Privacy Policy

Overview

Inspiration by VASA Works is a design inspiration gallery. Browsing the library needs no account. Free and paid accounts can save boards and use connected tools. Accounts can also upload images and import connected content. We do not sell personal data. This policy describes data processed through the website, account features and connected tools.

Accounts and billing

Creating an account only requires an email address. Normal sign-in uses emailed magic links. Dedicated review accounts may use a password stored as a salted hash. Subscription payments are processed by Stripe; we do not store your card details. Transactional email (magic links, receipts, account notices) is sent via Resend. Accounts also receive a weekly digest email of references picked from what they save and like. Every digest has a one-click unsubscribe link and the digest can be turned off anytime from the account page. We send no other marketing email. If you generate an API key for a connected tool, we store a one-way SHA-256 hash to validate it and an encrypted copy so your signed-in account can display it again and authorized connection flows can reuse it. Older keys may need rotation before they can be displayed again. Keep your API key private: it authorizes access to your account's connected features.

Boards and connected content

We store the boards you create, their titles and saved references, and images you upload. If you connect X, we store connection details, encrypted authorization tokens and imported bookmark content, which can include post text, links and media. Private account content is available through authorized account features and connected tools. Publishing an eligible board makes its contents publicly accessible.

Media links returned by account features or connected tools can be opened by anyone who has the link. Treat links to private uploads and imported media as private when sharing them.

Connected AI tools

When you connect an AI client through MCP, we process the tool requests it sends, such as searches, selected references, palette settings and board actions. Tool results are returned to that client and can include account content you request. The AI client processes those requests and results under its own privacy terms.

Figma plugin and Chrome new tab

The Figma plugin and the Chrome new tab extension sign in with your account key, which they keep in their own local storage (Figma's plugin storage, Chrome's extension storage) and send only to this site. The new tab extension talks only to this site and its image host; it cannot read your tabs, your history or other sites. Both send usage events to this site, such as opening the tool, searching, and placing or saving a reference, under a random install identifier before you sign in; the new tab never sends what you type into its search field. Once you sign in, these events are linked to your account.

What data is collected

We collect usage and technical analytics to understand how the site is used. This typically includes:

• Pages visited and navigation paths
• Referring website or search query (if your browser sends it)
• Browser type, operating system and approximate geographic region (country or region level, not precise location)
• Session duration and bounce rate

Browser analytics can use a device or visitor identifier. Account and connected-tool activity can be linked to your account, as described in the Analytics entry below.

Cookies and local storage

We use cookies for sign-in and browser storage for preferences and analytics identifiers. The sign-in cookie has a 30-day lifetime. We do not use advertising cookies or cross-site behavioral profiling.

Three first-party cookies remember when this browser last visited: the time of the latest visit, the one before it, and a capped count of visit days. They last up to 400 days and are used only to show what is new since your last visit and to decide when to show a one-time tip.

The analytics provider may use first-party cookies or local storage to distinguish visits. These identifiers can be associated with your account when you sign in.

You can disable cookies in your browser settings. The core browsing and search functionality of the site continues to work without cookies.

Third-party processors

We use third-party services to host the product, process payments, send transactional email and understand product usage:

• Hosting and CDN: Cloudflare hosts the website, databases and media, and processes requests as part of delivering the service.
• Payments and email: Stripe processes subscription payments and billing information. Resend processes email addresses, transactional messages and the weekly digest.
• Analytics: We use PostHog for browser and server events, session recordings and click heatmaps. Identified activity can be linked to your account. Signing out resets browser identification but does not delete previously recorded events or disconnect authorized tools. Connected-tool events can remain linked to your account while its credentials are used. Events can include tool names, usage, outcomes and selected request data such as search queries, board titles, reference identifiers and specimen text. Recording masks do not prevent separately instrumented events from including text.

We do not use Google Analytics, Meta Pixel or any advertising networks.

External links

Some references include links to an original website. Clicking those links takes you to a third-party website governed by its own privacy policy. We have no control over and no responsibility for data practices on external sites.

Data retention

We have no fixed automatic deletion schedule for account data, boards and saved content, analytics, or infrastructure logs. For information about retention or to request deletion, contact hello@vasa.works. Signing out does not delete your account, saved content or previously recorded activity.

Your rights

To ask about your personal data or request access, correction, deletion or a copy of it, contact us at the address below. Include enough information to identify the account or activity concerned. The rights available to you depend on applicable law.

Changes to this policy

We may update this policy when our practices change or to reflect new requirements. Material changes will be noted with an updated date at the top of this page.

Contact

For privacy-related questions, write to: hello@vasa.works