WebberUI Privacy Policy

Last updated: August 13, 2026

This document is published in English only. We do not maintain a translated version, because two versions of a contract eventually disagree and only one of them can control.

1. Who We Are and What This Policy Covers

1.1 WebberUI (webberui.com) is a React and Tailwind CSS UI component registry operated by Teyra LLC ("Teyra", "we", "us", "our"), a limited liability company formed in Wyoming, United States with its registered business address at 30 N Gould St Ste N, Sheridan, WY 82801, United States. For anything in this Privacy Policy, write to official@teyrallc.com.

1.2 This Privacy Policy (the "Policy") explains what personal data — information that relates to an identified or identifiable person ("Personal Data") — we collect, why we collect it, who sees it, and what you can do about it. It covers:

• the Site — webberui.com, including the documentation, component gallery, templates, composer, pricing, and account pages;
• the Registry API — the endpoints on webberui.com (such as /r/* and /api/*) that deliver component source code, install tokens, search results, and the early-access email list; and
• the CLI Tools — requests made to the Registry API by the shadcn CLI or by our published npm package @webberui/mcp. These tools run on your own machine, make only the registry requests you ask them to make, and contain no analytics or tracking of their own.

1.3 This Policy does not cover third-party websites we link to, and it does not cover your own projects after you install our components into them — because once installed, our components send nothing anywhere (Section 3.7).

1.4 Companion documents: our Terms of Service, License Agreement, Cookie Policy, Refund & Billing Policy, and Subprocessors list. This Policy is the governing document for Personal Data.

2. The Short Version

We collect as little as we can get away with, and this Policy says exactly what that is:

• Browsing and installing the 274 free components requires no account and no login. You can use most of WebberUI without ever telling us who you are.
• Our own database stores exactly one category of Personal Data: an email address you voluntarily submit — with the page you submitted it from and a timestamp. Not your IP address. Not your browser fingerprint.
• Sign-in (needed for Pro content) is handled by Clerk. We read from your account only what we need to check Pro access, and we never link your account to analytics.
• Analytics (PostHog) runs under a random anonymous ID with session recording, autocapture, dead-click capture, and surveys all switched off.
• We never sell, rent, or trade Personal Data — to anyone, at any price.
• Installed components never phone home. No telemetry, no runtime license checks, no kill switch, no expiry. Our servers going down does not affect your shipped product.

The rest of this Policy is the detailed version of those statements.

3. What We Collect, Why, and on What Legal Basis

This Section is organized by where the data comes from. For each source we state what is collected, what it is used for, and the legal basis we rely on under the EU General Data Protection Regulation ("GDPR") and the UK GDPR where they apply.

3.1 Account Data (Clerk)

3.1.1 You never need an account for the free tier. An account is required only to access Pro content — including under the current launch promotion, which grants all Pro content free to signed-in users while it runs.

3.1.2 Authentication is provided by Clerk, our sign-in subprocessor (see /subprocessors). When you sign up or sign in, Clerk collects and processes your email address, basic profile information provided by you or by your single sign-on provider (such as your name and avatar), and authentication and session data, including Clerk's session cookies. The sign-in methods currently offered are configured in our Clerk dashboard: as configured on 2026-08-13, sign-up and sign-in are offered with an email address (verified by a one-time code or a verification link), a username, and a password. Google is also available as a social sign-in provider. Phone-number sign-in and passkeys are disabled, and no other social or enterprise connection is active. Clerk also stores an optional first and last name, which we never require.

3.1.3 What our application reads from your Clerk account is deliberately narrow:

• your user ID and, if you use a team, your organization ID;
• your plan entitlements (whether your account or organization has Pro access), including an administrator-set "pro" flag used for manually granted access;
• whether you are currently signed in; and
• your first name, shown in the account menu so you can see which account you are signed into.

3.1.4 What we deliberately do not do: we never call any analytics "identify" function on you. Your account identity is never connected to the anonymous analytics ID described in Section 3.3, and we keep no separate copy of your account profile in our own database.

3.1.5 Purposes. (a) Authenticating you and checking Pro entitlements when you view or install Pro content; (b) letting organization administrators manage team access; and (c) launch-related communications: we are honest about this — one reason the current "sign in and get all Pro free" promotion exists is to build a list of people who care about WebberUI. If you create an account during the promotion, we may email you when paid plans launch and about major product news. The sign-up flow will disclose that promotional accounts may receive these launch emails, with an opt-out offered at sign-up, and every such email will include a working one-click unsubscribe. You can opt out at any time by emailing official@teyrallc.com, and opting out never affects components you have already installed.

3.1.6 Legal bases. Performance of a contract (GDPR Art. 6(1)(b)) for authentication and entitlement checks; our legitimate interests in telling people who signed up for free Pro access about the paid launch (Art. 6(1)(f)), or your consent (Art. 6(1)(a)) where applicable law requires it for the emails described above.

3.2 Early-Access Email List

3.2.1 In several places on the Site you can leave your email address to be notified when Pro launches. This happens only when you actively submit the form — we never collect an email address any other way.

3.2.2 What is stored — exactly three fields, in our Cloudflare D1 database:

• your email address (lowercased);
• the page you submitted from (one of homepage, pricing, docs, components, templates; anything else is recorded as unknown); and
• a timestamp.

That is the entire record. The endpoint is written so that it does not read your IP address or your browser's user agent at all, and the analytics event fired when you subscribe records only the page the form was on — never the email itself.

3.2.3 Anti-abuse without surveillance: the endpoint uses a same-origin check and a hidden honeypot field instead of tracking you, and a duplicate submission returns the same success response as a new one, so no one can use the form to test whether an address is on our list.

3.2.4 Purpose. One purpose only: notifying you about the launch you asked to hear about. We do not forward, sell, or use this list for any other marketing — a promise we already make next to the form itself.

3.2.5 Legal basis. Your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time by emailing us; deletions from this list are usually completed the same day, and we never ask why (Section 9).

3.3 Product Analytics (PostHog and Cloudflare Web Analytics)

3.3.1 We use PostHog, a product analytics service, loaded in your browser. If our analytics key is not configured, the analytics code is a complete no-op: nothing loads and no requests are sent.

3.3.2 Analytics data is sent to PostHog's US-hosted cloud (see Section 7 on international transfers). PostHog stores a randomly generated anonymous ID in your browser's localStorage and in a cookie (see also our Cookie Policy). Because our code never calls PostHog's "identify" function, this ID is never linked to your account, your email, or any other identity.

3.3.3 What is deliberately switched off in our configuration:

• session recording / session replay — off;
• autocapture of clicks and form interactions — off;
• dead-click capture — off;
• surveys — off;
• no advertising pixels, no ad-network data exchange, no cross-site profiling — none of this exists on the Site at all.

3.3.4 What is captured: manually sent pageviews (page path, referrer URL and referring domain, landing path), page-leave events, Core Web Vitals performance metrics (metric name, value, rating, and page path), and a fixed, closed list of named product events: pro_item_401, copy_install_command, component_view, composer_open, email_subscribe, pricing_view, pricing_scope_switch, checkout_click, doc_scroll_75, and web_vital. Event properties are limited to things like component or template slugs, page types, and pricing item slugs — not free-form content and never your email address.

3.3.5 Like any web request, requests to PostHog necessarily carry your IP address at the network level. Our code sets no additional IP-related options. As configured on 2026-08-13, our PostHog project does not have "Discard client IP data" enabled, which means PostHog stores the client IP address alongside each event for the retention period in Section 8.3. We are reviewing this setting; if we enable discarding, we will update this Policy and the Subprocessors list.

3.3.6 Purpose. Understanding, in aggregate, which components and pages are useful and how the Site performs, so we can improve it.

3.3.7 Legal basis. Our legitimate interests (GDPR Art. 6(1)(f)) in measuring aggregate usage of a product we operate, implemented in a deliberately minimal configuration. You can opt out at any time — see Section 10 (Do Not Track and Global Privacy Control). Content blockers also work: the Site functions fully with analytics blocked, and we do not attempt to circumvent blockers.

3.3.8 Cloudflare Web Analytics. In addition to PostHog, our Cloudflare zone serves a Cloudflare Web Analytics beacon (static.cloudflareinsights.com/beacon.min.js) on page loads. It reports page performance and traffic measurements to Cloudflare over a first-party endpoint on our own domain (/cdn-cgi/rum).

3.3.9 It sets no cookies and no identifiers. Cloudflare Web Analytics is cookieless by design: it stores nothing in your browser, assigns you no identifier, and does not track you between sites or between visits. It measures page loads, not people. The only cookies on the Site remain the Clerk and PostHog cookies listed in the Cookie Policy (/cookies).

3.3.10 Legal basis, and how to stop it. Our legitimate interests (GDPR Art. 6(1)(f)) in knowing whether the Site is fast and reachable. Because the beacon is served by our hosting provider rather than by our application code, our Do Not Track and Global Privacy Control handling (Section 10) applies to PostHog, not to this beacon. Content blockers do block it, and the Site works fully without it.

3.4 Server Logs (Cloudflare)

3.4.1 The Site and Registry API run on Cloudflare's network, which produces standard access logs: request time, path, response status, and coarse region. Our own application code contains no logging statements, and we deliberately refuse long-lived license keys in URLs specifically so they can never end up in these logs (Section 3.5).

3.4.2 We do not match server logs to any identity. They are used only for debugging, security, and abuse prevention.

3.4.3 Log retention follows Cloudflare's platform policy. Retention is set by Cloudflare and is not configurable by us. On our current plan it is 7 days, which is also Cloudflare's maximum for Workers Logs.

3.4.4 Legal basis. Our legitimate interests (GDPR Art. 6(1)(f)) in keeping the Service secure and working.

3.5 Pro License Keys and Install Tokens

3.5.1 License keys are not tied to your identity. Long-lived Pro license keys are plain random strings held in a server-side secret. We keep no mapping from keys to customers and no per-download records — we could not produce a list of what you installed because that list does not exist.

3.5.2 Your key is sent only as an Authorization header when the shadcn CLI or the @webberui/mcp package downloads Pro content from our registry. Keys presented in URLs are deliberately rejected so they cannot leak into server or CDN logs.

3.5.3 Copy-paste install links use a separate mechanism: a cryptographically signed token that is valid for at most 15 minutes, restricted to a single resource, and verified statelessly — nothing about it is stored. Responses that involve keys or tokens are marked non-cacheable (private, no-store), and our referrer policy is configured so tokens do not leak into outbound Referer headers.

3.5.4 Pro source code you download is stamped with a visible license header containing the component name, target path, retrieval date, and license URL — never your identity. The header is informational, executes nothing, and can be deleted without any effect (see /license).

3.5.5 Legal basis. Performance of a contract (GDPR Art. 6(1)(b)): delivering the content your plan entitles you to.

3.6 Data That Stays in Your Browser

3.6.1 Several features store data only in your browser's localStorage. None of it is uploaded; we have no server-side copy:

• saved (favorited) components and templates;
• your custom Theme Studio tokens;
• your light/dark theme preference; and
• minor UI state (such as a dismissed demo banner).

3.6.2 Props Playground settings exist only in memory while the page is open and disappear when you close it — they are not stored anywhere, not even in localStorage.

3.6.3 You control this data: the settings page at /account/settings includes a one-click "clear saved items" option, and your browser's own storage controls remove everything.

3.6.4 Because this data never reaches us, it is not processing of Personal Data by us; we describe it here for completeness and honesty.

3.7 Installed Components: Nothing

3.7.1 This is a core promise of the product, and it is a privacy promise too: components installed into your project contain no telemetry, no phone-home, no runtime license verification, no remote kill switch, and no expiry. They make no network requests to us — ever. Nothing about you or your end users flows back to WebberUI from code you have installed.

3.7.2 This promise appears in our License Agreement and Terms of Service as well, and this Policy restates it: an outage or shutdown of webberui.com has no effect on components already in your projects.

3.8 Payment Data (Not Yet Collected)

3.8.1 Paid billing is not yet live; during the current launch promotion no payment or card is required for anything. As of the date above, we collect no payment data at all.

3.8.2 When paid subscriptions launch, payments will be processed by a dedicated payment provider Paddle.com Market Limited, which acts as merchant of record; we will not store full card numbers ourselves. Before billing goes live we will update this Policy, the Subprocessors list, and the Refund & Billing Policy to describe exactly what the provider processes.

3.9 Summary Table

4. What We Never Do

4.1 To make the promises above bindingly explicit, we do not:

• sell, rent, or trade Personal Data — to anyone, at any price;
• run advertising pixels, exchange data with ad networks, or build cross-site profiles;
• collect your email address without you actively submitting it;
• link your account identity to analytics;
• record your sessions or capture your interactions wholesale;
• put any reporting, tracking, or phone-home mechanism inside installed components; or
• use retention flows or other dark patterns to delay or discourage deletion requests.

5. Cookies and Similar Technologies

5.1 The Site uses only two categories of cookies and local storage set by our stack: Clerk session cookies (strictly necessary for sign-in, set only when authentication is enabled) and the PostHog analytics cookie and localStorage entry carrying the anonymous ID described in Section 3.3. Our own application code sets no cookies of its own. There are no advertising cookies of any kind. Separately, our hosting provider Cloudflare could set strictly-necessary operational cookies at the network edge, but as configured on 2026-08-13 it does not: Bot Fight Mode is off and we subscribe to no bot-management product, so no __cf_bm cookie is set — see the Cookie Policy for details.

5.2 The full inventory, lifetimes, and your choices are described in the Cookie Policy.

6. Who We Share Personal Data With

6.1 Subprocessors only. We share Personal Data only with the service providers that run the Service for us: Cloudflare (hosting, database, storage, logs), Clerk (authentication only), and PostHog (analytics). When paid subscriptions launch, payments will be handled by a dedicated payment provider Paddle.com Market Limited, which acts as merchant of record (see Section 3.8.2), and notification and transactional emails will be sent via a provider we have not yet selected — see /subprocessors. The current list, each provider's role, and locations are maintained at /subprocessors, which we will update before adding any new provider.

6.2 Legal requirements. If we are legally compelled to disclose Personal Data (for example by a valid court order), we will disclose only the narrowest scope required, and — unless the law prohibits it — we will tell you.

6.3 Business transfers. If Teyra LLC is ever acquired or its assets transferred, Personal Data would remain subject to the promises in this Policy, including the promise in Section 4.1 never to sell, rent, or trade it.

6.4 That is the complete list. There is no "including but not limited to" here.

7. International Transfers

7.1 The Site is served through Cloudflare's global network. Our early-access email list is stored in Cloudflare D1. We have not configured a jurisdiction restriction on that database. A D1 jurisdiction (such as eu) can only be set when the database is created and cannot be changed afterwards; ours was created without one, so Cloudflare selects and may change the primary location. We therefore do not promise that this data stays in any particular country or region, and transfers are covered by the safeguards described in Section 7.3.

7.2 Analytics data is processed by PostHog on servers in the United States, and account data is processed by Clerk in the United States.

7.3 If you are in the European Economic Area, the United Kingdom, or Switzerland, transfers to the United States rely on an appropriate safeguard both PostHog and Clerk, Inc. self-certify under the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework. You can request a copy of, or more information about, the applicable safeguard at official@teyrallc.com.

7.4 For users in Taiwan: the cross-border transfers described in this Section are exactly the ones that occur; there are no undisclosed overseas transfers.

8. How Long We Keep Personal Data

8.1 Account data — for as long as your account exists. Ask us by email to delete your account and its data at any time (Section 9).

8.2 Early-access email list — until we have sent the launch notification you signed up for, after which the list is deleted within 90 days. The 90 days exist so that we can re-send the notice once if it was filtered as spam; addresses that have not responded within three months are a liability, not an asset. Deletion on request is available at any time and is usually completed the same day.

8.3 Analytics — retained in PostHog for 1 year, per our project's data-retention setting.

8.4 Server logs — retained per Cloudflare's platform policy (see Section 3.4.3 and its confirmation marker).

8.5 Browser-only data — entirely under your control; it lives in your browser until you clear it.

8.6 License keys and install tokens — keys are not Personal Data as we hold them (no identity mapping); install tokens expire within 15 minutes and are never stored.

9. Your Rights

9.1 Everyone, Everywhere

9.1.1 Regardless of where you live, you can email official@teyrallc.com (suggested subject line: "Privacy request") to: access the Personal Data we hold about you, receive a copy of it, correct it, or delete it. You never have to give a reason, we never use retention flows to talk you out of it, and there is no charge.

9.1.2 We will act promptly; deletions from the early-access email list are usually completed the same day. To protect you, we may first verify that you control the email address the request concerns — that is the only verification we can meaningfully perform, since it is essentially the only identifier we hold.

9.2 European Economic Area and United Kingdom (GDPR / UK GDPR)

9.2.1 If the GDPR or UK GDPR applies to you, you additionally have the rights to: restrict processing, object to processing based on legitimate interests (including objecting to direct marketing at any time, which we will always honor), data portability, and to withdraw consent at any time without affecting prior processing.

9.2.2 You also have the right to lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office. We would appreciate the chance to resolve any concern first, but you do not need our permission to complain.

9.2.3 We do not use Personal Data for automated decision-making that produces legal or similarly significant effects.

9.3 California (CCPA / CPRA)

9.3.1 In the 12 months preceding the date of this Policy, we collected the following categories of personal information: identifiers (email address; name and account ID if you create an account); internet or other electronic network activity (pageviews, the fixed product-event list in Section 3.3, coarse server logs); and approximate location at country/region level only, derived from IP addresses by our infrastructure providers. Once paid billing launches, commercial information (subscription status) will be added and this Policy updated. Sources and purposes are as described in Section 3; disclosures are limited to the service providers in Section 6. Retention for each category follows Section 8: identifiers in account data are kept for as long as your account exists (Section 8.1); the early-access email list is kept until 90 days after the launch notification has been sent (Section 8.2); analytics data is retained for 1 year under our PostHog project's data-retention setting (Section 8.3); and server logs are retained per Cloudflare's platform policy Retention is set by Cloudflare and is not configurable by us. On our current plan it is 7 days, which is also Cloudflare's maximum for Workers Logs (Section 8.4).

9.3.2 We do not sell personal information, and we do not share personal information for cross-context behavioral advertising — and we have not done either in the preceding 12 months. We do not use or disclose sensitive personal information for purposes that would trigger a right to limit; sign-in credentials are processed by our authentication provider, and we never see passwords.

9.3.3 You have the rights to know/access, correct, delete, and port your personal information, and the right not to be discriminated against for exercising any right. Exercise them by emailing official@teyrallc.com. An authorized agent may act for you if we can reasonably verify the request. Because we do not sell or share personal information, there is nothing to opt out of — but we honor Global Privacy Control anyway (Section 10).

9.3.4 Implementation note (notice at collection). The email-capture form and the Clerk sign-up screen must link to this Policy — for example to the anchor /privacy#notice-at-collection — at or before the point of collection, so that this Section serves as the notice at collection required by the CCPA/CPRA.

9.4 Taiwan (Personal Data Protection Act)

9.4.1 If Taiwan's Personal Data Protection Act (個人資料保護法) applies to you, you may exercise the rights under its Article 3 with us at any time: to inquire about and review your Personal Data, to obtain a copy, to supplement or correct it, to demand that we cease collecting, processing, or using it, and to demand deletion. We provide all of these free of charge, by email to official@teyrallc.com.

10. Do Not Track and Global Privacy Control

10.1 If your browser sends a Do Not Track (DNT) signal or a Global Privacy Control (GPC) signal, we treat it as an opt-out of analytics for that browser verified in code: lib/analytics.ts checks navigator.globalPrivacyControl and Do-Not-Track before PostHog initializes, and sets respect_dnt: true.

10.2 GPC is also recognized as an opt-out preference signal under California law; because we do not sell or share personal information, honoring it costs you nothing and us nothing.

10.3 Content blockers that block analytics do not break the Site, and we do not attempt to detect or circumvent them.

11. Children

11.1 The Service is not directed at children under 13, and we do not knowingly collect Personal Data from them. If you believe a child under 13 has given us Personal Data, email official@teyrallc.com and we will delete it.

12. Security

12.1 What we actually do, stated without inflation:

• all traffic is encrypted in transit (HTTPS, with HTTP Strict Transport Security);
• security headers restrict framing, MIME-sniffing, and browser access to camera, microphone, geolocation, and payment APIs;
• authenticated and tokenized responses are marked non-cacheable so they cannot be served to anyone else;
• Pro source code lives in a private storage bucket that is never publicly accessible;
• secrets (license keys, signing secrets, API keys) are held in the hosting platform's secret store, never in code or the repository;
• install tokens are cryptographically signed, single-resource, and expire within 15 minutes; and
• we never store passwords — authentication is handled entirely by Clerk.

12.2 The most effective security control we have is structural: our own database holds almost nothing about you — a single table of voluntarily submitted email addresses. Data that is never collected cannot be breached.

12.3 Honesty requires saying this too: no internet service can promise perfect security. If a breach affecting your Personal Data ever occurs, we will notify you and the competent authorities as applicable law requires.

13. Changes to This Policy

13.1 When we change this Policy, we update the date at the top. Material changes will be flagged prominently on the Site.

13.2 A standing promise, carried over from the first version of our privacy page: if a change affects how we use email addresses — whether the early-access list or account emails — we will notify the affected people by email before the change takes effect, not just silently edit this page.

14. Contact

14.1 Teyra LLC — official@teyrallc.com. This is our only official contact channel; we currently operate no social media accounts.

14.2 For data-subject requests, the suggested subject line is "Privacy request". For everything else, plain language is fine — a human reads this inbox.

14.3 EU/UK representative. We have not appointed a representative under GDPR Article 27 or the UK GDPR. We do not target or monitor individuals in the EEA or the UK: the Site is published in English only, is not priced in euros or pounds, and we run no advertising or outbound marketing aimed at those regions. If that changes, we will appoint a representative and name them here before the change takes effect. You can reach us directly at official@teyrallc.com in the meantime, and we answer data-subject requests from anywhere.