Privacy Policy

Last updated: May 21, 2026

1. Who we are

MimicKit is a Chrome extension and a related web service operated by the MimicKit team. Contact: [email protected].

2. What we collect

Account information

When you sign up, we store your email address and a hashed password (or your OAuth ID if you sign in with Google or GitHub). We use Supabase for authentication.

Saved items

When you tap the ♥ button on a color, gradient, SVG, image, or font inside the extension, we save that single item to your account so you can access it from any device. We store: the value itself (e.g., #723CEB), the source URL (so you remember where it came from), and a timestamp.

Usage counters

To enforce Free vs Pro plan limits we count anonymous events: how many extractions, design system generations, contrast checks, and exports you've done this month. We do not log which sites these happened on.

Payment information

If you upgrade to Pro, payment is processed by Stripe. We never see your card details. We store your Stripe customer ID and subscription status to know whether you have access to Pro features.

Server logs

Our hosting and backend providers (Cloudflare, Supabase, Stripe) keep standard request logs (IP address, timestamp, user-agent) for short retention periods for security and debugging. We don't combine these with your activity.

3. What we don't collect

• We don't track browsing history. The extension only inspects a page when you open the side panel or click an element. It does not phone home with URLs you visit.
• We don't read page content automatically. Extraction runs locally in your browser. The CSS, colors, fonts, and assets you see are processed on your machine.
• We don't fingerprint your browser.
• We don't use third-party analytics like Google Analytics, Facebook Pixel, or similar trackers on the extension UI.
• We don't sell or rent your data. Ever.

4. Permissions explained

Chrome shows scary permission strings on install. Here's what each one actually does in MimicKit:

• Read and change all your data on websites you visit (<all_urls>) — required so the extension can inspect any site you choose to inspect. We don't run automatically; the side panel must be open and you must click.
• Storage — for your local preferences (recent colors palette, UI state) on your device.
• Side panel — to render MimicKit's UI as a Chrome side panel.
• Downloads — to save SVGs, images, and design system ZIPs to your Downloads folder when you click Download.
• WebRequest — to detect web fonts, stylesheets, videos and images loaded on the page so they appear in the assets tab.
• Identity — for Google and GitHub OAuth sign-in.

5. Third parties we use

• Supabase — authentication and database hosting
• Stripe — payment processing for Pro subscriptions and Lifetime purchases
• Cloudflare — site hosting and DNS
• Google OAuth / GitHub OAuth — optional sign-in providers

Each has its own privacy policy. We only share with them what's strictly needed to provide the service.

6. Your rights

You can:

• Export your saved library as JSON anytime (Saved tab → Export)
• Clear all saved items at any time (Saved tab → Clear all)
• Delete your account by emailing [email protected] — we will delete all your data within 14 days
• Request a copy of all data we hold about you, under GDPR / CCPA, by emailing the same address

7. Data retention

We keep your account data as long as your account is active. If you delete your account, we erase your saved items, usage counters, and email within 14 days. Anonymized aggregate counts (e.g., "how many users in total") may be retained for product analytics.

8. Children

MimicKit is not intended for users under 13. We don't knowingly collect data from children.

9. Changes

If we change this policy materially, we'll update the "Last updated" date and notify active users by email. The current version always lives at mimickit.com/privacy.

10. Contact

Questions, GDPR requests, or anything else: [email protected].