Privacy

ChoiceUI runs on your machine and, by default, sends us nothing at all. This page says exactly what changes when you do connect something.

Last updated 28 July 2026

The short version

Using the ChoiceUI CLI without an account sends us no code and nothing from your repository. The commands read your repository and write files back into it, and that is almost the whole transaction. The exception is a single anonymous count of which command you ran, described below, which you can turn off in one command.

This website counts visits to its public pages. It sets no cookies to do it, stores nothing in your browser, and never identifies you. Everything else on this page applies only if you create an account, which is not currently open to the public.

Using the CLI without an account

init, doctor, guard, status, canonicalize, direction, manifest, intake, showcase and mcp do their work entirely on your machine.

Your design tokens, component code, file paths and repository contents stay on your machine and in your repository. We never receive them.

Anonymous usage counts

Because the CLI needs no account, we would otherwise have no idea whether anyone uses it or which commands are failing. So it sends one small, anonymous record when a command runs. The first time it happens, the CLI tells you so on screen.

What is sent:

Install IDA random identifier generated on your machine the first time you run a command. It is not derived from you, your machine or your repository, and it lets us tell one person running a command fifty times apart from fifty people running it once.

Command nameWhich command ran, for example doctor. Never its arguments.

VersionsThe CLI version, your operating system and its version, and your Node version.

That is the entire list. We do not record what a command found, so we cannot tell how large your codebase is or how much of it is off-system.

What is never sent: your source code, file paths, token names or values, colours, component names, repository names, your email, your IP address as a stored identifier, or anything else that originates in your repository. The server rejects anything that is not one of the fixed values above rather than storing it.

To turn it off, run choiceui telemetry off, or set DO_NOT_TRACK=1 in your environment. It is already off in continuous integration. Run choiceui telemetry status at any time to see exactly what is on and what is being sent.

This website

We use analytics on the public pages, provided by PostHog, and we have set it up to collect as little as we can while still answering the only two questions we have: does anyone come here, and does anything on the page actually get used.

What is collected on these public pages:

PageviewsWhich page was viewed, when, the address you arrived from, and the usual things your browser announces to every website: its type, its language and your rough screen size.

Copy eventsWhen someone uses a copy button, we record that a copy happened, the button’s label, which block it belonged to and whether it worked. We never record the text that was copied.

That is the entire list. There is no autocapture, so we are not silently logging every click and every piece of text you touch. There is no session recording, so nobody is watching a replay of your visit. There is no advertising network, no cross-site tracking and nothing here that follows you to another site.

No cookies. Analytics is configured to keep its state in memory only, so it writes nothing to your browser and nothing survives you closing the tab. That is why you are still not being asked to accept a cookie banner. The honest cost of that choice is ours: we cannot tell a returning visitor from a new one, so our own numbers are worse. We think that is the right way round.

Nothing is collected once you sign in. Analytics is loaded only on the public marketing pages. The dashboard and the rest of the signed-in product are not instrumented at all.

If your browser sends a Do Not Track signal, analytics does not run for you at all. As with any server your browser talks to, your IP address reaches PostHog, and they use it to work out an approximate country. We hold no way to connect that to a person.

Our host keeps standard server logs, as every web host does, and we do not build anything from them.

If you create an account

Accounts exist for the parts of ChoiceUI that share one design system across several repositories. That is not open to the public yet. If you do have one, here is everything we hold:

IdentityYour email address and, if you provide one, your name. Handled by our authentication provider, Clerk.

Repository namesThe name and URL of a repository you connect, so the dashboard can tell your repositories apart. We never receive the repository’s contents, and ChoiceUI has no access to your source control.

Device labelsA name for each machine you authorize, so you can recognise and revoke them. It defaults to something like “MacBook Pro”.

Published systemsWhen you publish a design system, we store the manifest: token names and values, component names and their variants. This is the thing other repositories follow.

Conformance reportsIf you run doctor --report, we store the violations it found so the dashboard can show them: file path, line number, violation type and the offending value, for example a hardcoded colour. We do not store the surrounding source code.

AI, and what it sees

reconcile can use AI to suggest fixes. This is the only feature that sends anything from your codebase to a third party, and we want to be blunt about it.

If you are signed in and use it, the violations being fixed are sent to Google’s Gemini API for analysis. That payload includes the file path, the line number, the offending value and a short snippet of surrounding code. Google processes it to return suggestions.

If you are not signed in, this feature is off unless you supply your own GEMINI_API_KEY, in which case the request goes from your machine directly to Google under your own key and does not pass through us at all. Every other command works without AI.

Who else processes your data

VercelHosting for this site and the dashboard.

PostHogAnalytics for the public pages only, as described above.

ClerkAuthentication and account identity.

RailwayThe database holding accounts, systems and reports.

GoogleThe Gemini API, for AI suggestions only, and only as described above.

We do not sell your data, we do not share it with advertisers, and we do not use your design system or your code to train any model.

How long we keep it

Account data is kept while your account exists. Published manifests and conformance reports are kept while the design system they belong to exists. Delete your account and we delete all of it.

Your choices

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything attached to it. Email hello@vervian.com and we will action it.

The strongest choice available to you is simply not creating an account. The CLI is fully functional without one, which is the point.

Changes and contact

If we change what we collect, we will change this page and move the date at the top. ChoiceUI is a product owned and operated by Vervian Design Group Inc.. Questions go to hello@vervian.com.