Privacy Policy

Who operates shads.app

shads.app is operated by the shads.app product team and is available at https://shads.app.

• This Privacy Policy explains how we collect, use, store, share, and delete information when you use the website, theme builder, share links, gallery, accounts, billing, and related APIs.
• Privacy and data requests: [email protected]
• Product support: [email protected]
• This page is the authoritative privacy notice for Google OAuth / Sign-In verification and for users of the service.

What shads.app is

shads.app is a visual theme builder for shadcn/ui. You can design tokens in the browser, preview them on real components, export CSS/theme files, and optionally sign in for cloud saves, sharing, hosted AI, and Pro features.

• You can use the core builder without creating an account.
• Signing in unlocks cloud-saved themes, account-linked share links, usage quotas, and hosted AI generation.
• Pro subscriptions add paid features listed on the Pricing page and are billed through Dodo Payments.

Contact email

How to reach us about privacy or your data:

• Privacy, deletion, and data requests: [email protected]
• General support: [email protected]
• Billing questions: [email protected]
• You can also use contact for the full list of aliases.

Information we collect

What we collect depends on whether you browse anonymously, sign in, share a theme, subscribe, send feedback, or use hosted AI.

• Google account information when signing in with Google: name; email address; profile picture (when provided by Google); and a Google / Neon Auth user identifier used to link your session to your shads.app account.
• Account and authentication information: your Neon Auth user id, session cookies, display name, email, avatar URL, plan status, and (if you subscribe) Dodo customer and subscription identifiers.
• Themes and configurations you save: cloud theme names and token/config JSON, plus version history when your plan supports it.
• Public / shared themes: theme snapshots, visibility, mode (editable or readonly), optional preview images, expiry, and share ids used for /?share=… links, Community gallery entries, and /r/{id}.json install URLs.
• Usage information: monthly quota counters (for example cloud saves, public shares, hosted AI generations), AI usage events (status, model, token counts, latency, error codes), and product analytics events described below.
• Technical information: IP address (used for rate limiting abuse controls; for feedback we store a one-way hash of the IP, not the raw address in the feedback row), browser User-Agent when you submit feedback, and standard request metadata processed by our hosting provider.
• Feedback you choose to send: message text, category, optional contact email (anonymous submissions), page URL, and related metadata.
• Billing information needed to sync Pro status (customer/subscription ids and email as provided by Dodo). We do not store full payment card numbers on our servers.

Information stored locally

Much of the builder works offline by keeping drafts and UI preferences in your browser. This data stays on your device unless you sign in and save to the cloud, create a share link, or otherwise send it to our servers.

• localStorage is used for draft theme state (so a refresh keeps your work), onboarding dismissal, preview UI state, dark-mode preference, dock/sidebar layout preferences, local user presets, and custom font entries you add on that device.
• sessionStorage is used for short-lived UI state such as which cloud theme is currently active in the session.
• Authentication sessions use HttpOnly cookies managed by Neon Auth (not readable by page JavaScript).
• Clearing site data / cookies in your browser removes local drafts, preferences, and signed-in session cookies for that browser. Cloud themes and shares already saved to your account remain until you delete them or delete your account.
• Account deletion does not automatically wipe localStorage on your devices; clear browser storage separately if you want local drafts removed.
• We no longer store Bring-Your-Own OpenRouter API keys in the browser. Hosted AI uses a server-side key when you are signed in.

How we use information

We use the information above to operate and improve shads.app:

• Authenticate users and keep you signed in securely.
• Save and retrieve your cloud themes and version history.
• Enable sharing, Community gallery listings, and registry install URLs.
• Provide the theme builder, export/import, and hosted AI features you request.
• Enforce plan limits, prevent abuse, and maintain security (rate limits, fraud/abuse controls).
• Process Pro subscriptions and sync billing status with Dodo Payments.
• Send transactional product emails when necessary (for example welcome or account-deleted confirmations) via UsePlunk.
• Measure aggregate product usage with Umami.
• Respond to support, privacy, and feedback requests.

We do not sell personal information. We do not use Google user data for advertising.

Google Sign-In

Google is used only for authentication. Sign-in is provided through Neon Auth (built on Better Auth), which redirects you to Google’s OAuth consent screen and returns identity information needed to create or restore your shads.app session.

• shads.app requests the Google OAuth scopes required for authentication, including openid, email, and profile. These scopes allow shads.app to receive your Google account identifier, email address, name, and profile picture when Google provides them.
• We do not request Google scopes for Gmail, Drive, Contacts, Calendar, or other Google products unrelated to signing in.
• shads.app receives only the profile fields permitted by those scopes and exposed by Neon Auth to our app (email, name, image/avatar, and auth user id).
• Google account data is used solely to authenticate you, display your account in the UI, link cloud themes and quotas to your user record, and communicate about the account when necessary.
• We do not sell Google user data. We do not use Google user data for advertising, unrelated profiling, or any purpose other than providing and securing shads.app authentication and account features.
• You can revoke shads.app’s access to your Google Account at https://myaccount.google.com/permissions. Revoking access does not by itself delete your shads.app cloud data — use in-app account deletion or email us.

Data sharing / third parties

We share or process data with the service providers needed to run shads.app. We do not sell personal data. Each provider processes data under its own terms and privacy policy.

We may also disclose information if required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset transfer — in which case we will continue to protect personal data as described here or provide notice of changes.

Data retention

How long we keep different categories of data:

• Account profile and cloud themes: retained until you delete the theme(s) or delete your account.
• Theme version history: retained with the theme while your account exists (feature availability depends on plan).
• Public / owned share links: Free shares typically expire after 90 days; Pro shares may be permanent (no expiry). Expired or deleted shares stop working for /?share=… and /r/{id}.json.
• Usage counters and AI audit events: retained for quota enforcement, debugging, and abuse prevention while the account exists; deleted when the account is deleted.
• Rate-limit records keyed by IP or user: retained only for short windows needed to enforce limits, then expire.
• Feedback submissions: retained to improve the product; if you delete your account, feedback rows are kept but the user id link is cleared.
• Email delivery logs: retained for idempotency and operational reliability; user id may be cleared on account deletion.
• Billing webhook idempotency records: retained for payment reliability and are not user-profile data.
• Dodo customer records: managed by Dodo; account deletion cancels an active subscription when possible but does not erase Dodo’s own payment records.
• Browser local/session storage: retained on your device until you clear it.

Data deletion

You can delete your account and associated cloud data from the product, or by contacting us.

1. In-app: open Account settings → Delete account, confirm by typing your account email. This calls our account deletion API.
2. Deletion cancels an active Dodo subscription when a subscription id is present (best-effort), sends an account-deleted confirmation email, removes the Neon Auth user (best-effort), deletes owned shares and your user row, and cascades deletion of cloud themes, theme versions, usage counters, and AI usage events.
3. After deletion you are signed out. Re-signing in with the same email creates a new empty free account; previous cloud themes and shares are not restored.

If you cannot use the in-app flow, email [email protected] from your account email and request deletion. We will verify ownership before acting.

Security

We take reasonable technical and organizational measures to protect data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

• Sessions use HttpOnly cookies via Neon Auth with SameSite protections.
• Application secrets and API keys are kept in server-side environment configuration, not in public client bundles.
• TLS is used to protect data in transit to shads.app.
• Database access is restricted to our application infrastructure.
• Share creation, feedback, and hosted AI are rate-limited to reduce abuse.
• Payment card data is processed by Dodo Payments rather than stored on our servers.

Cookies and similar technologies

We use cookies and browser storage as follows — not for cross-site advertising.

• Essential cookies: Neon Auth session cookies keep you signed in and secure the OAuth callback flow.
• localStorage / sessionStorage: draft themes, UI preferences, and related builder state as described in “Information stored locally”.
• Analytics: Umami is loaded on production builds when configured; it does not use cookies for tracking.
• You can block or clear cookies and site storage in your browser. Blocking essential auth cookies will prevent signing in.

Children’s privacy

shads.app is not directed to children, and we do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction).

• If you believe a child has provided personal information, contact us and we will delete it promptly where required.
• If you are under the applicable age of digital consent in your country, do not use the service without appropriate guardian permission where required by law.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date on this page and, where appropriate, provide additional notice.

Last updated: September 22, 2026.

Contact

Questions about this Privacy Policy or your personal data:

• Email [email protected]
• Support [email protected]
• More options: https://shads.app/contact