Your privacy.

Information we process.

Account information includes your email address, authentication identifiers and session information. Billing information includes Stripe customer, subscription, checkout and payment identifiers and verified membership, purchased shader ownership, Annual upgrade credit redemption, refund or dispute status. Stripe handles payment-card details; our application does not store full card numbers.

Saved configurations include shader settings, names, supported remote image references and timestamps. Export history records the shader, requested format and time, not the generated code or embedded images. An export request may be a preview or a canceled browser download; history alone does not establish that a file was saved.

Hosting, authentication, security and email providers process technical information such as IP addresses, request metadata, device/browser information, delivery information and operational logs. Support messages contain the information you choose to send. Do not email full payment-card details or passwords.

Why we use information.

We use information to authenticate you, restore sessions, save and retrieve configurations, verify paid access, generate requested exports, manage subscriptions, respond to support requests, prevent abuse, troubleshoot failures and comply with legal obligations. We do not sell account information or use saved configurations for targeted advertising.

Where applicable law requires a legal basis, providing the requested service relies on our agreement with you; security and service administration rely on our legitimate interests; billing and legally required records support legal obligations; optional features that require consent rely on that consent. You may contact us about applicable objections or withdrawals.

Images and browser storage.

Uploaded images and local customization drafts are stored in your browser. If you request a code export containing an image, the browser sends that image to our private export function to generate the response. We do not retain those image bytes in export history or intentionally log them.

Cloud saves omit embedded image uploads with your confirmation. A remote image URL can be saved as a reference. Loading it contacts that external host, which may receive your IP address and request information under its own privacy practices.

We use browser storage for necessary authentication, saved local preferences, shader drafts and sign-in return navigation. Clearing that storage can remove local drafts and sign you out. It does not cancel a subscription or delete cloud saves.

Striktly for Figma.

The image-output release of Striktly. Living Shaders. runs its previews, editing and PNG rendering locally in the Figma plugin. It requires no Striktly account, makes no network requests, and sends no Figma document content, images or analytics to Striktly. Image fills and the settings needed to reopen them, including any images you upload into that configuration, are saved in your Figma file. Anyone with access to that file may be able to access this content under Figma’s file permissions and privacy practices. Removing a layer removes its active saved configuration; Figma version history and backups follow Figma’s policies.

If you use a separate connected development build and choose to connect your Striktly membership, Striktly processes your account identity, current shader access and a revocable connection. Approval requests expire after ten minutes and plugin connections after seven days. The server stores a hash of the plugin token; the plugin stores the scoped token in Figma client storage. Your website sign-in credential, Figma file contents and uploaded images are not shared between the plugin and Striktly. You can revoke a connection from your account’s Figma connections page. Expired requests and sessions are removed by scheduled cleanup.

Striktly MCP connections.

If you connect an AI assistant, we process your account identifier, current Pro membership, the application name and registered callback addresses, approved shader permissions, and connection dates. Application names are supplied by the connecting client. You approve each connection on Striktly and may revoke it from Account → AI connections. These credentials grant shader access only; they do not grant billing, administration, saved-configuration access, or access to files on your computer.

Authorization codes expire after five minutes, access credentials after one hour, and connections after 30 days. Refresh credentials rotate when used; reuse of an old refresh credential revokes the connection. Credentials are stored as hashes on our server. Expired authorization codes and connections are removed by daily cleanup; token history is removed with its connection. Application registrations expire after one year and are removed by daily cleanup.

Shader configurations are processed to produce previews and code exports, but are not retained as MCP conversation history. We do not intentionally log prompts, generated source, images, or credentials. Existing export metadata and account-level usage totals also cover MCP exports. The assistant may confirm delivery after writing files; confirmation is not independent proof of a file saved to disk. Your chosen AI provider receives tool results and handles your conversations and project files under its own policies. Only connect an application you trust.

Optional analytics. Your choice.

With your permission, Google Analytics helps us understand page visits, selected button actions, successful sign-ins, checkout starts, verified purchases and shader kit download requests. Analytics is optional: we do not load the Google Analytics tag until you choose “Allow analytics.” Choosing “No thanks” does not limit your membership or access.

Google receives technical information such as your IP address, device/browser details, pages visited, cookie identifiers and these events. Purchase events include the plan, amount, tax, currency and a pseudonymous transaction reference. Download events include the shader and export format; they indicate a successful export followed by a browser download request, not proof that a file was saved. We do not send your email, account identifier, saved configuration names or contents, uploaded images, payment-card details, or URL query strings and fragments to Analytics. Advertising storage, advertising personalization and Google signals are disabled.

Analytics cookies identify a browser across visits. We remember your choice for up to six months. Use “Privacy choices” in the footer, including on the sign-in page, to change or withdraw permission. Withdrawal stops future analytics events and removes our Google Analytics cookies; it does not retroactively erase information already processed by Google. Google handles analytics information under its privacy policy. Contact us for applicable access or deletion requests.

Service providers and disclosures.

Supabase provides authentication and the application database, including secure password verification. If you choose Google sign-in or connect Google to your account, Google shares basic identity information such as your email address, name and profile image with Supabase so we can authenticate you. We do not request access to your Gmail messages, Drive files or contacts. Google sign-in is separate from optional Google Analytics consent. Netlify hosts the website and server functions, and processes contact-form submissions, including your name, email address, topic and message, so we can respond. Stripe processes payments, tax calculations and billing management. Resend delivers authentication email. GoDaddy and Microsoft 365 provide the support mailbox. These providers process information needed for their roles and may maintain their own operational or legally required records.

We may disclose information when necessary to comply with lawful requests, protect users and the service, investigate fraud or disputes, or handle a business transfer with appropriate protections. We do not make your private saved configurations public by default.

Our service providers may process information in the United States and other countries where they operate. The production database and authentication email region are in the United States. Privacy laws may differ by location; contact us about applicable transfer safeguards.

How long information remains.

Saved configurations remain until you delete them or request account deletion. Detailed application export metadata is retained for 90 days. Account-level totals for kit requests, download initiations, code copies and previews remain while your account exists so we can administer access and support requests; they are removed with account deletion. Download initiation and clipboard completion may be confirmed by your browser, but do not establish that a file was saved to disk. Older preview and copy requests may be indistinguishable. Processed webhook identifiers are retained for 365 days, with daily cleanup. Rate-limit counters older than one hour are removed during request processing, with daily cleanup as a fallback.

We process verified account-deletion requests within 30 days, except billing, legal, fraud-prevention or dispute records that must remain for their applicable purpose. Payment processors, hosting logs, mail systems and backups follow their own retention schedules; deletion from the active application does not instantly remove every provider backup or legally retained record. We limit retained information to what is needed and restrict its use.

Support correspondence remains while needed to resolve the request and meet related billing, security or legal obligations. You may ask us about a specific record or request deletion when there is no continuing need.

Your choices and requests.

You can edit or delete saved configurations through your account, cancel annual renewal through Account → Manage billing, and clear local browser storage. For access, correction, a portable copy, account deletion, an objection or another applicable privacy request, email info@striktly.com. We verify ownership before disclosing or changing account data.

Rights and exceptions depend on your location. You may be entitled to complain to a relevant privacy authority. We do not require you to waive mandatory rights to use the service. Account deletion and subscription cancellation are separate actions; contact us if you need help with both.

Security, age and changes.

We use access controls, authenticated server functions, encrypted transport and service-provider safeguards appropriate to the service. No system can guarantee absolute security. Keep email access and account sessions secure and report suspected unauthorized access to support.

The service is intended for people able to enter an agreement and is not directed to children under 13. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.

We will post material updates with a new effective date and provide additional notice where appropriate. Contact Striktly LLC at info@striktly.com with questions about this notice.