Skip to main content

Privacy Policy

Last updated: June 27, 2026

1. Who we are

Dembrandt (dembrandt.com) is an open-source CLI tool and web application for extracting and tracking design tokens from websites.

2. What data we collect

We collect the following:

  • Email address. Collected only if you subscribe to the newsletter, and stored by EmailOctopus. Dembrandt App accounts have no email address attached to them.
  • App account identity. GitHub OAuth sign-in stores your GitHub user ID and username. Nothing else from your profile is kept.
  • Extraction results. Snapshots created with an API key are stored under your account. A snapshot holds the design tokens of the URL you submitted, which are public by definition, and contains no personal data.
  • API keys. Stored as hashes, tied to your account, used to authenticate CLI requests.
  • Usage analytics. Page views and interactions through Google Analytics, loaded only after you accept cookies. IP addresses are truncated, no identifier is written to your browser, and there is no cross-site tracking.
  • Technical data. Server logs held by our host Vercel: IP address, browser, referrer. Used for security and debugging.

We collect no names, no payment information, and no special category data.

Domains and accounts are not combined in any way that would identify who extracted what. Extraction history is not profiled, sold, or used for marketing.

3. Legal basis for processing

  • Newsletter. Consent, given when you opted in.
  • App account and extractions. Contract, covering account creation and use of the service.
  • Analytics. Consent, given when you accepted cookies.
  • Server logs. Legitimate interest in security and uptime.

4. Third-party processors

We use the following sub-processors:

  • Vercel. Hosting and serverless compute. USA, EU data transfer covered by DPA.
  • Vercel Blob. Storage of extraction snapshots. USA, same DPA.
  • GitHub. OAuth authentication for app accounts. USA, GDPR compliant.
  • EmailOctopus. Newsletter delivery. UK, GDPR compliant.
  • Google Analytics. Consent-gated analytics. USA, EU data transfer covered by Google's DPA.
  • Google reCAPTCHA. Spam protection on the newsletter form, which processes your IP address. USA, same DPA.

5. Cookies

We only set analytics cookies after you give consent via the cookie banner. You can withdraw consent at any time by clicking the cookie settings link in the footer, which clears stored consent and stops analytics from loading.

The newsletter form may load a reCAPTCHA widget from Google to prevent spam. This may set cookies from Google. See Google's Privacy Policy for details.

6. Data retention

  • Newsletter email. Kept until you unsubscribe. Every email carries an unsubscribe link.
  • App account data. Your GitHub ID, API keys, settings, and extraction snapshots are kept while the account is in use, and deleted on request. See section 7.
  • Analytics data. Deleted automatically by Google Analytics after 14 months.
  • Server logs. Kept by Vercel under their retention policy, typically 30 days.

7. Your rights

Under GDPR you have the right to:

  • Access the personal data we hold about you
  • Request correction or deletion of your data
  • Withdraw consent at any time
  • Object to processing or request restriction
  • Lodge a complaint with your local data protection authority

To exercise any of these rights, email dembrandt@tutamail.com. We will respond within 30 days.

8. Children

This service is not directed at children under 16. We do not knowingly collect data from minors.

9. Changes to this policy

We may update this policy occasionally. Material changes will be communicated via the newsletter or a notice on this page. The date at the top of this page reflects the most recent update.

10. Contact

Questions about this policy: dembrandt@tutamail.com