Privacy

What we collect

We store personal data to deliver the product you paid for: to grant and verify access, to send and resend your license, to handle refunds and disputes, and to keep the service from being abused.

Your email address. Given when you buy a license or ask for nonprofit access. It is how we grant registry access and how we reach you about your purchase.

Your license token. Generated by us, tied to your email, used by the shadcn CLI to install paid components and, once saved in your browser, to show paid source on this site.

Your purchase record. Which plan you bought, Stripe's references for the checkout session and payment, when the license was issued, when it was last used, when its email was sent and, if it was ever revoked, when and why.

We do not use your email, token or purchase record for anything else.

Server logs. Our host records ordinary request data — IP address, browser and OS, the pages requested, timestamps. This is how any web server works. We use it to keep the service up and to spot abuse, not to build a profile of you. Our own rate limiter also keeps the times of recent requests per IP address in memory for a few minutes, for the same reason.

Analytics. We count visits with Vercel Web Analytics. It sets no cookies. It records the page, the referring site, your country and region, and your device, browser and operating system, and it tells one visit from another with a hash made from the request that is thrown away after 24 hours. It does not follow you from one day to the next or onto other sites.

A/B tests. We test versions of pages with Statsig, only if you accept the cookie banner. A random ID in a cookie keeps you on the same version, and Statsig receives that ID with the version you saw and whether you clicked "Get full access", started a checkout or bought a license, and for a purchase the plan and amount. It does not receive your email, your token or anything else that names you. If you decline, no ID is set and nothing is sent.

Cookies

The site sets two cookies, and only one of them is optional:

• 01o_consent remembers whether you accepted or declined the cookie banner, so it asks only once. Kept for a year.
• 01o_vid, only if you accept, is the random ID that keeps you on the same version during an A/B test. Kept for a year, and removed if you later decline.

Change your choice at any time with Cookies in the site footer.

Your browser's local storage remembers your light or dark choice, your package manager, your recent searches and, once your token is shown or pasted here, your license token so paid code shows on the site. The preferences stay on your device. The token is sent to our server when the site checks it to open paid code, and it also exists in our database and in the email we sent you. Your account page can forget the saved copy from any browser.

Payments

Payments are processed by Stripe. Stripe collects and processes your card details; our application never receives your full card number or security code.

Stripe sends us what we need to administer the purchase: that it happened, when, the amount, the email you used, and Stripe's references for the session and payment. For a refund or dispute, Stripe's notice can also carry limited payment metadata, such as the card brand and last four digits. We keep the references, not the card metadata. Stripe's handling of your data is governed by their privacy policy, not this one.

Who else touches your data

The services we run on. Each sees only what it needs:

We do not sell, rent, or trade your information, and we do not share it for anyone's advertising.

How long we keep it

Your email, token and purchase record stay for as long as your license is valid. It is a lifetime license, so that means indefinitely. If a license is revoked after a refund or dispute, we keep the record of that too. Server logs are kept only as long as our host retains them. A/B test events are kept by Statsig under its retention policy.

You can ask us to delete your data at any time. We delete your license record and your email, which ends your registry access. Stripe keeps its record of the payment, as the law requires, and our email provider keeps its sending logs for a limited time under its own policy.

Your rights

Wherever you live, you can ask us to show you what we hold, correct it, delete it, or send it to you in a portable format. If you are in the EU, UK, or California, those rights are statutory — GDPR Articles 15 to 21, or the CCPA — and they include the right to object to processing and to complain to your data protection authority.

Email hello@01orbital.dev. There is no charge.

Security

Data sits on infrastructure run by the providers above, behind their access controls. Tokens are validated server-side; a revoked token stops working immediately.

No method of transmission over the internet is completely secure. If we learn of a breach affecting your data, we will notify you by email.

Children

01orbital is a developer tool and is not directed at children. We do not knowingly collect information from anyone under 13.

Other sites

Pages here link out — to documentation and Stripe. Those sites have their own policies and we are not responsible for them.

Changes

If this policy changes, the updated version is posted here with a new date. Material changes affecting existing customers get an email, not a silent edit.

Questions, or a request about your data: hello@01orbital.dev