Privacy Policy
Yuki Shaders collects as little as it can. Without an account, your work never leaves your browser. With one, we keep your email address, your saved projects and what's needed to sign you in securely. There are no ads and no tracking cookies. We measure visits and how the studio is used with cookieless tools that don't follow you across sites.
Who is responsible
Dixie Raiz Pacheco, Cagayan de Oro City, Philippines, operates Yuki Shaders (yuki-shaders.app) and is responsible for your data. Questions or requests: contact@dixieraizpacheco.com.
Using the studio without an account
Your layers, settings and uploaded images autosave in your own browser (local storage and IndexedDB). They aren't sent to us. “Start over” in the studio clears them, as does clearing your browser's site data.
What we collect with an account
- Email address, to identify your account and send sign-in links.
- Sign-in sessions: for each signed-in device we record the IP address and browser name with the session, so we can secure your account and spot misuse.
- Passkeys: only the public key and basic device details. Your fingerprint, face or device PIN never leave your device and we never see them.
- Authenticator app, if you turn it on: the shared secret and your backup codes, used to check your codes.
- Projects: the names and settings of looks you save, and the images you add to them.
- Abuse protection: short-lived counters keyed by IP address that limit how often sign-in emails and codes can be requested.
We use this data only to provide the service and keep it secure. We don't sell it, share it for advertising or use it to profile you. Our legal basis is providing the service you asked for, plus our legitimate interest in keeping it secure.
Share links
A project is private until you turn on its share link. Anyone with the link can then open a copy of the project, including its images, until you stop sharing. Your email address is never shown.
Visit statistics
We use Cloudflare Web Analytics to see how many people visit, which pages they open, where they came from and how fast pages load. It records page views, the referring site, browser and device type, country and page-load timings. It sets no cookies, doesn't use your browser storage, doesn't fingerprint you and doesn't follow you to other sites, and we can't identify you from it. We use it only to improve Yuki Shaders.
How the studio is used
We use PostHog (hosted in the United States) to understand how people use the studio, so we can improve it. It records page views and studio actions such as which template or preset you pick, image exports (size and format), copying code, saving or sharing a project and signing in, plus clicks on the studio's buttons and your browser, device type and referring site. Your IP address is turned into the daily hash and discarded, so it isn't stored or used to look up your location. It never records what you type, your images or your email address, and it doesn't record your screen.
It runs in PostHog's cookieless mode: nothing is stored in your browser, and PostHog counts visitors with a privacy-preserving hash that changes every day, so your visits can't be linked over time or to your account. It only runs on yuki-shaders.app.
Cookies and storage
When you sign in, we set essential cookies that keep you signed in. They're required for accounts to work, which is why there's no cookie banner. We use no advertising or tracking cookies, and neither our visit statistics nor our usage analytics use cookies or browser storage.
Services we rely on
- Cloudflare hosts the site, its database and image storage, protects it from attacks and provides the cookieless visit statistics above. Like any web host, it handles your IP address and request details.
- Resend delivers sign-in emails, so it receives your email address and the email's content.
- PostHog receives the cookieless usage events described above.
- Google Fonts and jsDelivr serve the fonts and the open-source shader libraries the studio loads, so they see your IP address and browser details when you open it.
These providers may process data outside your country, including in the United States. They act under their own privacy terms and the safeguards they offer for international transfers.
How long we keep it
- Sign-in links expire after 10 minutes and work once.
- Sessions end when you sign out or after a period without use.
- Your account, projects and images stay until you delete them. Delete account (under Account in the studio) permanently removes your account, projects, images, passkeys and authenticator settings straight away. For your security it asks you to have signed in within the last day.
Your rights
You can ask to see, correct, export or delete your personal data, or object to how we use it. Email contact@dixieraizpacheco.com from the address you sign in with and we'll reply within 30 days. You also have the right to complain to a data protection authority, such as the Philippines' National Privacy Commission or the authority where you live. We aim to meet the Philippine Data Privacy Act of 2012 and, for users in Europe and the UK, the GDPR.
Security
Accounts have no passwords to leak. Sign-in links are single-use and short-lived, passkeys are phishing-resistant, and an authenticator app can be added as a second step. Data is encrypted in transit, private projects can be read only by their owner, and access to the systems behind the service is restricted. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.
Children
Yuki Shaders is a design tool and isn't meant for children under 16. We don't knowingly collect their data; if you think a child has made an account, let us know and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. For significant changes we'll tell signed-in users by email or in the studio before they take effect.
Contact
Dixie Raiz Pacheco, Cagayan de Oro City, Philippines. contact@dixieraizpacheco.com