Privacy Policy

Last updated 27 July 2026

In short

We collect what is needed to sell you a licence and let you use it: your name and email, what you bought, and which machines download blocks.

There is no analytics, no advertising, and no third-party tracking anywhere on this site. We never see your card details.

This summary is for orientation only — the text below is what applies.

1. Who we are

Profound, Inc. operates toro-ui.com and is the data controller for the information described here. Contact us at mail@weareprofound.com.

2. What we collect

Account information, when you sign up:

Your name and email address.
A password hash, if you sign up with a password.
If you sign in with GitHub or Google: your account identifier at that provider, and the access tokens needed to complete sign-in.
Session records, including the IP address and browser user agent of the session, used to keep you signed in and to let you spot unfamiliar sessions.

Licence information, when you buy:

Which plan you bought, what it grants, the amount and currency, and the order and invoice reference from Polar Software, Inc..
The email address associated with the purchase.
The seats on your licence, including the email address of anyone you invite.

Usage information, when you download blocks:

Which block and version was downloaded, and when.
A device identifier generated by the CLI on first sign-in — a random value that identifies the machine, not you.
An optional device label, defaulting to your username and hostname, so you can recognise your own machines in your account.
A truncated, hashed form of your IP address.

IP addresses are never stored in full. They are truncated to the network portion and then hashed. That is enough to notice one key being used across many different networks, which is how we detect licence sharing, and not enough to identify or locate an individual.

3. What we do not collect

Card numbers or payment details. Checkout is handled entirely by Polar Software, Inc.; we receive only an order reference and the amount.
Analytics. There is no analytics tool, tag manager, session recorder or heatmap on this site.
Advertising or tracking cookies. We do not run advertising and do not share data with ad networks.
Anything about the code you write. The CLI sends the name of the block being installed. It never reads, uploads or inspects your project.

4. Why we process it, and on what basis

To perform our contract with you: creating your account, granting your licence, issuing seat keys and serving downloads.
For our legitimate interests: verifying that a key belongs to a valid licence, detecting keys shared beyond the seats bought, and preventing abuse of the registry.
To comply with legal obligations: keeping records of sales for tax and accounting.

Where you have asked us to sign you in with GitHub or Google, we process the resulting tokens on the basis of your request.

5. Who we share it with

We do not sell personal data and do not share it for marketing. We share only with the providers needed to run the service:

Polar Software, Inc. — payment processing and tax, as merchant of record. They receive your billing details directly from you at checkout.
Our hosting and database provider, which stores the data described above.
GitHub and Google — only if you choose to sign in with them, and only to complete that sign-in.

6. Cookies and local storage

We set one cookie: a session cookie that keeps you signed in. It is strictly necessary for the site to work and is not used for tracking.

Your accent colour, typeface and corner-radius preferences are stored in your browser's local storage so the site looks the same on your next visit. They never leave your browser.

The CLI stores your seat key and device identifier in a file in your home directory, readable only by you. Nothing else is written to your machine.

7. How long we keep it

Account and licence records: for as long as your licence is valid, and afterwards as long as needed for tax and accounting.
Download logs and device records: rolling, and pruned once no longer useful for detecting abuse.
Sessions: until they expire or you sign out.

8. Your rights

Depending on where you live, you may have the right to access the data we hold about you, to correct it, to have it deleted, to receive a copy in a portable form, or to object to certain processing. These rights are available to everyone who contacts us, regardless of location.

Email mail@weareprofound.com and we will respond within thirty days. We will not discriminate against you for exercising any of these rights.

Deleting your account removes your personal data. It does not revoke a licence you have paid for, and it does not remove records we must keep for tax purposes.

9. International transfers

We operate from the United States, and data is processed there. If you are in the European Economic Area or the United Kingdom, your data is transferred outside your region on the basis of standard contractual clauses or an equivalent safeguard with our providers.

10. Changes

If this policy changes materially we will update the date at the top of this page. We will not start using data we already hold for a materially different purpose without telling you.

11. Contact

Questions, requests or complaints: mail@weareprofound.com. If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

Licence Agreement Terms of Service Privacy Policy