Privacy Policy
What this site collects, why, where it lives, and the choices you have - including the cookie choice you make in the cookie notice.
Last updated: October 15, 2026
Overview
AI Patterns (aipatterns.dev) is an independent reference site. This policy covers the public site, accounts, the MCP server, and the machine-readable mirrors. We do not sell personal data, we run no advertising, and we do no cross-site tracking. The only optional tracking on this site is aggregate web analytics, which runs solely with your consent.
Data we collect
- Account data. When you sign up we store your name, email address, and a hashed password (we never store the password itself). If you sign in with GitHub instead, we receive the basic profile GitHub shares: your name, email address, and avatar URL.
- Sign-in security records. Sessions record the sign-in time, the IP address, and the browser user-agent. This protects your account and feeds abuse prevention (rate limiting).
- Bot protection. Sign-up, sign-in and password reset forms are protected by Cloudflare Turnstile, which checks that a real browser is present. Turnstile may process IP and browser data and set its own cookies on Cloudflare’s challenge domain for that purpose.
- Usage metering. For the MCP server we keep a per-identity, per-UTC-day count of tool calls (with first and last call timestamps) so the daily allowance can be enforced.
- Content you upload. If you upload an avatar, the image is stored on our Cloudflare R2 bucket and served from cdn.aipatterns.dev.
- Email delivery. Transactional email (verification, password reset, welcome) is delivered through Resend, which processes the recipient address and the message content to deliver it.
- Analytics (consent required). If you allow web analytics, Vercel Web Analytics records aggregate page views, referrers, and general browser, OS and region information. Vercel states this data is aggregated and anonymous - it is not used to identify individuals and no cross-site identifiers are collected. The analytics script is not loaded at all unless you accept, and you can withdraw at any time via Cookie settings in the footer.
Cookies and similar technologies
Two categories are used on this site: essential cookies, which the service and its security need, and everything else, which currently is only web analytics (a script, loaded exclusively after consent - it sets no cookies of its own).
| Storage key | Category | Purpose | Lifetime |
|---|---|---|---|
better-auth.session_token and related CSRF cookie | Essential | Keeps you signed in; protects requests | Up to 7 days, refreshed while you are active |
aip_consent | Essential | Remembers your cookie consent choice | 12 months |
locale | Preference (set only when you change language) | Remembers your interface language | 12 months |
| Cloudflare Turnstile cookies | Essential (security) | Bot protection on authentication forms | Short-lived, set on Cloudflare’s domain |
| localStorage / sessionStorage | Preference | Your code-language tab choice, the docs sidebar state, and whether you dismissed the cookie notice. Set in response to your own actions on the page. | Until you clear site data (or the browsing session) |
Third-party services
These providers process data on our behalf. Each is used only for the role described.
- Vercel - hosts the site and, if you consent, its Web Analytics product counts visits.
- Supabase - hosts the Postgres database that stores accounts, sessions, usage counts, and search indexes.
- Cloudflare - Turnstile (bot protection on auth forms) and R2 (avatar image storage and CDN delivery).
- Resend - delivers our transactional email.
- GitHub - optional sign-in identity provider. We receive only the basic profile fields listed above.
Retention and deletion
- Account data is kept until you delete your account. Deleting your account (Settings → Danger zone) removes your account and its authentication records.
- Sessions expire when they age out; sign-in records go with them.
- Usage counters are organized per UTC day and enforce the daily allowance.
- Uploaded avatars persist until you replace them with another upload.
- Emails we have sent remain in your and our mail systems according to those systems’ retention.
Security
- All traffic uses HTTPS; database connections require SSL.
- Passwords are hashed with scrypt, never stored in clear.
- Authentication forms are protected by a CAPTCHA and by rate limiting on authentication endpoints.
- API secrets are server-side only; the browser never receives them.
Your rights and choices
- Access and correction. You can see and change your account details, email address and password in your account settings.
- Deletion. You can delete your account and its associated records yourself from the settings’ danger zone.
- Analytics consent. You grant or refuse web analytics in the cookie notice, and can revisit that choice at any time via “Cookie settings” in the footer. Dismissing the notice neither accepts nor declines anything - optional analytics simply stays off until you choose. Refusing (or withdrawing) stops the analytics script.
- Objections and other rights. Depending on where you live (for example the EU/EEA or California), you may have further rights such as access, portability, or complaint to a supervisory authority. Write to us and we will help.
Children
The service is not directed at children. Do not create an account if you are below the age at which your jurisdiction requires parental consent for online services.
Changes to this policy
We update this page when our practices change, with a new last-updated date above. If a change is material, we will say so on the site.
Contact
Privacy questions: noreply@aipatterns.dev. See also our terms and conditions.