Security
What we store, how API keys are protected, and what your agent can touch through MCP.
What we store
Firestore is the only datastore, and it holds exactly what running the product needs. Nothing here is sold or shared.
| Data | What's kept |
|---|---|
| Account | Your uid, an email if you signed in with one, and the provider you used. |
| Subscription | Plan, status and renewal date, mirrored from LemonSqueezy. |
| Usage | Which designs you copied today, only to enforce the daily limit. |
| Bookmarks | The designs you saved. |
| Agent API keys | A SHA-256 hash of each key. Never the key itself. |
Firestore security rules
An account can read its own documents and nothing else's. Every write, on every collection, goes through the server with the Admin SDK; the client-side rules deny writes outright, so there is no path from a browser straight into the database.
Agent API keys
A key is 256 bits of randomness behind the mdc_ prefix, generated once and shown to you exactly that one time. Only its SHA-256 is ever stored, as the document's own id, so a leak of the whole table hands an attacker nothing to replay: there is no secret to reverse, only a hash to look up. Revoking deletes that one row, which is the credential, so it stops working immediately.
What your agent can do through MCP
Every tool is a read. Searching and listing need no key at all; only pulling a design's code is metered, and it costs exactly what the copy button here costs.
- It cannot write to your account. The only thing that moves is your copy count.
- It cannot re-theme a design or invent one that does not exist.
- It cannot see another account's keys or usage.
Full detail on the tools themselves is on the MCP page.
Payments
LemonSqueezy is the merchant of record; we never see a full card number. Every webhook it sends is verified against its signature (HMAC-SHA256 over the raw body, compared in constant time) before anything is written, and an unsigned or mismatched request is rejected outright.
Reporting an issue
Email support@clevens.com with what you found. We read it ourselves; nothing routes through a ticket system first.