Privacy Policy

Shavin is built and run by the Shavin team (“we”, “us”). This policy explains what personal information we handle when you use shavin.cc, Shavin Studio, the community, the kits storefront and the documentation site.

It covers our hosted services. The open-source packages (@shavin/ui, the CLI, the MCP server, the skills and block-schema) run on your own machine. We do not receive your code, tokens or project files when you use them.

The Dev Inspector bridge and the MCP server talk to your browser and your AI assistant over localhost. That traffic stays on your computer.

• Account details. When you sign in with GitHub or Google, our authentication provider gives us your email address, display name, avatar and the account ID from that provider. We never see your GitHub or Google password.
• Your work. Studio projects (name, canvas data, preview image) and sessions are saved to your account so you can come back to them.
• Community submissions. Blocks you publish to the community are public, together with the name and description you give them and your username.
• Messages. If you email us, for example about a kit, we keep the message and our reply.
• Technical logs. Like most sites, our hosting infrastructure processes standard request data such as IP address, browser type and the page requested, to serve pages and keep the service secure.

At the time of writing this website does not run advertising trackers or third-party analytics. If that changes, we will update this policy before it does.

We use your browser’s local storage for your light or dark theme preference and, when you are signed in, for the session token issued by our authentication provider. We do not use advertising cookies.

You can clear this data in your browser settings. You will be signed out and the theme will reset.

• To sign you in and keep your Studio projects and community blocks available.
• To operate, secure and fix the services, and to prevent abuse.
• To answer your messages and handle kit enquiries.
• To meet legal obligations.

We do not sell your personal information.

We use a small number of service providers who process data for us: Supabase for authentication and the database, our hosting provider for serving the sites, and GitHub or Google when you choose to sign in with them. They may only use the data to provide their service to us, under their own terms and privacy policies.

We may disclose information if the law requires it, or to protect the rights, safety and security of our users and the services.

If you connect an AI assistant to the MCP server, that assistant processes what you send it under its own provider’s terms. We are not part of that exchange.

We keep account data and saved projects for as long as your account exists. Public community blocks stay visible until you remove them or ask us to. Email correspondence is kept for as long as it is useful to the conversation or required by law.

You can ask us to give you a copy of your data, correct it, or delete it, and you can object to how we use it. Depending on where you live (for example under the GDPR or the CCPA) you may have further rights.

We use reasonable technical and organisational measures to protect your information, including access controls and encrypted connections. No online service is completely secure, so we cannot guarantee absolute security.

Our services are not directed at children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

Our providers may process data in countries other than yours. Where that happens we rely on the safeguards those providers offer, such as standard contractual clauses.

We may update this policy as the services change. The date at the top shows the latest version. For material changes we will tell signed-in users, for example by email or a notice on the site.