Privacy Policy

What we collect

• Account details: your email address, plus the name and profile picture GitHub or Google share when you sign in with them.
• Subscription records: your Stripe customer ID, plan, status and renewal date. Card details go straight to Stripe and never reach us.
• API keys: the name you give each key, its first few characters and when it was last used. The key itself is stored only as a SHA-256 hash.
• Bookmarks: the components you save while signed in.
• Device sign-in codes: when an agent connects to your account, we keep a short-lived code, the agent's name and a hash of the requesting IP address so we can rate-limit requests.
• Server logs: our host records IP addresses, user agents and requested URLs to run and secure the service.

Browsing, searching and previewing components needs no account. We don't run advertising or tracking. Vercel Web Analytics counts page views and measures load speed without cookies, and we strip query strings from what it records.

Cookies and local storage

Signing in sets cookies that keep your session. Your browser's local storage remembers your light or dark theme and, when you're signed out, your bookmarks. Nothing is used to track you across other sites.

How we use it

• To sign you in and keep your account secure.
• To check whether your subscription unlocks component source, and to bill it.
• To let agents and tools you connect use your API keys.
• To answer you when you contact us, and to prevent abuse.

We don't sell personal data or use it for advertising.

Google user data

If you sign in with Google, we receive only your email address, name and profile picture, and we use them only to create and identify your account. We don't use Google user data for advertising, sell it, or share it except with the service providers below as needed to run the account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Service providers

We share data only with the companies that run parts of the service for us, and only what each one needs:

• Supabase: authentication and the database that holds accounts, subscriptions, API keys and bookmarks.
• Stripe: checkout, billing and the customer portal.
• Vercel: hosting, server logs and cookieless page analytics.
• GitHub and Google: sign-in, when you choose them.
• Anthropic: when the component generator is used, the prompt is sent to Claude to write the component.

We may also disclose information when the law requires it.

Retention and deletion

We keep account data for as long as you have an account. Delete your account at any time from your account page (or email mattbeamish.design@gmail.com); deleting it cancels any subscription and removes your API keys, bookmarks and subscription record from our database. Stripe keeps billing records for as long as tax and accounting laws require. Expired device sign-in codes are discarded.

Your rights

You can ask for a copy of your data, a correction or its deletion at any time by emailing mattbeamish.design@gmail.com. Depending on where you live, you may have further rights under laws such as the GDPR or CCPA, including the right to complain to your data protection authority.

Security

Data is encrypted in transit, database access is restricted by row-level security, and API keys and device codes are stored only as hashes. No system is perfectly secure, so please tell us if you find a problem.

Children

Assembli isn't directed at children under 16, and we don't knowingly collect their data.

Changes

If this policy changes, we'll update the date at the top. For significant changes, we'll let subscribers know by email.

Contact

Questions or requests: mattbeamish.design@gmail.com.