Privacy Policy

What valyro.xyz, the account server, valyro-cli and the hosted MCP server collect, why, how long it is kept and how to have it deleted. Short version: a GitHub profile, hashed API tokens and the state of your licence. No analytics, no ads, no tracking.

Who is responsible

[OPERATOR: FULL NAME OR COMPANY], [COUNTRY AND POSTAL ADDRESS], is the controller of the personal data described here. Questions and requests: [email protected].

What we collect

Sign-in with GitHub: your GitHub user id, login, display name, avatar address and email — the public one on your profile or, if there is none, your primary verified email. We ask GitHub only for read:user and user:email: no access to your repositories. GitHub’s access token is used once during sign-in and never stored.
There is no user database: your profile lives in a signed session cookie in your browser.
API tokens: we keep a hash of each token (never the token itself), its name, your login and GitHub id, its scope and when it was created and last used. Tokens made by valyro-cli login are named after your computer: “valyro CLI on <hostname>”.
Purchases: Polar collects your payment details and billing address; we never see your card. We pass Polar your GitHub id, login and email to link the purchase to your account. From Polar we keep your Polar customer id, plan, billing interval, seats, subscription status and period end, and, for Team plans, which logins hold a seat and since when. We do not store amounts, card data or Polar’s full messages.
Waitlist: if you joined the Pro waitlist, your login, email, the plan you picked and the date.
Figma: an export from the docs to the Figma plugin (the layers of the component and your login) is held in memory for up to 10 minutes; a Figma Kit code for up to 2 hours.
Technical data: your IP address, held in memory for 10 minutes to rate-limit requests. The account server logs events with your login (sign-in, tokens created or revoked, checkout, Figma exports) but not IP addresses or the content of MCP requests. The web server and Cloudflare see your IP address, browser and the addresses you open.

Cookies and browser storage

We set only two cookies, both strictly necessary, so there is no consent banner:

__Host-valyro_session keeps you signed in for 30 days (or until you sign out). It holds your GitHub id, login, name, avatar address and email, signed so it cannot be forged.
__Host-valyro_oauth protects the GitHub sign-in for 10 minutes while it is in progress.

The docs also save your preferences in your browser’s local storage — theme, mode, text direction, preview device, framework, language, catalogue view, the Theme Builder and demo state — and keep the plan you picked and a CLI sign-in code for the tab’s session. This stays on your device; clear it in your browser’s settings.

We do not sell personal data or share it for advertising. It reaches:

GitHub — for sign-in; avatars load from GitHub’s servers.
Polar — our Merchant of Record, under its own privacy policy, for checkout, invoices, taxes and the billing portal.
Cloudflare — the network in front of the site, which carries every request.
Some demos load images from Riot Games’ Data Dragon CDN and map tiles from OpenStreetMap; those servers see your IP address when the demo is on screen.
Authorities, when the law requires it.

The CLI and MCP

valyro-cli has no telemetry. After valyro-cli login it saves your token, login and the time to ~/.config/valyro/auth.json (%APPDATA%\valyro\auth.json on Windows), readable only by you, and sends the token only to valyro.xyz. valyro-cli logout revokes the token and deletes the file. mcp add --hosted writes the token into the config of the AI client you name. Brand import fetches the sites you give it directly from your computer.

Why we use it

To run your account, tokens and licence and deliver what you bought — performance of our contract with you.
To keep the Service secure, stop abuse and fix errors — our legitimate interest.
To keep tax and accounting records — a legal obligation, met mostly by Polar as the seller of record.
To answer your emails.

How long we keep it

Session cookie: 30 days, or until you sign out.
API tokens: until you revoke them or your account is deleted.
Licence records: while the licence and the rights it leaves you after cancelling last, or until you ask us to delete them.
Waitlist entries: until you ask us to remove them.
Polar event ids: 30 days. Rate limits and Figma exports: minutes to hours, in memory only.
Server logs: [LOG RETENTION PERIOD].
Emails to support: as long as needed to answer them.

Your rights

Depending on where you live (for example under the GDPR), you can ask for a copy of your data, correct it, have it deleted, object to or restrict its use, and take it elsewhere. Some of it you can do yourself:

sign out and revoke API tokens on the account page;
update your name, avatar or email on GitHub and sign in again;
remove ValyroUI from the applications in your GitHub settings.

For anything else — a copy of your data or deleting your account — write to [email protected] from the email of your account. We answer within 30 days. Records Polar must keep for taxes stay with Polar. You can also complain to the data protection authority where you live.

Where the data is

Our server is in [COUNTRY OF THE SERVER]. GitHub, Polar and Cloudflare process data in the United States and other countries under their own safeguards.

Security

Everything goes over HTTPS. Cookies are HttpOnly, Secure and SameSite. Tokens are stored only as hashes, data files are readable only by the server, and the account server is not reachable from the internet except through the web server. Report a vulnerability to the address in security.txt.

Children

The Service is for developers and is not meant for children under 16. GitHub itself requires its users to be at least 13.

Changes

When we change what we collect, we update this page and the date at the top first, and announce material changes on the site or by email.

Contact

[OPERATOR: FULL NAME OR COMPANY], [COUNTRY AND POSTAL ADDRESS]. Email: [email protected]. We answer within 30 days, usually much sooner.