Privacy Policy
Version 2026-10-26
This policy explains what personal data slidekit.dev (the "Service", run by Trendvisor, Inc.) collects, why, who sees it and what control you have. We try to collect as little as we can.
1. What we collect
Account data (needed to give you an account)
- Email address, only if your sign-in provider says it is verified.
- Display name and avatar picture URL from Google or GitHub, and the provider's user id.
- Your handle (public name in your profile address), display name, optional bio and optional profile picture.
- Records of what you agreed to (terms version, privacy version, age confirmation, marketing choice) and when.
Optional data (only if you give it)
- Answers to the optional onboarding questions (role, job title, organization, team size, purposes, experience, how you found us, which coding agents you use).
- A profile picture you upload (metadata such as location is stripped).
- Marketing preference (off by default; separate from accepting the terms).
Content you create
- Decks, images and assets, comments and replies, folders, workspace membership and invitations (including the email an invitation was sent to), stars and recent items.
Technical data
- Sign-in sessions: a hashed session token, creation time and your browser's user-agent text, so you can see and revoke your active sessions.
- Personal access tokens for agents: a hash of the token, a label, scopes and last-used time (the token itself is shown once and not stored).
- Request logs and rate-limit counters, which can include your network (IP) address, used to keep the Service secure and to limit abuse. Rate-limit counters are kept for minutes; logs are kept for up to 7 days.
Information from Google and GitHub. When you sign in with Google we ask only for openid, email and profile; with GitHub only read:user and user:email. We receive your provider id, your verified email address, your display name and your avatar picture URL, and use them only to create your account, sign you in and show your name and picture in the app. We do not use this information for advertising, we do not sell or transfer it to other parties except as described in this policy, and we do not read your files, contacts, repositories or any other data in your Google or GitHub account.
We do not store provider access tokens, we do not run advertising, and we do not use analytics or tracking cookies.
2. Why we use it
| Purpose | Data | Basis (where the law asks for one) |
|---|---|---|
| Create and secure your account, sign you in | account data, sessions | contract |
| Run the editor, sharing, comments and agent features | content, tokens | contract |
| Protect the Service from abuse, enforce limits | technical data | legitimate interests |
| Keep records of your agreement | consent records | legal obligation, legitimate interests |
| Improve the product with onboarding answers | optional answers | consent |
| Send product news | email, marketing choice | consent (you can withdraw anytime) |
3. Who sees it
- Other people: your public profile (handle, display name, bio, picture) if you make it public; decks only as you share them; workspace members see what the workspace role allows.
- Your agents: anything you let an agent token reach (comments and decks in the workspaces it is allowed to use).
- Service providers (processors): Cloudflare hosts the Service, its database and file storage. Google and GitHub handle sign-in when you choose them. We do not sell personal data.
- Authorities: when the law requires it.
4. Where it is stored
Data is processed on Cloudflare's global network and stored in the regions Cloudflare uses for our database and storage. This can include countries outside your own. Where the law requires, we rely on appropriate safeguards for such transfers.
Korea: additional notices (Personal Information Protection Act)
The operator is based in South Korea, so the Personal Information Protection Act applies to users in Korea.
- Third-party provision: we do not provide personal data to third parties, except where the law requires it or authorities ask through a lawful procedure.
- Entrusted processing: Cloudflare, Inc. hosts the Service, its database and file storage, and handles network delivery and security. Google LLC and GitHub, Inc. are independent sign-in providers that you choose yourself; we do not entrust processing to them.
- Transfer abroad: the data in section 1 is transferred to Cloudflare, Inc. (United States and the other countries where Cloudflare operates; privacy contact privacyquestions@cloudflare.com, data protection officer dpo@cloudflare.com) every time you use the Service, over the network, to host and store it and keep it secure, for the retention periods in section 5. If you do not want this transfer, do not use the Service or delete your account; the Service cannot work without it.
5. How long we keep it
- Account and content: until you delete them. Archived decks are removed after 30 days.
- After deletion: removed from the live Service promptly; copies in backups disappear when the backups expire (within 35 days: database point-in-time recovery data is kept for up to 30 days and our weekly exports for 4 weeks).
- Sessions: until they expire (30 days at most) or you revoke them.
- Consent records: kept while your account exists.
- Logs: up to 7 days.
6. Your choices and rights
- See and export: Settings has "Download my data" (JSON).
- Correct: edit your profile and answers in Settings.
- Delete: Settings has "Delete account".
- Marketing: turn it off in Settings at any time.
- Depending on where you live (for example the EU/UK or California), you may have more rights: access, correction, deletion, restriction, objection, portability, withdrawing consent, and complaining to your data protection authority. Contact contact@trendvisor.kr and we will answer within the time the law sets.
7. Children
The Service is for people 16 and older. We do not process personal data of children under 14 without a legal guardian's consent. If you believe a child under 16 has an account, contact contact@trendvisor.kr and we will delete it.
8. Security
Sessions use secure, HTTP-only cookies; tokens and passwords are stored only as hashes; deck content is served from a separate, sandboxed host so a deck cannot read your account. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.
9. Cookies
See the Cookie notice.
10. Changes
When we change this policy in a way that matters, we change the version date above and, where needed, ask you to accept again.
11. Contact and privacy officer
Trendvisor, Inc., 5309, 5F, 47 Honamdae-gil (Seobong-dong, Hyeonmyeonggwan), Gwangsan-gu, Gwangju, Republic of Korea. Privacy questions and requests: contact@trendvisor.kr.
Privacy officer (Korea): the Representative of Trendvisor, Inc., contact@trendvisor.kr. We answer access, correction, deletion and suspension requests without delay and within 10 days, and you may use an agent with a power of attorney.
Remedies in Korea: if our answer is not enough you can ask the Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), the Supreme Prosecutors' Office cyber investigation (1301, spo.go.kr) or the National Police Agency cyber investigation (182, ecrm.police.go.kr).