Privacy Policy

Last updated: July 15, 2026

1. Introduction

Crop&Kern Co., Ltd. (registered Japanese name: Crop&Kern株式会社) (“Company”, “we”, “us”) operates Stil (stil.dev). This Privacy Policy explains how we collect, use, share, and protect your information.

2. Information We Collect

2.1 Account Information

Email address
Name (optional)
Authentication data (OAuth tokens for GitHub, Google, Figma)

2.2 Project Data

Design tokens exported from Figma
Component definitions and variants
Gate policies and rules
DESIGN.md generated content
Changeset history

2.3 Usage Data

Feature usage patterns (which tools are used, frequency)
Error logs for debugging
Performance metrics

2.4 Payment Data

Payment information is processed directly by Stripe. We do not store credit card numbers, bank account details, or other sensitive financial data on our servers.

2.5 Contact Inquiries

Name
Email address
Inquiry category
Message content

2.6 Cookies and Similar Storage

We use cookies, localStorage, and sessionStorage for authentication, session management, language and theme preferences, preview state, feature flag management, and similar service functions. We do not use cookies for advertising delivery or third-party advertising tracking.

3. How We Use Your Information

We use your information to:

Provide and maintain the Service
Process billing and subscriptions
Send service-related notifications (account changes, security alerts)
Improve the Service based on usage patterns
Provide customer support
Comply with legal obligations

We do NOT:

Sell your personal data to third parties
Use your design system data to train our own AI models
Share your project data with other users without your consent
Send marketing emails without your explicit opt-in

However, to provide AI-assisted features, we may send prompts, selected design system information, and related context to external AI providers.

4. Data Sharing

We may share data with, or have data processed by, the following third parties as necessary to provide the Service:

Third Party	Purpose	Data Shared
Supabase	Database hosting	Project data, account data
Vercel	Application hosting	Application logs
Stripe	Payment processing	Email, subscription details
Figma API	Plugin functionality	OAuth tokens (encrypted), connected data
GitHub API	Repository integration	OAuth tokens (encrypted), connected data
Google API	Authentication or integration functionality	OAuth information, account information
Resend	Email delivery (authentication emails, notifications, etc.)	Email address, email content (authentication codes, notification content, etc.)
Slack	Contact inquiry notifications, when configured	Name, email address, inquiry category, message content
Anthropic and other AI providers	Providing AI-assisted features	Prompts, inputs, and related context
External tools you connect	Integration features you configure or use	Data necessary for the integration

We do not share your design tokens, components, or DESIGN.md content with any third party except as necessary to provide the Service, maintain security, comply with law, or support integrations you configure.

5. Data Storage and Security

5.1 Location

Project and account data is stored on Supabase infrastructure. We use Vercel infrastructure for application hosting and application log processing. Data may be processed in regions where these service providers operate, subject to their security controls and applicable law.

5.2 Security Measures

All data in transit is encrypted via TLS
Database access is restricted by row-level security policies
OAuth tokens are encrypted at rest
Access logs are maintained and reviewed

5.3 Retention

Active account data: retained while your account is active
Authentication users, sessions, OAuth connections, memberships, personal access tokens, and similar records after account deletion: deleted within a reasonable period
Workspaces, audit logs, usage logs, contact inquiries, and security logs: may be retained for legal, security, or legitimate business purposes
Billing records: retained as required by tax law (7 years in Japan)

6. Your Rights

You have the right to:

Access: Request a copy of your personal data
Correction: Update inaccurate information
Deletion and suspension: Request deletion, suspension of use, erasure, or suspension of third-party provision of personal data in accordance with law
Export: Export your project data via the Service's export features or API, to the extent supported by those features
Third-party provision records: Request disclosure of third-party provision records in accordance with law

To exercise these rights, contact us via our contact form. We may need to verify your identity. Depending on the request, we may not be able to delete records that we are required or permitted to retain for legal or legitimate business purposes.

6.1 GDPR (EU Users)

If you are located in the European Economic Area, you have additional rights under GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority.

6.2 APPI (Japan)

We comply with Japan’s Act on the Protection of Personal Information (APPI). In accordance with APPI, you may request disclosure, correction, suspension of use, suspension of third-party provision, and disclosure of third-party provision records for retained personal data. We accept privacy complaints and requests through the contact point below.

7. Children

The Service is not available to users under 16 years of age. If you are a minor, you must obtain consent from your legal guardian. We do not knowingly collect personal information from users under 16.

8. Changes

We may update this Privacy Policy. Material changes will be notified via email or through the Service at least 14 days before they take effect.

9. Contact

Personal Information Handling Business Operator: Crop&Kern Co., Ltd. (Crop&Kern株式会社)
Representative: Tetsuro Sugita
Address: Arrowland Mansion 203, 5-6-2 Miyanishicho, Fuchu-shi, Tokyo, Japan
Data Protection Inquiries: https://stil.dev/contact