Privacy Policy

Better Design is a service that helps developers and AI coding agents build production quality user interfaces faster, using a catalog of curated design systems, a library of UI principles and review rules, and a generation pipeline that produces a custom design system from a natural language prompt.

This policy covers the Better Design web app at better-design.com and the Better Design MCP server (Model Context Protocol) that AI coding tools connect to. If we add other surfaces later this page will say so.

Three categories of personal data, each tied to a clear purpose:

PostHog and Google Analytics stay off until you select Accept in the banner. If you select Reject, neither one loads, and we set no analytics cookies. We do not record your screen or your sessions. Your choice is stored in your browser.

To change your choice, select Cookie settings here or in the site footer.

• Operate the service. Authenticate you, generate the design systems you ask for, persist your projects, deliver the components and the install commands the agent returns.
• Bill and meter usage. Track per user credit balances so we can enforce the free quota and the Pro quota fairly across both the web app and MCP clients.
• Keep the service safe. Rate limit abusive traffic, detect fraud, investigate incidents.
• Improve the product. Analyse aggregate usage to decide which features to invest in and where the onboarding drops people.
• Communicate with you. Reply when you write to support, send important account or service notifications.
• Send product tips. From October 13, 2026, during a Pro trial we email a few short tips about Pro features. We pick which feature each tip shows from the tools your coding agent has used, so you hear about the ones you have not tried yet. Every tip email has an unsubscribe link, and unsubscribing stops them.

We do not sell your data, and we do not run third party ad networks on the site. We may use the content you submit to train the models that power Better Design, as our Terms of Service describe. Each night we keep a training copy of the page source you submit and its review findings in our private storage, under a pseudonym. When you delete the project or your account, we remove that copy within 30 days. If we ever change any of those positions we will tell you in advance, not after.

We use the companies below to run the service, and each one receives only the data it needs for its job. The same list is on our security page.

• Account data is kept while your account is active. When you delete your account, we delete it within 30 days, except where retention is required by law (for example, invoicing records).
• Project data is kept while the project exists. You can delete a project at any time, which removes the prompts, messages, generated systems, and component artefacts within 30 days.
• MCP tool call logs are kept for 180 days. The pseudonymous copies of those calls are kept until you delete your account.
• Anonymous trial projects are kept for 30 days after creation, then purged.
• Analytics events are retained for 12 months in aggregate form.
• Error and request logs are retained for 30 days for incident investigation.

Whatever law applies to you, we extend the same controls to everyone:

• Access. Ask for a copy of the personal data we hold about you.
• Correction. Update your account name or email from settings, or by writing to us.
• Deletion. Delete your account or individual projects at any time.
• Export. Ask for a machine readable export of your projects.
• Object or withdraw consent. Opt out of analytics, product tips or service emails.

To exercise any of these, write to [email protected]. We answer within 30 days, usually much sooner.

These controls cover the rights the EU and UK General Data Protection Regulation (GDPR) gives you, and the rights the California Consumer Privacy Act (CCPA) gives California residents to know, correct and delete their data. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Using any of these rights never changes the service you get.

When you connect Better Design as an MCP server to an AI coding tool (Cursor, Claude Code, ChatGPT Apps, Claude.ai, and so on), the AI client sends the prompt you wrote to our server so the tool can fulfil it. Three things to know:

• We meter the call against your Better Design account when you authenticate (OAuth or API key). Unauthenticated calls fall back to a generous anonymous trial quota tied to the request IP.
• We send your prompt only to the companies listed above. Two of them run AI models for us: OpenAI generates design systems and components, and Google turns search text into numbers we can compare.
• We receive only what the AI client sends to a tool, never the rest of your conversation. We log each tool call with your account, its inputs and the start of its result, so we can run and fix the service, and we delete that log after 180 days. We also keep a copy of each call in our private storage under a pseudonym and with secrets removed. We use it to improve the tools and to train the models that power Better Design. When you delete your account, the nightly cleanup removes that copy.

Transport is HTTPS everywhere. Passwords are hashed with the better-auth defaults. API keys are stored as SHA-256 hashes, not in plaintext, and you can revoke any key from your account settings. Access tokens issued by our OAuth server have a one hour lifetime, with rotating refresh tokens. We log administrative access and review it. Despite all of this, no system is unbreakable, so we will tell you if we believe your personal data has been compromised.

Better Design is not directed at children under 13 (or 16 where local law sets a higher bar). If you believe a child has created an account, write to us and we will delete it.

When we change this policy in a way that materially affects your rights, we will notify you by email or in app at least 14 days before the change takes effect. Minor edits (fixing a typo, adding a processor of the same category) are reflected by updating the date at the top of this page.

For any privacy question, including data subject requests, write to [email protected]. If you are in the EU and would prefer to escalate, you have the right to complain to your local supervisory authority.