Chocolate UI ("we", "us") runs chocolateui.com, the registry and MCP server at api.chocolateui.com, and the chocolate-ui command-line tool. This policy explains what we collect, why, and the choices you have. We keep it short because we collect very little.
The short version
- Browsing the site does not require an account, and we run no advertising or third-party analytics trackers.
- If you sign in, we store your name, email address and profile picture from Google or GitHub.
- Payments are handled by Polar. We never see or store your card details.
- We never sell your personal information.
Information we collect
Account information. When you sign in with Google or GitHub we receive your name, email address, profile picture and that provider's account identifier. We do not receive your password, and we only request the basic profile and email scopes.
Purchase information. When you buy a license, Polar processes the payment as merchant of record. Polar sends us your email, order identifier, amount, currency and product. We use these to issue your license key.
License and API usage. We store your license key, the machines you activate it on (a fingerprint and an optional label you choose), hashed API tokens you create, and the items you save as favorites. When the registry or MCP server is called we log the item name, whether the caller was anonymous, licensed or signed in, and the time.
Technical data. Our hosting provider, Cloudflare, processes IP addresses and request metadata to deliver the service, protect it from abuse and enforce rate limits. We use IP addresses only for short-lived rate-limit counters on the MCP endpoint, which expire within two minutes.
How we use information
- To provide the service: sign you in, issue and validate license keys, gate Pro source and answer MCP requests.
- To send transactional email such as your license key and receipts. We do not send marketing email unless you opt in.
- To prevent abuse, enforce fair-use limits and keep the service secure.
- To understand which blocks and components are used, in aggregate, so we know what to build next.
Google user data
If you sign in with Google, we use your Google name, email address and profile picture only to create and identify your Chocolate UI account. We do not use Google user data for advertising, we do not sell it, and we do not transfer it to others except as needed to provide the service or as required by law. Chocolate UI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Retention and deletion
We keep account and license data for as long as your account exists, because a lifetime license has no end date. Usage logs are kept for up to 12 months. Order records are kept as long as tax law requires.
You can ask us to export or delete your data at any time by emailing hello@chocolateui.com from the address on your account. Deleting your account deactivates any license attached to it.
Your rights
Depending on where you live, you may have the right to access, correct, delete or port your personal data, and to object to or restrict certain processing. We honor these requests for everyone, wherever they live. You may also complain to your local data protection authority.
Security
Traffic is encrypted with TLS. API tokens are stored only as SHA-256 hashes and shown to you once. Session identifiers are random and stored server-side. No system is perfectly secure, so please tell us at hello@chocolateui.com if you find a vulnerability.
Children
Chocolate UI is a developer tool and is not directed at children under 16. We do not knowingly collect their personal information.
Changes and contact
If we change this policy we will update the date at the top, and for material changes we will notify signed-in users by email. Questions go to hello@chocolateui.com.
See also Privacy Policy, Terms of Service and Licensing.