Privacy policy
Last updated
1. Scope and responsibility
This policy covers the UI website, public registry, source downloads, copy telemetry, account authentication, authenticated sessions, Pro billing, and messages sent to UI. UI is operated under the EDBN name. EDBN decides why and how personal information is handled for those activities.
The downloadable MCP package runs in the environment where it is installed. It is read-only and does not send prompts, source files, or tool results to EDBN. This policy covers the website requests used to obtain public registry data or documentation, not information that a user processes locally with the MCP package.
Questions and requests can be sent to privacy@edbn.me.
2. Information handled today
Account notice at collection
When you select Continue with Google or Continue with GitHub, UI starts an OAuth flow through Better Auth. After you approve the information shown by the selected provider, Better Auth may create or access an authentication record. It can include the provider account identifier, email address, name, profile image, provider name, account status, sign-in timestamps, and related security or audit events.
UI uses this information to create or access the account, maintain authentication security, and troubleshoot sign-in. This version of the application contains no advertising or data-broker integration and does not use account information for cross-context behavioral advertising. Account, cookie, log, and correspondence retention is described in Sections 5 and 8.
Google and GitHub sign-in
If you choose Google or GitHub, the selected provider and Better Auth participate in the OAuth exchange. UI's callback receives a temporary authorization code and sends it to Better Auth to establish the session. UI may then receive the provider account identifier, email address, name, profile image, and basic profile fields that the provider shows and you authorize for sign-in. UI does not receive your provider password.
Sessions, devices, and requests
UI's hosting or network providers receive data normally sent with a request to the website, such as IP address, requested URL, referrer when supplied, date and time, user agent, and response status. Better Auth receives the account and request information sent to its authentication service, including authentication and security events. Supabase receives the anonymous analytics session and event data described below.
Better Auth first-party session cookies can contain an opaque session token or related session state. UI processes those values to keep you signed in, validate the session, sign you out on the current device, grant authorized access, and investigate suspected misuse. Do not send a session token, password, private key, or database credential by email.
Messages and requests
If you contact a UI legal, privacy, copyright, security, abuse, or terms address, UI and its mail provider process your contact details, message, attachments, affected URLs, supporting evidence, and records of the review and response. Provide only what is needed for the issue.
Public registry and copy telemetry
When you view or copy public registry material, the website may send a telemetry event to measure component usage, installation activity, documentation usefulness, and service reliability. A copy event can include an anonymous session identifier, event type, component name and version, page path, referrer, source file path, surface, copy type, language, package manager, variant, demo identifier, property name, subcomponent, line count, content length, command length, and similar bounded metadata. The copied source text itself is not sent in the event.
The browser may queue up to 100 events in local storage under the keyedbn:copy-telemetry:v1. Queued events are limited to seven days and are removed after successful delivery or expiry. The server also receives the request user agent and coarse location values when supplied by the hosting network, including country, city, latitude, longitude, timezone, and continent. The server uses the request IP for rate limiting and does not store an IP hash in the analytics event. User agents are truncated and parsed into bounded browser, operating system, device, and bot fields.
Telemetry is stored in Supabase and associated with the Supabase anonymous session identifier. This analytics route does not link the event to a Better Auth account identifier. UI does not use this telemetry for behavioral advertising or sell it to data brokers.
Pro checkout and billing
When you choose Pro checkout, UI sends Polar your stable internal account identifier, selected product, checkout and return URLs, and customer IP address when available. Polar's hosted checkout may collect your email, display name, payment details, and billing information. Polar acts as merchant of record for the transaction and handles payment details, applicable taxes, receipts, refunds, disputes, and subscription management. UI does not receive your full card number. Polar's own privacy and buyer terms apply to its processing. See the Polar Privacy Policy and Polar Buyer Terms. The applicable EDBN code rights are described in the Source-Available License.
UI keeps a restricted billing record containing provider customer, checkout, payment, subscription, refund, and dispute identifiers; product, currency, amount, status, and paid-period information; and signed-event audit and reconciliation records. These records connect billing status to the Better Auth user identifier and are used to grant, suspend, restore, or end Pro access accurately.
3. Sources
UI receives information:
- directly from you when you send a message;
- from Google or GitHub when you deliberately select that sign-in provider;
- from Better Auth when it authenticates or maintains your account session;
- from Supabase when anonymous analytics sessions and events are created;
- from Polar when checkout or billing events occur;
- automatically from your browser, device, and network requests; and
- from hosting, security, email, and network providers when they operate the Service or report a reliability or abuse event.
4. Purposes and legal bases
Account access
UI uses account, OAuth, and session information to provide the sign-in service you request, take steps before providing it, maintain the session, and respond to account issues. Where a legal basis is required, this processing is necessary to perform the agreement with you or take the steps you request before entering it.
Security and reliability
UI uses request, device, session, and audit information to prevent abuse, detect account compromise, enforce configured authentication rate limits, troubleshoot failures, and protect the Service. The basis is UI's legitimate interest in operating a secure and reliable service, after weighing that interest against the effect on users.
Purchases and subscription access
UI and Polar use checkout and billing information to take the steps you request before purchase, perform the subscription agreement, calculate and document charges and taxes, provide receipts and account management, prevent duplicate charges, reconcile failures, and handle cancellations, refunds, disputes, and support.
Analytics and service improvement
UI uses anonymous registry, documentation, source-copy, and request telemetry to understand which public materials are used, improve documentation and installation flows, measure reliability, prevent abuse, and maintain the Service. The telemetry is described in Section 2 and is not used for behavioral advertising.
Communications and legal duties
UI uses messages and evidence to answer requests, resolve disputes, protect rights, keep necessary records, and comply with law. Depending on the matter, the basis is performance of the agreement, a legal obligation, UI's legitimate interests in support and legal claims, or consent where the law requires a choice.
UI does not currently use personal information for behavioral advertising, data brokerage, or solely automated decisions that have a legal or similarly significant effect on a person.
6. Disclosures
- Supabase. Supabase provides the anonymous analytics session, event storage, and related database infrastructure. Better Auth handles account authentication.
- Google and GitHub. The selected provider receives and returns information only when you choose its sign-in flow.
- Better Auth and EDBN infrastructure. These systems provide account sessions, account records, entitlement checks, and security processing.
- Polar. Polar is the merchant of record for Pro purchases and handles checkout, payment methods, taxes, invoices, subscription management, refunds, and disputes.
- Hosting, network, and email providers. These providers handle requests, diagnostics, and messages on UI's behalf.
- Professional advisers and authorities. Information may be disclosed when reasonably necessary for advice, a lawful request, an investigation, safety, rights protection, or a dispute.
- Rights-process participants. UI may share the report substance and necessary contact details with an affected contributor, claimant, subscriber, or opposing party to review a rights dispute. If a statutory DMCA process applies, valid notices and counter-notices are forwarded as that process requires.
- A successor. Information may transfer in a merger, financing, reorganization, insolvency, or sale, subject to applicable confidentiality and notice duties.
This version of the application contains no advertising or data-broker integration and does not send personal information to an advertising integration for cross-context behavioral advertising. Providers may process information under their own privacy notices and contractual obligations. EDBN discloses the provider categories and purposes here and does not sell personal information.
7. International processing
EDBN and its service providers may process information outside the country where you live. Where a law requires safeguards for an international transfer, EDBN uses a lawful transfer mechanism and appropriate contractual, organizational, or technical safeguards. You may contact the privacy address for information about a transfer that concerns your request.
8. Retention and deletion
Authentication records are kept while an account is active and until they are deleted or must be retained for a security, dispute, or legal reason. You may request deletion at the privacy address.
Billing records are kept for subscription administration, accounting, tax, refund, chargeback, fraud-prevention, support, and legal-claim requirements. Signed webhook bodies are restricted to server-side processing, removed from the operational inbox after successful normalization, and retained longer only while an event is unresolved. Provider and financial-record retention can differ where Polar or applicable law requires it. A deletion request may therefore sever the account link while legally required transaction evidence remains.
Sessions remain until expiry, revocation, sign-out, account deletion, or another configured session limit. Signing out through the current UI ends the session on that device; it does not promise to revoke every session on every device. Revoking the underlying session prevents later refreshes, but an access token already issued for that session may remain accepted until the token expires. Infrastructure, authentication, and email logs are kept for the provider's configured operational period. Legal, privacy, security, and rights correspondence is kept as long as needed to resolve the matter, meet a legal duty, or establish or defend a claim.
Anonymous registry and copy telemetry is retained for product analytics, abuse prevention, reliability, and legal or security needs, and is deleted or aggregated when it is no longer reasonably needed. Local browser queue entries expire after seven days or are removed after successful delivery.
Deletion from active systems may not immediately remove a record from a rotating backup. A restricted copy may be kept during the backup cycle or under a legal hold. UI will not keep information longer merely because it may be useful someday.
9. Security and incidents
The application is configured to use secure production transport, security headers, no-cache responses for authentication writes, signed session validation, server-only secrets, rate limiting, and restricted analytics writes. Session cookies and local storage require protection against script injection. Hosting, identity, logging, mailbox, payment, and database providers apply additional controls under their own security programs. No storage or transmission method is completely secure.
Report suspected compromise to security@edbn.me. UI will notify affected people and authorities when applicable law requires it.
10. Choices and rights
Depending on where you live, you may have the right to access, correct, delete, restrict, object to, or receive a copy of personal information; withdraw consent; appeal a refusal; use an authorized agent; or complain to a privacy regulator. UI will not discriminate against you for making a privacy request.
Send a request to privacy@edbn.me. Identify the email associated with the account and the request. UI may ask for the minimum additional information needed to verify identity, authority, and scope. Do not email passwords, session tokens, or unnecessary identity documents. UI will respond within the period required by applicable law and explain any lawful refusal.
11. California and other U.S. state disclosures
The current account and Google or GitHub sign-in paths handle identifiers such as email address, Better Auth user identifier, IP address, provider identifier, and authorized basic profile fields. They also handle internet or electronic activity such as user agent, requested website URL, request timestamps, authentication events, and session or security events. Account credentials and session tokens may qualify as sensitive personal information. UI uses them for authentication and account security, not to infer characteristics about a person. Pro billing also handles commercial information such as subscription, payment, refund, dispute, invoice, amount, currency, and paid-period records. Registry telemetry can include the categories listed in Section 2, including coarse location, device, bot, path, and source-copy metadata.
The sources and purposes are described in Sections 3 and 4. Better Auth receives account and session data. Supabase receives anonymous analytics sessions and registry events. Google or GitHub receives the OAuth request when its sign-in flow is selected and returns the profile fields authorized for sign-in. Hosting and network providers receive ordinary website request data. A mail provider receives information included in messages sent to UI. Polar receives checkout and billing information when Pro is used. This application contains no sale or cross-context advertising integration, so there is no such integration to opt out of today.
California residents may request access to categories and specific pieces, correction, or deletion, and may use an authorized agent. Other state laws may also provide portability, opt-out, appeal, or related rights. Use the privacy address in Section 10. These provisions apply when the relevant law covers EDBN and the processing.
12. EEA, United Kingdom, and Switzerland
Sections 2 through 8 describe the categories, sources, purposes, legal bases, recipient categories, transfer status, and retention criteria for current processing. You may complain to the data protection authority where you live or work. Send privacy requests and questions to the privacy address in Section 10.
13. India
EDBN handles personal information in accordance with applicable Indian data-protection, grievance, consent, security, breach, retention, and children's-data requirements. Current requests and grievances can be sent to the privacy address above.
14. Minors
UI is not offered to anyone under 18. If UI learns that a minor created an account or provided personal information, it will restrict the account and delete the information unless preservation is legally required. A parent or guardian can contact the privacy address.
15. Changes and contact
UI will update this policy when its real data practices, providers, or legal duties materially change. The revised version will show a new effective date. Additional notice or consent will be provided when law requires it before a materially new use begins.
Privacy questions, requests, and complaints: privacy@edbn.me. Formal legal notices: legal@edbn.me.