Privacy policy

This policy covers the Alea documentation site (https://alea.alevasquez.dev), the Alea Pro registry and CLI, and buying Alea Pro. Alejandro Vasquez (https://alevasquez.dev) is responsible for the data described here, except what Lemon Squeezy keeps as the seller (section 4).

1. The documentation site

• Statistics. The site counts visits with Google Analytics 4, the same service and the same consent banner used on alevasquez.dev, fun.alevasquez.dev and alea.alevasquez.dev. It runs only after you accept in the banner: until then nothing from Google is loaded and no cookie is stored. If you accept, Google Analytics sets the cookies _ga and _ga_<id> and records the page, the language, the look you pick, that a code sample was copied (never its content), that the search was opened (never what you typed), and clicks on the Figma kit and plugin links. Google signals and ad personalization are off, GA4 does not log or store IP addresses, and the data is kept for 14 months. Google processes it for the author; it is used for no ads and sold to no one. You can withdraw at any time from Cookie settings in the footer of the site. Global Privacy Control and Do Not Track are respected as a rejection.
• Your browser. The site keeps a few preferences in your browser's local storage: language (alea-lang), theme (alea-theme), look (alea-preset), contrast (alea-contrast), background (alea-background), glass effect (alea-refraction), the package manager you pick in the install tabs (alea-pm), the recent emojis of the emoji picker demo (alea-emoji-recent) and your cookie choice (ale-consent). They stay on your device and you can clear them in your browser settings.
• Fonts and hosting. The fonts are served from the site itself. The site is hosted on GitHub Pages, which may keep standard server logs (such as IP address and user agent) under its own privacy policy.
• There are no accounts, no ads and no forms on the site.

2. The Alea Pro registry and the CLI

The CLI sends your license key to the private registry only when you add a Pro component or install a Pro package. It sends nothing else, and the free packages send nothing.

• The registry is a Cloudflare Worker. It checks your key with Lemon Squeezy and keeps no request logs.
• It never stores your key or your IP address as themselves. Both become a one-way keyed hash (HMAC-SHA256) with a secret that stays on the server.
• Per key it keeps when the key was first and last seen, a count of uses and, for 14 days, a shortened hash of each client per day, only to flag a key shared too widely. These records expire 90 days after the last use. A valid answer from Lemon Squeezy is remembered for one hour.
• A key revoked by the author is kept as a revoked hash until it is restored.
• Requests are limited per client (60 a minute, and 10 failed keys a minute) using the hash of the IP.

3. Support

When you email hi@alevasquez.dev, the author reads your message and your address to answer you. If you use the help form of a Fun Lab Figma plugin, what that plugin sends and keeps is described on https://fun.alevasquez.dev/security. Closed help requests are deleted after 24 months. The emails about help requests are sent through Resend.

4. Purchases

Lemon Squeezy is the merchant of record. Your payment details go to Lemon Squeezy, not to the author, who never sees your card. Lemon Squeezy shares with the author the order details needed to deliver and support your license, such as name, email and country. What Lemon Squeezy keeps is governed by its own privacy policy: https://www.lemonsqueezy.com/privacy

5. Sharing and transfers

Nothing is sold, shared with advertisers or used to train AI models. Data is handled by the services named here: Cloudflare (registry), Lemon Squeezy (payments and license keys), Resend (email), GitHub Pages (hosting) and Google LLC (statistics, only if you accept). These providers may process data in countries other than yours, under their own policies.

6. Your choices

You can ask to see or delete what the author keeps about you. Email hi@alevasquez.dev from the address you used; the author deletes it within 30 days and confirms by email. You can also reject or withdraw the statistics at any time from Cookie settings, with Global Privacy Control, Do Not Track or a content blocker, and the site works the same.

7. Children

Alea is made for designers and developers and is not directed to children.

8. Changes

If this policy changes, its version and date change, and the change history lists what changed.

9. Contact

Questions: https://www.alevasquez.dev/contact or hi@alevasquez.dev

Change history

• 1.4 (October 28, 2026): The contact link points to the main site with a campaign tag, and the link to the security page carries a campaign tag too.
• 1.3 (October 27, 2026): The list of browser storage is now complete and exact (package manager and recent emojis); the link to the security page is fixed.
• 1.2 (October 27, 2026): Statistics now use Google Analytics 4 with a consent banner, only after you accept; the list of browser storage and the providers are updated.
• 1.0 (October 27, 2026): First version.