Privacy Policy

Last updated: March 8, 2026

1. Introduction

Crop&Kern Co., Ltd. (“Company”, “we”, “us”) operates Stil (stil.dev). This Privacy Policy explains how we collect, use, and protect your information.

2. Information We Collect

2.1 Account Information

• Email address
• Name (optional)
• Authentication data (OAuth tokens for GitHub, Google, Figma)

2.2 Project Data

• Design tokens exported from Figma
• Component definitions and variants
• Gate policies and rules
• spec.md generated content
• Changeset history

2.3 Usage Data

• Feature usage patterns (which tools are used, frequency)
• Error logs for debugging
• Performance metrics

2.4 Payment Data

Payment information is processed directly by Stripe. We do not store credit card numbers, bank account details, or other sensitive financial data on our servers.

2.5 Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies.

3. How We Use Your Information

We use your information to:

• Provide and maintain the Service
• Process billing and subscriptions
• Send service-related notifications (account changes, security alerts)
• Improve the Service based on usage patterns
• Provide customer support
• Comply with legal obligations

We do NOT:

• Sell your personal data to third parties
• Use your design system data to train AI models
• Share your project data with other users without your consent
• Send marketing emails without your explicit opt-in

4. Data Sharing

We share data only with:

We do not share your design tokens, components, or spec.md content with any third party except as necessary to provide the Service.

5. Data Storage and Security

5.1 Location

Data is stored on Supabase infrastructure. Database servers are located in the United States (AWS).

5.2 Security Measures

• All data in transit is encrypted via TLS
• Database access is restricted by row-level security policies
• OAuth tokens are encrypted at rest
• Access logs are maintained and reviewed

5.3 Retention

• Active account data: retained while your account is active
• Deleted account data: removed within 30 days, backups within 90 days
• Usage logs: retained for 12 months
• Billing records: retained as required by tax law (7 years in Japan)

6. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update inaccurate information
• Deletion: Request account and data deletion
• Export: Export your project data via API or Service features
• Objection: Object to specific data processing activities

To exercise these rights, contact us via our contact form.

6.1 GDPR (EU Users)

If you are located in the European Economic Area, you have additional rights under GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority.

6.2 APPI (Japan)

We comply with Japan’s Act on the Protection of Personal Information (APPI). Your personal information is handled in accordance with APPI requirements.

7. Children

The Service is not intended for users under 16 years of age. We do not knowingly collect data from children.

8. Changes

We may update this Privacy Policy. Material changes will be notified via email or through the Service at least 14 days before they take effect.

9. Contact

Crop&Kern Co., Ltd.
Data Protection Inquiries: https://stil.dev/contact