They handle it under their own terms and privacy policies, and we don't control what they do with it. You choose the agents you connect, and they aren't our service providers.

How long we keep it

  • Access tokens: 1 hour. Refresh tokens: 30 days. We delete token records 30 days after they're created.
  • Your consent: until you revoke the agent, or until it goes unused for 30 days.
  • An agent's registration: deleted once no connection uses it and it is more than 7 days old.
  • The call log: 90 days.
  • The IP address of a token refresh: about 20 seconds.

Your controls

Settings > MCP lists the agents you connected. For each one it shows its name, when you allowed it, when it was last used, the last tool it called and what it can do. It also shows the latest 50 calls, without what the agent sent. You can revoke one agent, or all of them, on every plan. Revoking deletes the agent's tokens, its unused codes and your consent, and the agent loses access on its next call.

Figma sync

An agent you connect can sync a design system with your copy of the shadcndesign Figma kit. DS Manager never calls Figma and holds no Figma token. Your agent runs each step through your own Figma connection and sends DS Manager what Figma returned. A push writes variable values and plugin data into your Figma file.

We store:

  • the link between a system and a Figma file: the file key, the file name, the kit version and timestamps
  • the values that DS Manager and the file last agreed on
  • your last push, so you can undo it

We keep these until you unlink the file in Settings > MCP, or delete the system or your account. The state of a sync step lasts 30 minutes.

AI providers

The DS Manager agent runs on AI models from other companies:

  • Included AI credits and the free trial use Grok from xAI.
  • With your own API key (Pro and Lifetime), the agent can use Anthropic (Claude), OpenAI, xAI or Google (Gemini). Your requests then fall under that provider's terms.

When you use the agent, we send the provider your messages, the files you attach (images, PDFs and text), the design-system context the agent needs (including the names of up to 60 of your custom icons), screenshots of your canvas, the content of links you paste (our server fetches the page) and our system prompt. When you save an API key, we send it to the provider once to check that it works.

DS Manager calls no AI provider for the agents you connect over MCP. Those agents run on their own providers (see Connected agents (MCP)).

We don't use your design systems or chats to train AI models. Each provider handles the data under its own privacy policy:

How we use your data

Under the GDPR, every use of personal data needs a lawful basis. These are ours:

  • Selling you products, delivering licenses and running DS Manager, including the agent: performance of a contract.
  • Letting the agents you connect over MCP act as you, syncing with your Figma file and showing you what your agents did: performance of a contract.
  • Linking a plan you bought to your DS Manager account, including the Polar lookups at sign-in and every night: performance of a contract and legitimate interests.
  • Checking license keys, limiting request rates and enforcing usage caps for connected agents: performance of a contract and legitimate interests.
  • Answering support, upgrade and student discount requests: performance of a contract and legitimate interests.
  • Sending checkout reminders, and product update emails to customers: legitimate interests. You can unsubscribe at any time.
  • Preventing fraud, blocking bots and stopping abuse: legitimate interests and legal obligation.
  • Measuring how people use the website and DS Manager so we can improve them: legitimate interests.

Emails we send

  • Checkout reminder. At most one, if you leave a checkout after entering your email address (see Unfinished checkouts).
  • Figma Kit emails. When you buy a Figma Kit package (Basic, Plus or Premium), we add your email address to our Resend contact list for that package. You get a follow-up email the next day, and later emails about updates to the product. You can unsubscribe at any time, and a refund removes you from the list. We send these emails because we have a legitimate interest in telling customers about the products they bought, so we don't ask for separate consent.
  • Help form replies. Our answer to your request, and the automatic reply for student discount requests from academic addresses.

DS Manager sends no email itself. When you attach a website purchase on the Plans tab, Polar emails the code.

Cookies

The website uses Google Analytics cookies, a cookie that remembers whether the docs sidebar is open and, while an A/B test runs, a cookie that keeps you in the same test group. Your theme choice is kept in local storage. DS Manager uses a session cookie, a short-lived cookie while you sign in and a cookie for its light or dark theme. Loom and Figma embeds can set their own cookies.

The Cookie Policy lists every cookie with its lifetime and explains how to block them.

Service providers

These companies process data for us:

  • Vercel: hosting for the website and DS Manager, BotID and DS Manager analytics (USA).
  • Neon: the DS Manager database, including the files you upload (USA).
  • Upstash: rate limits and short-lived data for the website only. DS Manager doesn't use it.
  • Polar: payments as merchant of record, license keys, the customer portal and DS Manager plan lookups.
  • Lemon Squeezy: checks for older license keys only.
  • Resend: email.
  • Google Analytics: website analytics.
  • ParityDeals: country lookup for regional prices.
  • GitHub: DS Manager sign-in.
  • Google: DS Manager sign-in, profile pictures and Google Fonts.
  • xAI, Anthropic, OpenAI and Google: AI models for the DS Manager agent (see AI providers).
  • Loom and Figma: embedded videos and files.
  • Gumroad: Matt's newsletter.

We share with each of them only what they need to do their part.

The AI agents you connect to DS Manager over MCP, and the AI providers they run on, aren't our service providers. You choose them, and their own terms and privacy policies apply.

How long we keep data

On the website:

  • Unfinished checkout data: 7 days.
  • Unsubscribes from checkout reminders: kept, so we don't email you again.
  • Purchase tracking marks in Upstash Redis: 7 days.
  • Your country from ParityDeals: about 10 minutes.
  • Your IP address and license key for rate limiting: a short time.
  • Figma Kit contact lists: until you unsubscribe or get a refund.

In DS Manager:

  • Your account data and content: until you delete it or ask us to delete your account.
  • Verified GitHub email addresses: updated at each GitHub sign-in, and kept until we delete your account.
  • Sessions: until you sign out or the session expires.
  • Edit history and up to 20 saved versions of a system: until you delete the system or your account.
  • Files of registries you published: until you delete the registry, the system or your account, then deleted within a day. Unpublishing keeps them. A file that another live registry also uses stays until no registry uses it.
  • Agent chats: until you delete the chat, the design system or your account.
  • AI usage records and daily usage counts: until we delete your account.
  • Your API keys: until you remove them, or until a day after your Pro or Lifetime plan ends.
  • Project imports: 30 minutes.
  • Reviews: 30 days after they're proposed.
  • Connected agents: access tokens 1 hour, refresh tokens 30 days, token records 30 days after they're created, consent until you revoke the agent or it goes unused for 30 days, and unused registrations 7 days.
  • The call log of connected agents: 90 days.
  • The IP address of a token refresh: about 20 seconds.
  • Figma sync links, last agreed values and your last push: until you unlink the file or delete the system or your account. The state of a sync step: 30 minutes.
  • Share-link preview images: cached for up to 1 hour.
  • Request logs: Vercel keeps them for a limited time. They contain user IDs and Polar customer and order IDs.

We keep other data, such as support emails, only as long as we need it for the reason we collected it or as the law requires. Polar keeps its own records as merchant of record.

International transfers

We process data mainly in the USA. DS Manager's server functions run on Vercel in Washington, D.C. (iad1). One function that compiles styles also runs in Frankfurt and stores nothing. The DS Manager database runs on Neon in AWS US East (N. Virginia).

When personal data leaves the EU, we rely on Standard Contractual Clauses, or on the EU-US Data Privacy Framework where the provider uses it.

Your rights

Depending on where you live, you may have the right to:

  • see the personal data we hold about you and get a copy of it
  • correct it
  • delete it
  • object to how we use it, or ask us to limit it
  • receive it in a format you can take to another service
  • complain to your local data protection authority

To use any of these rights, email hi@shadcndesign.com.

Deleting your DS Manager account

DS Manager has no button to delete your account yet. Email hi@shadcndesign.com or use the help page, and we will delete your account and the data stored with it: design systems, registries, share links, chats, API keys, connected agents, Figma links and the billing records stored in DS Manager.

The files of registries you published are deleted within a day. A file that another person's live registry also uses stays until no registry uses it. Records that Polar keeps as merchant of record stay with Polar.

You can delete your design systems and registries yourself in the app, and revoke connected agents in Settings > MCP.

California notice

If you live in California, the CCPA and CPRA give you rights over your personal information, including the rights listed above. We disclose the categories of personal information described in this policy to our service providers for business purposes. We don't sell personal information. If any of our processing counts as "sharing" for cross-context behavioral advertising, you can opt out by emailing us. We don't knowingly sell or share the personal information of anyone under 16.

When we disclose data

Business transactions

If ShadcnDesign is part of a merger, acquisition or asset sale, your personal data may be transferred. We will tell you before that happens and before a different privacy policy applies to your data.

We may have to disclose personal data when the law requires it or when a public authority, such as a court or a government agency, makes a valid request.

We may also disclose personal data when we believe in good faith that we need to:

  • comply with a legal obligation
  • protect and defend our rights or property
  • prevent or investigate possible wrongdoing
  • protect the personal safety of our users or the public
  • protect ourselves against legal liability

Security

We use technical and organizational measures to protect personal data, such as the encryption of your API keys and the hashing of agent tokens described above. No way of sending or storing data over the internet is 100% secure, so we can't guarantee absolute security.

Customer logos and testimonials

We may name your company and show your logo to identify you as a customer, for example on our website or in materials about our products. Our lawful basis is legitimate interests: showing the kinds of customers who use our products. It doesn't mean you endorse us.

If you give us a testimonial or review, we may quote it with your name. We won't change the meaning of your words without your approval.

  • Where it appears: website pages, case studies, decks and social posts that name you as a customer.
  • We don't disclose confidential information.
  • We follow reasonable brand guidelines you give us.
  • To have your logo or testimonial removed or corrected, email hi@shadcndesign.com. We will remove it within a reasonable time.

Children

Our website and products are not meant for children under 13, and we don't knowingly collect personal data from children under 13. If you think a child has given us personal data, contact us and we will delete it. Where the law requires parental consent, we will ask for it before we process the data.

Our website and products link to websites we don't run. If you follow such a link, you leave our site, and that site's own privacy policy applies. We have no control over the content, privacy policies or practices of other websites, and we take no responsibility for them. Read the privacy policy of every site you visit.

Changes

We may update this Privacy Policy. When we do, we post the new version on this page and change the "Last updated" date at the top. Where the law requires it, we will tell you about material changes.

Contact

For questions about this Privacy Policy or to use your rights, email us at hi@shadcndesign.com.

Level-up your workflow today

One-time payment
14 days refund policy