Privacy

Your account. Your name, email address and whether you’ve verified it. If you set a password, we keep a one-way hash of it, never the password. If you sign in with GitHub or Google, we keep the account identifier and access tokens they give us. If you turn on two-factor authentication or add a passkey, we keep the encrypted secret, your backup codes and your passkeys’ public keys.

Your sessions. For each signed-in browser: when it signed in, when it was last active, its browser and operating system, and part of its IP address (for example 203.0.113.x). You can see and end them in Settings.

Access requests. When you apply as a design partner or ask for SDK access: your name, work email, company, role, what your agent does, the frameworks you use, your browser’s user agent, and a salted hash of your IP address, which lets us limit abuse without storing the address itself.

Abuse limits. To slow down password guessing, we count recent requests per IP address and page. These counts are stored under salted hashes and deleted after a day.

We set only the cookies sign-in needs: your session, a short-lived copy of it that saves a database lookup, a marker for devices you trust for two-factor authentication, a temporary passkey challenge, and which sign-in method you used last. Nothing is kept in your browser’s local storage. Because none of this is used to track you, there’s no cookie banner.

• Supabase hosts our database.
• Vercel hosts the website and app.
• Resend delivers our emails.
• Have I Been Pwned checks new passwords against known breaches. It receives only the first five characters of the password’s SHA-1 hash, never the password.
• GitHub and Google, only if you choose to sign in with them.

• Account data: until you delete your account, which removes it, your sessions, passkeys and connected accounts.
• Sessions: they expire after seven days without use.
• Abuse-limit counts: one day.
• Access requests: until you ask us to remove them.

You can change your name and email, end sessions and delete your account in Settings. To get a copy of your data, correct it, or have an access request removed, email founders@dyeline.ai.

If this page changes in a way that matters, we’ll update the date above and, for account holders, tell you by email.