Privacy policy

• You can browse UI Discovery without an account. If you sign in with Google or email, we store your name, email address, available profile image, account identifier and session details so you can use your account.
• Google Analytics and Microsoft Clarity measure site use. Visitors in the EU, EEA, UK and Switzerland are asked first; elsewhere they are on by default and you can turn them off under Privacy choices. Clarity recordings are disabled on account, admin, search and query-string pages. We don't use either service for advertising.
• Guest saves stay in your browser. When you sign in, your saved references, boards and notes sync to your account so you can use them on other devices.
• When you search, your query is sent to our server and, when AI ranking is on, to one AI provider so it can put the most relevant references first.
• We don't sell personal information, and we don't share it for advertising.

UI Discovery is operated by Ramandeep Singh ("UI Discovery", "we", "us"). This policy covers the UI Discovery website, its public API and the UI Discovery MCP server. It explains what information is involved when you use them and what we do with it.

Questions or requests about privacy: townmedialabs@gmail.com.

When you save a reference, create a board or write a note, UI Discovery keeps a copy in your browser's local storage. Signed-in collections also sync to our database under your account. Guest saves are added to the account you sign into on that browser. Account-specific storage uses these key prefixes:

• kitbash-saved-items — the references you saved, which board they're on, and any private note you added.
• kitbash-boards — the names of the boards you created.
• kitbash-active-board — which board you last had open.

Guest-only saves disappear if you clear site data. Clearing your browser does not delete synced account collections; remove those references from your saved boards while signed in and connected. Recently viewed history stays on the current browser, separated by account, and can be cleared on the library dashboard. Board exports are generated in your browser.

When you search the library — on the search page, through the API or through the MCP server — the text you type is sent to our server so we can find matching references. The same applies to product briefs submitted to the brief endpoint.

To order results by relevance, we may send your query (up to 180 characters for search, 600 for a brief) together with descriptions of candidate references to TypeSafe, an AI service that scores how well each reference fits. We send the text only — no name, email, account or device identifier. Results are cached in our server's memory for a short time so repeated searches are fast, and that cache is cleared when the server restarts.

Please don't type personal or confidential information into search or brief fields. API users can skip AI ranking entirely by adding ai=0 to a search request.

When you connect your UI Discovery account to a service such as ChatGPT, the authorization process lets that service request the UI Discovery tools you approve. We use your account identifier and current plan to decide which catalog features the connection can access. Connecting does not give the service your UI Discovery password or API key.

When you ask a connected service to use a tool, it sends the tool inputs to us. We return the requested catalog results to that service, which may include reference links, screenshots, palettes, fonts, and, when your account has access, build briefs and imagery plans. The connected service then handles those results under its own privacy terms. Disconnect the service in its account settings to stop future tool calls, or contact us for help revoking access.

Like any website, our servers receive standard request information when you load a page or call the API: IP address, browser type, the page or endpoint requested, and the time. Our VPS provider (Hosting Raja) may keep this in server logs for security and troubleshooting.

To stop abuse of the AI-backed endpoints, we keep a short-lived counter per IP address in memory. It counts requests over a one-minute window, lives only in the server's memory, and is never written to a database.

To run and improve the service we keep aggregate statistics: daily counts of visits, pages viewed, referring sites, device types, crawler visits, and API requests with their response times and status codes. To count a visitor once per day, the server combines the IP address and browser type into a salted hash that stays in its memory, uses a new salt every day, and is never stored. Only the totals are saved, and no cookie is used.

To enforce daily API and MCP limits, we also store a count for each day and caller. The caller is an account ID, an API key ID, or a salted hash of the caller's IP address. We automatically delete these daily counters after 90 days.

We also collect aggregate page performance, browser error counts, failed download counts and searches without results to improve reliability. These experience measurements contain no account identifiers; route names exclude query strings and sensitive-looking search text is redacted. Experience measurements expire after 30 days. Browser experience beacons respect Do Not Track.

Public browsing on UI Discovery does not require an account. Signing in sets a necessary, secure, HTTP-only session cookie on the host where you sign in. Separately, unless you decline analytics, Google Analytics and Microsoft Clarity use browser storage and network requests to measure page use. Clarity may record interactions on public pages so we can understand navigation and usability; form fields are masked by Clarity and account, admin and search pages are excluded from recordings.

In the EU, EEA, UK and Switzerland (judged from your browser's time zone) these optional tools are off until you choose Allow analytics. Elsewhere they are on by default. Either way you can choose Decline, or reopen Privacy choices at any time. Your choice is saved in this browser. Our fonts are served from our own domain.

If you email us — for a content-removal request, a job application or anything else — we receive your email address and whatever you choose to include. We use it to reply and to handle your request, and we keep it only as long as needed for that purpose and our records.

You can sign in with Google or email. Google handles your Google password; email sign-in uses a one-time code unless a password option is offered to your account. Any password is stored as a secure hash. We keep account and session records, synced collections and signed-in download/design activity. Our email provider sends sign-in, verification and recovery messages when those features are used. Stripe handles checkout, payment details and billing; we store subscription identifiers and status, not card numbers. You can request account deletion through townmedialabs@gmail.com.

We share information only with service providers that help us run UI Discovery, and only what they need:

• TypeSafe — receives search and brief text to rank results (see above).
• Our hosting provider — serves the site and may process request logs.
• AI services you connect, such as OpenAI — receive the results of tool calls you make through that connection, as described above.
• Google — handles optional Google sign-in when you choose it.
• Google Analytics — receives page paths without query strings and limited usage events if you allow analytics. It is configured without advertising signals, account IDs or form data.
• Microsoft Clarity — receives public-page interaction and session recording data if you allow analytics. Account, admin and search pages are excluded.
• Stripe — processes payments and manages subscription billing.
• Our account email provider (Hostinger SMTP when configured) — processes the recipient address and account email content for verification and recovery.

We may also disclose information if required by law or to protect the safety and rights of our users or others. We don't sell personal information or share it for targeted advertising.

Reference pages link to the original websites and App Store listings they come from. Those sites have their own privacy practices, which this policy doesn't cover.

Account details, saved collections and connected-service authorizations are kept while your account is active. Contact us to request account deletion or access revocation; we remove data from the active service unless we must retain it to meet legal, security or billing obligations. Short-lived search ranking caches stay in server memory until they expire or the server restarts. Browser-stored data stays under your control. Aggregate experience measurements expire after 30 days. We limit what we collect in the first place and protect what we hold with reasonable safeguards, but no system is perfectly secure.

Depending on where you live, you may have rights to access, correct, delete or object to the processing of your personal information. Guest boards and recently viewed history can be cleared on your device. To remove synced references, use your saved boards while signed in and connected. For account records held on our server, contact us to request access or deletion.

For anything we hold (for example an email you sent us), write to townmedialabs@gmail.com and we'll respond within the time the law requires. You can also contact your local data-protection authority.

UI Discovery is a professional design tool and isn't directed at children under 16. We don't knowingly collect information from them.

We'll update this page when our practices change and change the date at the top. This policy is governed by the laws of Alberta, Canada.