Privacy Policy
Last updated
HextaUI (hextaui.com) is run by Preet Suthar, an individual based in India. This policy explains what data the site collects, why, who else handles it and what you can ask for. Questions go to [email protected].
The short version
- You can read the docs and use every free component without an account. Analytics cookies are only set if you allow them.
- If you sign in, I keep your name, email and profile picture from GitHub or Google so your account and HextaUI Pro work.
- Payments go through Dodo Payments. I never see your full card details.
- I don’t sell your data, show ads or track you across sites.
When you browse
Reading the site needs no account. Two things happen on every visit, and a third only if you agree to it:
- Analytics. OneDollarStats records aggregate statistics: the page you came from, the pages you view, how long you stay, and your device type, operating system, browser and country. It doesn’t collect personally identifiable data from browsing and sets no cookies.
- Google Analytics, if you allow it. The first time you visit, a banner asks whether HextaUI can use Google Analytics. Only if you choose Allow does it load and set cookies to count visits and see which pages are used: the pages you view, how you got there, roughly where you are, and your device and browser. If you choose Decline, it never loads.
- Hosting. Cloudflare serves the site and, like any web host, processes your IP address and browser details to deliver pages and block abuse.
When you sign in
You sign in with GitHub or Google. With your permission on their screen, they share the following, which I store:
- Your name, email address and profile picture URL.
- Your account ID with that provider and whether your email is verified.
- The access tokens the provider issues. They’re encrypted in the database and only used to complete sign-in.
- For each session: a session token, the IP address and browser you signed in from, and when the session expires.
If you sign in with both GitHub and Google using the same verified email, both connect to one account, so your purchase follows you.
When you buy HextaUI Pro
Dodo Payments is the merchant of record. It collects your payment details, billing address and tax information, processes the payment and issues the invoice, under its own privacy policy. From Dodo I receive and keep the payment ID, its customer ID for you, the product, amount, currency, status and date.
When you create API tokens
Tokens let the shadcn CLI install Pro blocks. I store only a hash of each token, the name you give it, a short hint like hxt_abcd…wxyz, and when it was created and last used. The full token is shown to you once and can’t be recovered.
How the data is used
- To sign you in and keep you signed in.
- To check your HextaUI Pro access and deliver Pro blocks.
- To process purchases, refunds and disputes.
- To prevent fraud and abuse, such as shared or leaked tokens.
- To answer you when you email me.
- To understand, in aggregate, which pages are useful.
Cookies and browser storage
Without your consent, the only cookies are the ones that make sign-in work, set by the authentication system (their names start with better-auth):
- A session cookie that keeps you signed in for up to 30 days.
- A short-lived copy of your session, refreshed every few minutes.
- A sign-in state cookie that lasts a few minutes while GitHub or Google redirects you back.
If you allow analytics, Google Analytics also sets cookies whose names start with _ga, which last up to two years. You can change your choice any time with Cookie settings in the footer. Choosing Decline there removes these cookies and stops Google Analytics.
The site also saves a few preferences in your browser’s storage: your analytics choice, your theme, your package manager, recent searches, the layout of resizable examples, whether you’ve signed in before, and a cached GitHub star count. These never leave your device.
Who else handles data
- Cloudflare hosts the site, its functions and the database.
- GitHub and Google handle sign-in under their own privacy policies.
- Dodo Payments processes payments, taxes and refunds.
- OneDollarStats provides analytics, hosted in Finland.
- Google provides Google Analytics, only if you allow it, under its own privacy policy.
Some pages also load content straight from other services, which then receive your IP address and browser details: the GitHub API for the star count, profile pictures from GitHub and Google, sample images and videos in docs examples (Unsplash, W3C and MDN), and site icons in the Thinking block preview through DuckDuckGo’s icon service.
These providers may process data outside India.
How long data is kept
- Account data: until you ask me to delete your account.
- Sessions: they expire after 30 days without use, or when you sign out.
- API tokens: until you revoke them or delete your account.
- Purchase records: kept for as long as tax, accounting and fraud rules require, even after the account is deleted.
Your rights
Under India’s Digital Personal Data Protection Act, 2023, and, where it applies to you, the GDPR, you can ask to access, correct or delete your data, withdraw consent, or raise a grievance. Email [email protected] from the address on your account and I’ll respond within 30 days. Deleting your account removes your profile, linked sign-ins, sessions and API tokens, and ends Pro access.
Children
HextaUI accounts and purchases are meant for people 18 or older. If you’re younger, ask a parent or guardian before signing in or buying.
Security
Traffic is encrypted with HTTPS, API tokens are stored only as hashes and provider tokens are encrypted. No system is perfectly secure, so please keep your tokens private and revoke any you think have leaked.
Changes
If this policy changes, the date at the top changes too. Material changes will be announced on the site. See also the Terms of Service.