Privacy policy

Account data

If you sign in with GitHub, we store your GitHub username, display name and avatar URL. We do not receive or store your GitHub password or access to your repositories.

If you create an account with an email address, we store the email, your username and display name, and a salted hash of your password (never the password itself). The email is used to sign you in and to send the one-time links you ask for (password reset, email change); we send no marketing mail. Mail is delivered through our email provider, Resend, and the link tokens are stored only as hashes and stop working once used or expired.

A session cookie keeps you signed in. It is removed when you sign out or when it expires.

What you publish

Components you submit (source code, demo, name, description, tags) are stored with your username. Once approved they are public, along with your profile name and avatar. Your favorites are private unless you make them public on your profile.

Stored in your browser

Your theme choices, language and favorites are saved in your browser (cookies and local storage) so the site remembers them. Clearing site data removes them.

Usage counts

To rank components we count installs and copies. Each count uses a hash of your network address and browser details that changes every day, so a visitor counts once per item per day. The hash cannot be reversed to identify you, and we do not keep the address itself.

Sharing

We do not sell your data. Infrastructure providers that host the site (for example hosting, database and storage services) process data on our behalf. Packages used by community components may be loaded from a public CDN (esm.sh), which sees the request from your browser.

Your choices

In your account settings you can edit your public profile, download your data as a JSON file, and permanently delete your account together with the components you published and your favorites.

Reports you file about components are visible to the site moderators. If you delete your account, your reports stay in the moderation record without your identity.