What we collect

Last updated 4 September 2026. Controller: Artbloom Labs.

Browsing the site

Every page here is generated at build time and served as static HTML. There is no tracking script, no ad network, no session recorder, and no third-party analytics of any kind. Signed out, the only thing we put in your browser is your theme choice, which lives in local storage on your own device and is never sent anywhere.

Our host keeps ordinary server logs — IP address, user agent, the path requested — for a short window, to serve traffic and absorb abuse. We do not join those logs to anything else described on this page.

Signing in

Sign-in is GitHub only, through Supabase Auth. GitHub tells us your account id, your handle, your display name, your avatar URL and the email address on your GitHub account; Supabase keeps that as your user row. What we add to it is one line per bookmark — the name of the piece, when you saved it, and which account it belongs to. That is the whole of it; there is no password here, because there is no password to set.

Signing in sets three cookies, and only signing in sets them:

• ab-access — your Supabase access token, so a page load knows who you are. Expires when the token does, usually an hour.
• ab-refresh — the token that fetches a fresh one, so you are not signed out every hour. 30 days.
• ab-verifier — a single-use value proving the sign-in coming back from GitHub is the one you started. 10 minutes, then it is deleted.

All three are httpOnly, so no script on the page can read them — not ours and not anybody else's — SameSite=Lax, and Secure in production. None of them measures anything or follows you anywhere; without them the bookmark button cannot work at all. Signing out deletes all three on the spot.

The CLI

When you run npx ui.artbloom add …, your machine fetches JSON from /r/<name>.json. That is an ordinary HTTP request, so it reaches the host with your IP address, exactly like loading a page.

Then, once the files are on disk, the CLI posts one short message per installed piece: the name of the piece, the CLI's version, and which package manager you use. Nothing else — not your project name, not a file path, not your username, not a machine id, and nothing that persists between runs to link two installs together. It is a single POST with a two-second timeout, and a failure is silent, so a counter can never break an install.

Three ways to send nothing at all:

• --no-telemetry on any command.
• DO_NOT_TRACK=1 in the environment.
• CI=1, which most build servers set for you — automated installs are not counted.

What we keep of that message is the name of the piece, the day, and a salted SHA-256 hash of your IP address cut to 128 bits. The hash is there so one machine installing one piece twice in a day counts once; the salt is a server secret we do not publish. Your address itself is never written to the database, and the hash cannot be turned back into it. The result is a number per piece per day, and nothing on this site displays those numbers today.

What we do not do

We do not sell or share any of this with anyone. There is no advertising, no cross-site tracking, no profiling, and no mailing list — outside of sign-in we never learn your address, so we could not email you if we wanted to. There is no payment processor and no card handling either, because everything in the catalogue is free.

Your rights

Under the GDPR and similar laws you can ask for a copy of anything we hold about you, ask for it corrected, or ask for it deleted. Signed out, the honest answer is that we hold nothing we can tie to you. Signed in, it is your user row and your bookmarks, and deleting the account takes both with it. Write to hey@ui.artbloom.tech.

Other people's services

Supabase hosts the authentication service and the database the rows above live in. GitHub is the identity provider, and sees that you signed in here. Our host serves the pages and keeps the logs. That is the entire list.

Separately, a template you install may load fonts or images from a third party inside your project — that is your users' data and your privacy notice, not ours. Each item page lists what it fetches. See also the licence and terms.

Changes

If what we collect changes, the date at the top changes with it and the section that changed says what it now does. This page is meant to be checked against the code rather than believed: the cookies are set in one file, and the counter is one route.

Children

This is a developer tool and not intended for anyone under 16.