Privacy

Layro is a small registry run by one person. It keeps as little about you as it can, and none of it is sold or shared for advertising. This page lists everything it does keep.

If you just browse

• No cookies are set and no account is needed. Your theme choice is kept in your own browser.
• Page views are counted with Umami, a cookieless analytics service. Per page view it gets the address of the page (without anything after the ?, so searches stay private), the page title, the site you came from, your screen size and language, and works out your browser, operating system, device type and country. It doesn't store your IP address and tells visitors apart with a hash that changes every day.
• For each component Layro counts views, copies and installs so its author can see how it's doing. Each count stores the component, what happened, a two-letter country and whether the visitor was signed in. To count each visitor once a day, Layro hashes your IP address and browser with the date and keeps that hash only in Cloudflare's cache until midnight UTC. Nothing else.
• What you type into search is never logged or stored.

If you sign in

You sign in with GitHub. Layro stores:

• From GitHub: your name, email address, profile photo, username (which becomes your handle) and GitHub account id, plus the access token GitHub issues for sign-in, which can only read your public profile and email address.
• For each session: the IP address and browser it started from, so sessions can be listed and abused ones stopped. Sessions expire after a week and are deleted a day later.
• Whatever you add yourself: your bio and links, components you publish, bookmarks, access tokens (only a hash of each), agents you connect and the GitHub repos you link.
• Small daily counters of what you used (submissions, reports, recordings), to apply limits.

Your public profile shows your name, handle, photo, bio, links and components. Your email address is never shown.

Emails

Layro emails you when a component you sent is approved or rejected, and when one is taken down after a report. Emails are sent through Resend from notifications@mail.layro.dev; replies go to hello@layro.dev. Turn review emails off in Settings, Notifications. There is no newsletter and no marketing email.

Who processes your data

• Cloudflare hosts Layro (Workers, storage, queues, caching) and protects it from abuse. It handles every request, including your IP address. Short request logs are kept for a few days. The form on the submit page uses Cloudflare Turnstile to check you're a person.
• Supabase runs the database, in Frankfurt (EU).
• Resend sends the emails above.
• Umami counts page views as described above.
• GitHub handles sign-in, and repos you connect through the Layro GitHub App.

Component previews run on a separate site, layro.live, which sets no cookies and records nothing about you.

Backups

The database is backed up every night. Backups are private and kept for up to six months, then deleted. If you delete your account, it disappears from the live site at once and from backups as they expire.

Deleting your data

Delete your account any time in Settings, Account. You choose whether your components go with it or stay on Layro without your name. You can also email hello@layro.dev to ask for a copy of your data, a correction or deletion; we answer within 30 days.

Changes

If this page changes in a way that matters, the date at the top changes and signed-in authors get an email.