Privacy Policy

Last updated: October 29, 2026

This policy explains what QuasarUI (www.quasarui.com, "we") collects about you, why, and what you can do about it. If anything here is unclear, email us. QuasarUI is run by Hafiz Javaid Iqbal, Lahore, Pakistan who is responsible for your data.

The short version

You can browse the catalogue, copy Free Components and read the docs without an account. We don't run analytics or advertising trackers, so browsing collects nothing about you beyond ordinary server logs.
When you create an account or buy something, we store your email address and what you bought, so we can sign you in and unlock your Products.
Payments are handled by Polar. We never see your card details.
We don't sell your data, and we only email you about your account and your purchases.

What we collect

Your account

Email address. It identifies your account, and we send sign-in, password reset and purchase emails to it.
Name and profile picture, if you give us a name or sign in with GitHub or Google.
Password, if you set one. We store only a one-way hash of it, never the password itself.
GitHub or Google account ID, if you sign in with one, so we can recognise you next time. We only receive your public profile and email address from them.
Whether your email is verified and when you last used the site.

If you pay without being signed in, we create an account for that email address automatically, so you can sign in and use what you bought.

If you bought on the old QuasarUI site, we copied your account and purchases to this one so that they keep working.

Your purchases

We store which Products you hold and the Polar order they came from. Polar collects your name, billing address and payment details at checkout, and keeps your invoices and receipts, which you can open from your dashboard.

When you buy a Template, Polar asks you to connect your GitHub account so it can invite you to the Template's private repository.

Access Keys

When you create an Access Key for the MCP Server, we store the name you give it, a hash of the key, the first few characters (so you can tell your keys apart) and when it was last used. We can't recover the full key once it is shown to you.

Magic Links, six-digit sign-in codes and password reset links are stored only as hashes, and stop working after they expire or are used.

Security

To stop people guessing passwords or flooding sign-in emails, we count attempts per email address and per IP address. Both are hashed before they are stored, and each count is deleted once its time window ends, after an hour at most.

Our hosting provider also keeps standard server logs, such as IP address, browser and the page requested, for a short period, to keep the site running and secure.

Cookies

We only use cookies the site needs to work:

Cookie	What it does	How long it lasts
Session cookie	Keeps you signed in. It is encrypted, so it can't be read or changed in your browser.	Until you sign out, or up to a year
`last_auth_method`	Remembers whether you last signed in with email, GitHub or Google, so the sign-in page can point it out. It holds nothing else.	One year
Sign-in redirect	Remembers which page to send you back to after signing in with GitHub or Google.	Ten minutes

Polar's checkout and customer portal run on Polar's own website and set their own cookies there. There are no advertising or analytics cookies, so there is no cookie banner.

How we use your data

To create your account and sign you in.
To unlock the Products you bought, on the site and through the MCP Server.
To send you emails you need: sign-in links and codes, password resets, and access to what you bought. We don't send newsletters or marketing.
To answer you when you contact us.
To protect the site from abuse, and to stop accounts that break our Terms of Service.
To keep the records the law requires for sales.

We share your data only with the services that run QuasarUI, and only what each one needs:

Service	What for
Polar	Checkout, payments, invoices, tax and refunds. Polar is the merchant of record, and card payments are processed by Stripe on Polar's behalf.
Vercel	Hosting the website.
Turso	The database where your account, purchases and Access Keys are stored.
Resend	Sending our emails.
GitHub and Google	Signing you in, only if you choose to use them. GitHub also hosts the private Template repositories.

Some of these services are based in, or store data in, the United States and other countries outside your own. Each one protects the data under its own privacy policy and data processing terms.

We may also disclose data if the law requires it, for example in response to a valid court order.

How long we keep it

Your account and purchases are kept for as long as your account exists, so your lifetime access keeps working.
Records of sales may be kept longer where tax or accounting law requires it, even after you delete your account.
Sign-in codes, links and attempt counters are deleted once they expire, as described above.

Your rights

You can:

See and change your name, and change your password, on your dashboard.
Revoke any Access Key on your dashboard at any time.
Ask us for a copy of the personal data we hold about you.
Ask us to correct it, or to delete your account and its data.
Object to how we use your data, or ask us to restrict it.

To do any of these, email us from the address on your account. We will answer within 30 days. Deleting your account ends your access to anything you bought, and it can't be undone.

If you are in the EU, the UK or another place with data protection law, you also have the right to complain to your local data protection authority.