Privacy

ChoiceUI runs on your machine and, by default, sends us nothing at all. This page says exactly what changes when you do connect something.

Last updated 28 July 2026

The short version

Using the ChoiceUI CLI without an account sends us no code and nothing from your repository. The commands read your repository and write files back into it, and that is almost the whole transaction. The exception is a single anonymous count of which command you ran, described below, which you can turn off in one command.

This website does not track you at all. Everything else on this page applies only if you create an account, which is not currently open to the public.

Using the CLI without an account

init, doctor, guard, status, canonicalize, direction, manifest, intake, showcase and mcp do their work entirely on your machine.

Your design tokens, component code, file paths and repository contents stay on your machine and in your repository. We never receive them.

Anonymous usage counts

Because the CLI needs no account, we would otherwise have no idea whether anyone uses it or which commands are failing. So it sends one small, anonymous record when a command runs. The first time it happens, the CLI tells you so on screen.

What is sent:

Install IDA random identifier generated on your machine the first time you run a command. It is not derived from you, your machine or your repository, and it lets us tell one person running a command fifty times apart from fifty people running it once.

Command nameWhich command ran, for example doctor. Never its arguments.

VersionsThe CLI version, your operating system and its version, and your Node version.

That is the entire list. We do not record what a command found, so we cannot tell how large your codebase is or how much of it is off-system.

What is never sent: your source code, file paths, token names or values, colours, component names, repository names, your email, your IP address as a stored identifier, or anything else that originates in your repository. The server rejects anything that is not one of the fixed values above rather than storing it.

To turn it off, run choiceui telemetry off, or set DO_NOT_TRACK=1 in your environment. It is already off in continuous integration. Run choiceui telemetry status at any time to see exactly what is on and what is being sent.

This website

We run no analytics on this site. No page tracking, no cookies beyond what signing in requires, no advertising network, no cross-site tracking and no third-party scripts watching you read this. That is why you are not being asked to accept a cookie banner.

Our host keeps standard server logs, as every web host does, and we do not build anything from them.

If you create an account

Accounts exist for the parts of ChoiceUI that share one design system across several repositories. That is not open to the public yet. If you do have one, here is everything we hold:

IdentityYour email address and, if you provide one, your name. Handled by our authentication provider, Clerk.

Repository namesThe name and URL of a repository you connect, so the dashboard can tell your repositories apart. We never receive the repository’s contents, and ChoiceUI has no access to your source control.

Device labelsA name for each machine you authorize, so you can recognise and revoke them. It defaults to something like “MacBook Pro”.

Published systemsWhen you publish a design system, we store the manifest: token names and values, component names and their variants. This is the thing other repositories follow.

Conformance reportsIf you run doctor --report, we store the violations it found so the dashboard can show them: file path, line number, violation type and the offending value, for example a hardcoded colour. We do not store the surrounding source code.

AI, and what it sees

reconcile can use AI to suggest fixes. This is the only feature that sends anything from your codebase to a third party, and we want to be blunt about it.

If you are signed in and use it, the violations being fixed are sent to Google’s Gemini API for analysis. That payload includes the file path, the line number, the offending value and a short snippet of surrounding code. Google processes it to return suggestions.

If you are not signed in, this feature is off unless you supply your own GEMINI_API_KEY, in which case the request goes from your machine directly to Google under your own key and does not pass through us at all. Every other command works without AI.

Who else processes your data

VercelHosting for this site and the dashboard.

ClerkAuthentication and account identity.

RailwayThe database holding accounts, systems and reports.

GoogleThe Gemini API, for AI suggestions only, and only as described above.

We do not sell your data, we do not share it with advertisers, and we do not use your design system or your code to train any model.

How long we keep it

Account data is kept while your account exists. Published manifests and conformance reports are kept while the design system they belong to exists. Delete your account and we delete all of it.

Your choices

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything attached to it. Email hello@vervian.com and we will action it.

The strongest choice available to you is simply not creating an account. The CLI is fully functional without one, which is the point.

Changes and contact

If we change what we collect, we will change this page and move the date at the top. ChoiceUI is a product owned and operated by Vervian Design Group Inc.. Questions go to hello@vervian.com.