Privacy policy.

01Who we are and what this policy covers

New Horizon Code Pty Ltd (ABN 61 634 659 804), trading as Syrup, operates ui-design.studio. In this policy, "we", "us" and "our" refer to that company.

This policy covers the website, accounts, personal boards, shared-board viewing and responses, the public feed and related content processing. It applies to visitors, account holders, share-link recipients, people who respond to shared boards and identifiable people whose public X posts or profile details appear in the gallery. We usually obtain featured people's information from X rather than directly from them.

Where account features are available, you can save references in personal boards and publish a version for clients, who can respond with reactions and comments when you allow it. The Service does not currently provide user image uploads, purchases or newsletters. Separate services operated by New Horizon Code Pty Ltd have their own privacy notices.

02Accounts, sign-in and personal boards

An account is optional for public browsing, viewing an active shared-board link and responding to it. To provide an account, we need the identifying and authentication information required by your chosen sign-in method. If you do not supply it, you can still browse, but cannot create or manage boards.

• Account information. We use Supabase Auth for email and password, Figma and X sign-in. We handle your account ID, email address where supplied, verification status, linked sign-in identities, account and sign-in timestamps, and session information.
• Provider information. If you choose Figma or X, that provider supplies identity information to Supabase, which may include its user ID, handle, display name, profile image and email address, depending on the provider and permissions you approve. Authentication may also involve provider tokens. The provider processes your sign-in request under its own privacy policy.
• Board information. We store the titles, descriptions, selected references, ordering, notes, top pick and favourite markers you enter, together with ownership, creation and update records. If you publish a board, we also store its published version, sharing and response settings, the information needed to validate or revoke its link, your replies to clients, your moderation choices and when you last marked feedback as read.
• Responses to shared boards. If you respond to a shared board, we store the name you enter, your reactions and comments, when you made them, and a one-way hash of a random key your browser keeps for that link. The key lets you change your reactions, rename yourself and delete your own comments from that browser. We do not ask respondents for an email address or an account.
• Account messages. Supabase and the email delivery service process your email address and message content to send confirmation, password recovery and email-change messages. These are service messages, not a newsletter subscription.

Email sign-in passwords pass through our server to Supabase for authentication; Supabase stores a password hash rather than a readable password. Figma and X handle their own passwords, which are not supplied to us. Figma sign-in requests access to your basic account identity, not your design files. Signing in with X does not authorise the studio to post from your X account. Neither method claims or verifies ownership of a featured designer page.

Boards begin private. They are available to your account, with access by us and our service providers where needed to operate, support or secure the Service or meet legal obligations. Publishing creates a separate version. It includes the board title, selected references, top pick and favourite markers, and notes written for clients; descriptions and private notes are excluded unless you choose to include them. Later edits to your private board are not shared until you update the published version.

Anyone with an active share link can view that published version without signing in and can forward the link or keep a copy. It is not restricted to a named client. Rotating or revoking the link, or deleting the board or account, prevents future access through that link; it cannot recall information already received. Only include personal or client information you are authorised to use and share.

While responses are open, everyone with the link can see each comment with the name its author entered, the board owner's replies and how many people chose each reaction. The board owner also sees which reaction each respondent chose and comments the owner has hidden. Owners can hide comments, remove a respondent's responses or turn responses off; respondents can delete their own comments. Responses are linked to the board, not to an account, and names are not verified.

03Information handled when you visit

We and our service providers may handle:

• Network and request information, such as IP address, user agent, requested URL, request time, response status, errors and similar server or security logs.
• Rate-limit information. On Vercel, the Service reads the trusted client IP and converts it to an HMAC-derived identifier before sending the identifier to Upstash Redis. Account, board and response operations may also use a derived account identifier and database usage counters, including a per-board count of recent responses. These identifiers help prevent abuse; they are not anonymous information. The application does not store the raw IP address as a Redis key or in its gallery database.
• Privacy preference, stored in your browser as either "accepted" or "denied" under the local-storage key ui-design-cookie-consent.
• Analytics information only if you allow it, as described in the storage and analytics section below.

The DMCA Notice Form uses information you enter only in your browser to prepare an email draft. The form does not transmit that information to or store it on the Service. If you send the draft from your email app, your email provider and our email systems process the message, and we handle it as legal correspondence under this policy.

If you follow a link, load externally hosted media or use X's sharing flow, the relevant third party receives the network information needed to serve that request. Our site-wide referrer policy is set to avoid sending the gallery page address as an HTTP referrer, but the third party still receives information such as your IP address and user agent.

The operator-only X connection flow also processes the authorised X account's user ID, handle, OAuth scope, access token, refresh token and expiry. Those credentials are stored server-side and are not a public visitor account.

04Information about featured people and posts

The curator uses the X API to retrieve public posts liked by the configured curator account. For authors and other identifiable people associated with those posts, we may collect and hold:

• X user ID, handle, display name, profile image and verification status;
• post ID, text, language, source URL, publication time and public engagement counts;
• images, video cover images, video URLs, alt text and other public media metadata;
• whether X marks a post as possibly sensitive;
• the X API response used to create the gallery record;
• curation status, categories, tags, first and last sync times, and announcement records; and
• AI classification metadata, evidence and usage records when classification is enabled.

Featured media can incidentally contain names, faces, account details or other information visible in the original design screenshot. We do not intentionally infer sensitive characteristics from that material. Posts marked by X as possibly sensitive are excluded from the public gallery.

The source is a publicly accessible X post and its associated API data. This section is intended to tell featured people how we use information obtained indirectly from that public source. If your information is inaccurate or you want a selection reviewed, use the Copyright & Takedown Policy or contact us.

05Why we handle information

We handle information to:

• operate, deliver, cache and troubleshoot the Service;
• create and secure accounts, verify sign-in, recover access and process account changes;
• save, organise and display your boards, deliver published versions at your direction, and record and display responses to them;
• curate public interface-design posts, credit their creators and link to the source;
• organise selections by designer and tag, including with AI assistance;
• rehost selected images and, when enabled, publish credited studio announcements;
• secure the Service, enforce rate limits, prevent abuse and investigate incidents;
• understand aggregate usage when a visitor permits analytics;
• process privacy, credit, removal and legal requests; and
• comply with law, court orders and applicable platform obligations.

Where the GDPR or UK GDPR applies, we rely on performance of our agreement with you for the account, authentication, board, sharing and response services you request; consent for optional analytics; our legitimate interests in operating, securing and improving the Service and presenting properly attributed public work for the core gallery; and legal obligations where processing is required by law. We balance those interests against the rights of visitors, account holders and featured people, including through access controls, attribution, source links, sensitive-content filtering and a removal process.

Where another law requires a different basis, we use the basis that law permits. You may withdraw analytics consent at any time without affecting processing that occurred before withdrawal.

06Browser storage, cookies and analytics

Public browsing does not require an account. Account features use necessary authentication cookies to maintain your session and short-lived cookies to complete sign-in, linking and recovery safely. While you are signed in, a small readable cookie without any account details records only that a session exists, so the site header can show the right sign-in or sign-out button; it is removed when you sign out. Your browser may temporarily retain the selected public reference while you sign in to complete a save, and a content-free notification to detect account changes across tabs. An active share link is held in the browser address fragment while you view a board. If you respond to a shared board, local storage keeps the name you entered and a random response key for that link, so the board recognises your responses when you return; clearing site data removes them from your browser but does not delete responses you have submitted. The Service also uses local storage to remember your analytics choice. If storage is unavailable, that choice may last only for the current page session.

Vercel Web Analytics loads only after you allow analytics. Vercel describes this service as cookieless and designed to provide aggregated statistics without attaching events to a name, account or stored IP address. It may process page URL, referrer, timestamp, approximate location, device, browser and operating-system information and uses a request-derived visitor hash that resets daily. We currently use it for page-view analytics, not targeted advertising.

You can allow or deny analytics when first asked and change the choice later using the privacy-settings button at the lower-left of the site. Creating an account does not enable analytics or give marketing consent. Necessary authentication, hosting, security, request logging and rate limiting continue regardless of your analytics choice because they deliver and protect the Service. Blocking necessary cookies may prevent sign-in and account features from working.

A short-lived, HttpOnly X OAuth cookie is used only when an authorised operator connects the studio's X account. It expires after approximately ten minutes and is not used to track gallery visitors.

Account, authentication, image-search, private board and shared-board routes are excluded from our optional page-view analytics. Hosting and authentication providers still process the requests needed to deliver and secure these features.

07AI-assisted classification

This classification processing concerns public gallery references. Account details, private board descriptions, notes and responses to shared boards are not sent to the gallery classification workflow. Saving a reference does not submit your board to an AI service. Generated moodboards and design generation are not offered.

When screenshot search is available, the selected image is analyzed on your device after you choose to start. Its file bytes and filename are not uploaded. A numerical visual fingerprint is sent to our authenticated search service to compare against public gallery references. That fingerprint is processed for the request and is not stored in the result session. The image tools are public files that your browser may cache for reuse.

Image-search result sessions contain an account identifier, selected public reference identities, supported filters and result identities. They expire after ten minutes; clearing or replacing a search also requests their deletion. Network failures may delay that deletion until expiry. Removing a screenshot or leaving the page releases the application's reference to the local file. Saved boards contain the selected public gallery references, never the private screenshot. Search requests remain subject to necessary hosting and security processing.

When AI classification is enabled, the Service sends a bounded caption and up to four selected images or still video/GIF cover images to OpenAI's Responses API. Before transmission, images are decoded, resized, converted to JPEG and stripped of embedded metadata. The request disables provider-side response storage using store: false, although OpenAI may still retain limited data as described in its terms and abuse-monitoring policies.

The response can include private descriptions and tag evidence. Only approved canonical tags are used publicly. The workflow instructs the model not to transcribe screen text or return personal information, but automated output can still be inaccurate.

Classification is used to organise the gallery. It is not used to make decisions that produce legal or similarly significant effects on a visitor or featured person. You may ask us to review or remove an AI-applied tag.

08When information is disclosed

We may disclose information to:

• Vercel for hosting, content delivery, optional Blob image storage, operational logs and consented Web Analytics;
• Supabase for authentication and the database that stores accounts, boards, gallery, sync, OAuth and classification records;
• Upstash for short-lived rate-limit and cooldown state based on derived visitor or account identifiers;
• Figma when you choose it to sign in or link an identity;
• X Corp. as the content source, media host, OAuth provider and optional announcement destination;
• email delivery providers for account confirmation, recovery, email-change and support messages;
• people who possess your active board link, for the information you choose to publish and for responses and replies on that board;
• the owner of a board you respond to, for your name, reactions and comments;
• OpenAI for classification when that feature is enabled;
• professional advisers, insurers, auditors and authorities where reasonably necessary; and
• a successor in connection with a proposed or completed sale, restructure or transfer of the Service, subject to appropriate protections.

Images and videos are public page resources. Depending on the item, your browser requests them directly from X or a public Vercel Blob URL. Clicking an external link sends you to the third party.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising, use it for targeted advertising, or offer a financial incentive for personal information.

09Overseas processing

We are based in Australia, but the Service uses providers and infrastructure outside Australia. The primary Supabase database is hosted in Tokyo, Japan. Information may also be processed in the United States by or for Vercel, Figma, X, OpenAI, Supabase and Upstash, and in other countries where those providers or our email delivery providers operate networks or engage subprocessors. People receiving a board link may also be outside Australia.

Provider locations can change as infrastructure changes. Where required, we take reasonable steps to use contractual, technical and organisational safeguards for overseas processing. Those countries may have privacy laws that differ from Australian law and from the law where you live.

10How long information is kept

Retention depends on the information and why it is held:

• Your browser keeps the analytics preference until you clear site data or change the choice.
• Account details and linked identities are held while your account remains active. Signing out or disconnecting a sign-in provider does not delete the account or its boards.
• Boards and their published versions remain until you delete them or your account, or they are removed under our Terms. Revoking a share link stops access through that link without deleting the private board.
• Responses to a shared board remain until the respondent deletes their comment, the owner removes the reference concerned, the board or the owner's account is deleted, or they are removed under our Terms. Hidden comments and removed respondents stay visible to the owner until then. Replacing or revoking a link, or turning responses off, does not delete responses. Your browser keeps your response key and name until you clear site data.
• Successful account deletion removes the authentication account, its linked identities, boards, published versions and the responses on them from the active application database. Limited provider backups, security logs and correspondence may remain under their applicable retention settings or legal obligations. Copies already saved by recipients are outside our control.
• Application rate-limit and cooldown records are designed to be short-lived. Hosting, security and provider logs follow the relevant provider's plan and retention settings.
• Vercel Analytics availability depends on the project plan and Vercel may retain data beyond the visible reporting window.
• Featured post and author records are held while used for curation, attribution, operation, audit or compliance. A post can be hidden from public view while limited database, raw-source, AI, announcement or budget-audit records remain.
• Public Blob copies are removed through the applicable sync or manual takedown process. Browser, CDN, search-engine and third-party caches can take additional time to expire.
• OAuth credentials are held while the relevant operator account remains connected or until they are replaced, revoked or no longer needed.
• Requests and legal correspondence may be kept as needed to act on the request, prevent repeated disputes, establish rights and meet legal obligations.

We delete or de-identify information when it is no longer reasonably required, subject to legal, security, backup and recordkeeping needs. A public removal does not necessarily mean that every internal record is immediately erased.

11Security

We use measures intended to reduce unauthorised access, including server-only credentials, database access controls, encrypted network connections, request validation, source allowlists, rate limits and restricted administrative routes. No online service or storage method is completely secure, and we cannot guarantee absolute security.

If you believe the Service exposes personal information or credentials improperly, contact us promptly and do not publish or exploit the information.

12Access, correction, deletion and complaints

You can manage your email address and sign-in methods or delete your account in Account settings. Security checks, recent sign-in or email confirmation may be required. You can edit or delete boards, hide or remove responses, turn responses off and revoke sharing from your board settings. If you responded to a shared board, you can change your name and delete your own comments from the browser you used; for anything else about those responses, contact the board owner or us. Deleting your studio account does not delete your Figma or X account, or independently curated public posts; use the copyright or privacy contact process for those records. Contact us if you cannot access your account or need a copy of your personal information.

Depending on the law that applies to you, you may request access to personal information about you, correction, deletion, restriction, portability or an explanation of how it is used. You may also object to certain processing, withdraw analytics consent, or complain to a privacy regulator.

In Australia, you may ask us to access or correct personal information and complain about how it is handled. Send the request in writing using the contact details below. We may need enough information to verify your identity and locate the relevant record. We aim to respond within a reasonable period, ordinarily within 30 days. If you are not satisfied after giving us a reasonable opportunity to respond, you may contact the Office of the Australian Information Commissioner.

If the GDPR or UK GDPR applies, you may also object to processing based on legitimate interests and complain to the supervisory authority where you live or work. If an applicable US state privacy law gives you access, correction, deletion, opt-out, appeal or authorised-agent rights, we will handle a verified request as that law requires. We will not discriminate against you for exercising a privacy right.

These rights can be limited by exemptions and competing obligations. We may retain a minimal record of a request or decline it where the law permits, and will explain the basis where required.

13Age restriction

The Service is intended only for people aged 18 or older and is not directed to anyone under 18. If you are under 18, do not access or use the Service.

We do not knowingly solicit personal information from anyone under 18. Public X content featured in the gallery could nevertheless identify or depict a person under 18. If you believe someone under 18 has created an account, or their information has been featured or handled inappropriately, contact us so we can review it and take appropriate action.

14Changes and contact

We may update this policy when the Service, providers or law changes. The date at the top shows the latest version. If a change materially affects how we handle information, we will take reasonable steps to make it prominent.

Contact our privacy team to exercise a right, make a complaint, or ask a question. For removal or credit requests, you may also use our Copyright & Takedown Policy.