Privacy Policy
The short version
Styles Gallery stores your account and your billing records, anything you deliberately send us — a newsletter signup, a message through the contact form — and the website analytics described below if you allow them. That is the list. The gallery is a static website that needs no account at all. The extension does its work inside your own browser: the designs you pick and the sites you pin them to are stored locally in your browser's extension storage, not on our servers. We never collect your browsing history, and we do not sell or share your data with advertisers.
What we collect
Account information
When you create an account we store your email address, your name and avatar if your sign-in method supplies them (Google does; a magic link doesn't), and when the account was created. Sign-in uses Google OAuth or an emailed magic link — we never see or store a password.
Billing
Payments are processed by Stripe. We store your subscription status and your Stripe customer ID; your card details go to Stripe and never touch our servers. Stripe's handling of them is governed by Stripe's own privacy policy.
Newsletter
If you subscribe to product news, we store the email address you gave us, which page you gave it on, the IP address the request came from (the record that you consented, and when), and whether you have confirmed. Addresses collected before the extension shipped — when this list was a launch waitlist — are the same list under the same consent, and can leave it the same way. It is double opt-in: nothing is sent to an address that hasn't clicked the confirmation link, and every mail after it carries a one-click unsubscribe. We use the list for product news about Styles Gallery and nothing else, and we never sell or rent it.
Messages you send us
The contact form sends your name, email address and message to our support inbox, so we can answer you; we keep the thread as long as it is useful for support. The uninstall survey is the opposite — it has no email field and is not tied to your account or to any identifier: the reason you pick and the optional note are the whole message.
Server logs
Like every website, our servers keep ordinary request logs — IP address, user agent, path, timestamp, and, on requests made while you are signed in, the account they belong to. They exist for security and debugging, are kept for up to 90 days on the same EU infrastructure as the rest of the service, and are not used to build profiles.
Website analytics
This website — not the extension — uses Google Analytics to see which pages get read and which calls-to-action get pressed, and it loads only if you allow it at the cookie banner. Decline and no analytics script loads at all; the site works exactly the same. You can change your answer at any time from "Cookie preferences" in the footer, or the Privacy tab under Settings when signed in. The extension itself sends no analytics of any kind.
Cookies
When you sign in we set a session cookie; it is what keeps you signed in, and the site does not work without it. Your browser also stores your theme and similar interface choices, and your analytics answer itself — none of which identify you or leave your browser. Google Analytics sets its own cookies, on this website only, and only after you allow it at the banner. We use no advertising cookies and run no ad networks.
What the extension does — and doesn't — see
The extension applies design tokens to the page you point it at, in your browser, and nothing about that page is sent to us. Your picks — which palette, fonts and style you chose for which site — live in your browser's extension storage, along with the panel's own settings and — if you are signed in — a cached copy of your account's name, email, avatar and plan, refreshed whenever the panel opens so it still knows what you bought while you are offline. Pinning a site grants the extension permission for that one origin so it can re-apply your picks when the page reloads; unpinning removes the permission. Screenshots are taken and saved by your own browser, to the folder or clipboard you choose, and never pass through us. Font files are fetched by your browser directly from Google Fonts, not through us, and cached locally.
The extension makes exactly two kinds of network request: font files from Google, and one question to styles.gallery — whether you are signed in and what plan you are on, sent with your session cookie and a tag naming which part of the extension asked. There is no analytics, no telemetry and no page-content upload of any kind. Uninstalling opens our farewell page in a normal browser tab; the survey there is anonymous, and closing the tab sends nothing.
Account email is transactional only: magic links you asked for, a welcome note, payment-failure warnings, renewal reminders and a note when a subscription ends. The one non-transactional list is the newsletter above, which you have to confirm before it can reach you and can leave from any mail it sends. Delivery runs through our own mail service, which hands the message to Amazon SES for the last hop — so SES processes the recipient address and the message on our behalf. Bounce and complaint notices come back to us so we stop sending to dead addresses.
Your rights
From the Privacy tab in your settings you can export everything we hold about your account, or delete the account outright — both run immediately, with no request queue. The export is one JSON file covering your account details, how you sign in, your subscription and billing records, and your newsletter subscription if you have one; deleting the account removes all of it, that row included. There is no recovery window and no archived copy; Stripe retains what payment regulations require it to retain. If you have no account — you only subscribed to the newsletter, or wrote to support — the unsubscribe link handles the first, and one line to the address below handles either.
If you are in the EU/EEA or UK, these are your GDPR rights to access, portability and erasure; the rest (rectification, restriction, objection, withdrawal of consent) work by writing to us. Our grounds for processing are the contract with you (your account, your subscription), your consent (analytics, the newsletter — withdrawable at any time, without affecting what was done before), and our legitimate interest in keeping the service secure and working (server logs).
Where data lives
Our servers, database and logs are hosted in Germany, in the EU. A few other companies handle data on our behalf, under their own safeguards: Cloudflare carries the traffic between your browser and us, Stripe takes payments, Google provides OAuth sign-in and — only if you allowed it — Analytics, and Amazon SES delivers our email from the US. Our own fonts are not on that list: they are downloaded when the site is built and served from styles.gallery, so an ordinary page here asks Google for nothing. The one exception is the typography gallery, which shows real specimens of Google-hosted families and therefore has your browser load them from Google directly.
Changes and contact
If this policy changes materially we will note it here and move the date at the top. Questions, requests, complaints: [email protected].