Privacy Policy

Effective March 24, 2026

Bounce Kit is a UI component registry for Next.js developers. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our website at bouncekit.dev, our CLI tool, and related services (“Services”).

1. Data Controller

The data controller responsible for your personal data is Bounce Kit, operated by Carson Idsinga. For privacy inquiries, contact support@bouncekit.dev.

2. Personal Data We Collect

Data you provide directly

Identity & contact data — name and email address when you create an account, subscribe to our newsletter, or purchase a license.
Payment information — processed securely by Stripe. We never receive or store your full card number, CVV, or billing address.
Communications — messages you send to our support email or feedback you provide about the product.

Data collected automatically

Analytics (PostHog) — page views, component interactions, and feature usage. IP addresses are excluded from capture via our property_denylist configuration.
Error tracking (Sentry) — error reports, stack traces, and performance metrics. Text inputs are masked, media is blocked, and no cookies are set. Runs under legitimate interest for service quality.
Download analytics (Redis) — component download counts with SHA-256 hashed IP addresses for 24-hour deduplication. Raw IPs are never stored.
Server logs — standard HTTP request logs including IP address, user agent, and request path. Retained for security and debugging.

3. How We Use Your Data

Purpose	Data used	Legal basis (GDPR)
Deliver your purchase and license key	Name, email, payment	Contract
Send product updates and newsletters	Email	Consent (unsubscribe any time)
Provide customer support	Name, email, communications	Contract / legitimate interest
Improve product features and UX	Analytics, download counts	Legitimate interest
Monitor errors and performance	Error reports, stack traces	Legitimate interest
Prevent fraud and abuse	IP hashes, request logs	Legitimate interest

4. Cookies & Consent

Sentry does not set cookies and requires no consent. PostHog uses cookieless_mode: “on_reject” — if you accept analytics, a first-party cookie enables cross-session identification. If you decline, PostHog uses a privacy-preserving server-side hash with no cookies or local storage. You can change your choice any time via the “Cookie Settings” link in the footer. We do not use advertising, retargeting, or third-party tracking cookies.

5. Third-Party Services

We share personal data only with the service providers necessary to operate Bounce Kit:

Provider	Purpose	Data shared
Stripe	Payment processing	Name, email, payment details
PostHog	Product analytics	Anonymized usage events
Sentry	Error tracking	Error reports, masked replays
Resend	Transactional email	Email address
Upstash	Rate limiting, caching, queues	Hashed IPs, request metadata
Vercel	Hosting	Server logs

We do not sell, rent, or share your personal information for advertising purposes.

6. International Data Transfers

Your personal data may be transferred to and processed in the United States, where our servers and service providers are located. For transfers from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions where available.

7. Data Retention

Purchase records — retained as long as your license is active, plus any period required by tax law
Newsletter subscriptions — until you unsubscribe
Download analytics — 90 days, then auto-deleted
Error logs (Sentry) — 30 days
Analytics events (PostHog) — 1 year
Rate-limit / abuse data — 24 hours

When data is no longer needed, we delete it or anonymize it in accordance with applicable law.

8. Your Rights

Depending on where you live, you may have the following rights regarding your personal data. These rights apply under GDPR (EU/UK), CCPA/CPRA (California), and similar laws in other jurisdictions:

Access — request a copy of the personal data we hold about you
Correction — request correction of inaccurate or incomplete data
Deletion — request deletion of your personal data
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interest
Restriction — request that we limit processing of your data
Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing

To exercise any of these rights, email support@bouncekit.dev. We will respond within 30 days. We will not discriminate against you for exercising your privacy rights.

If you are in the EU/UK, you also have the right to lodge a complaint with your local data protection authority.

9. Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), rate limiting on all public endpoints, input validation, and hashed storage of sensitive identifiers. No system is 100% secure, but we work to protect your information and promptly address any vulnerabilities.

10. Children

Our Services are not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact support@bouncekit.dev and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website. The effective date at the top of this page indicates when it was last revised.

12. Contact

Privacy questions, requests, or complaints? Email support@bouncekit.dev.