Privacy Policy

1. What we collect

Account data: your name, email address, and organization membership, handled by our authentication provider (Clerk).

Repository data: when you connect a repository, we read the content needed to verify governance results and store findings, component and token metadata, contract definitions, and scan summaries. CI reports can contain offending literals and structured source-derived facts, but they do not upload whole files, whole source lines, or function bodies.

Connected AI tools and MCP: when you ask a connected tool to inspect or repair UI code, Fragments receives the code snippet and filename you submit and returns design-system information, findings, and any repaired code. We record tool activity and contract/check receipts. Compliance workflows can also store task results containing returned code; this differs from the source-derived summaries in CI reports.

Usage and diagnostics: product analytics on our public pages (PostHog, plus Vercel Analytics and Speed Insights), and error reports — captured by PostHog on the public site and by Sentry in Fragments Cloud — that help us fix failures.

AI theme creator: if you describe a theme on our theme creator page, that description is sent to OpenAI to generate the theme. Send only text you are happy to share with a third-party model provider.

AI documentation and brand guidance: component enrichment sends component names, source paths, props, composition information, and existing descriptions to OpenAI. Generated brand guidelines send bounded repository/project information, component and token metadata, token-use summaries, and relevant scan findings to OpenAI to produce guidance.

Waitlist and updates: if you give us your email for product updates we store it with your submission details.

2. What we use it for

To run the service you asked for: scanning repositories, reporting findings, creating the check runs and pull-request comments you configure, and serving your design-system data to the tools you connect.

To operate the business: billing through Stripe, transactional email through Resend, support, and security.

To connect to tools you authorize: we return the selected project's design-system information and requested results to that tool. Connecting a hosted MCP server does not give it access to local files; a coding tool must explicitly send the relevant code.

We do not sell personal data, and we do not use your code to train machine-learning models.

3. Who processes it

We use a small set of processors to run the service: Clerk (authentication), Convex (data storage and functions), GitHub (repository access via the GitHub App you install), Stripe (payments), Sentry (error reporting), Resend (email), PostHog (product analytics and public-site error capture), OpenAI (theme creation, component documentation enrichment, and generated brand guidelines), and our hosting providers. Each receives only what its role requires.

AI hosts you choose to connect, such as ChatGPT, Codex, or Claude, receive the tool results and source context used in your request under their own terms and privacy policies. When supported and enabled, an MCP compliance workflow can ask that host to generate a repair from the submitted code and findings. Fragments does not choose a separate model provider for that host-side request.

4. Retention and deletion

We keep data while your account is active. Disconnecting a repository stops new collection for it, and deleting your account removes your stored account and repository data from the live service within a reasonable period, after which it also ages out of backups.

MCP activity records, receipts, and stored task results are part of the associated project or organization data. Disconnecting an AI tool revokes its future access; it does not itself erase records already stored. You can request deletion through the account controls or contact below. A workflow's task-expiry time is not a promise that all stored records are deleted at that time.

Fragments Cloud account settings carry a delete-account action for self-serve deletion. You can also request access to, correction of, or deletion of your personal data at any time by emailing hello@usefragments.com.

5. Cookies

The sites use cookies needed for sign-in and session state. Marketing analytics are kept minimal; we do not run third-party advertising trackers.

6. International transfers and legal bases

We operate from the United Kingdom and use processors in other countries, relying on standard contractual protections for transfers. Where UK and EU data-protection law applies, we process personal data to perform our contract with you, to meet legal obligations, and for legitimate interests such as securing the service.

7. Changes

If this policy changes materially we will update this page and its date. Continued use of the service after a change means the new policy applies.

Questions about this document: hello@usefragments.com