Privacy policy

Who we are

Vamos UI is published by Vamos, a digital agency in Istanbul, Türkiye (“Vamos”, “we”). Vamos is the data controller for the services this policy covers:

• the documentation site https://ui.vamos.ist;
• the component registry under https://ui.vamos.ist/r/;
• the vamos-ui command-line tool and the @vamos-ui/mcp package when you run them yourself;
• the hosted MCP server https://mcp.vamos.ist/mcp, including when you add it to Claude, ChatGPT or another AI client.

Summary

We do not sell personal data, do not use it for advertising or profiling, and do not use it to train AI models.

Docs site

ui.vamos.ist is a set of static files served from a server we operate. It has no sign-in, sets no cookies and runs no analytics, tracking pixels or advertising scripts.

• Theme choices (light/dark, accent, density, font) are saved in your browser's localStorage under the key vamos-theme so the site looks the same on your next visit. Some interactive examples save their demo state the same way. This data stays in your browser and is never sent to us; clear it in your browser settings at any time.
• Third-party content on some example pages. Image galleries, website templates and other previews load sample photos from Unsplash (images.unsplash.com); the font previews and font picker load fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com); one video player example loads a script from jsDelivr (cdn.jsdelivr.net). When your browser loads these files, that provider receives your IP address and browser user agent under its own privacy policy. The site's own fonts are served from our server.

Registry

The registry is a collection of public, static JSON files under https://ui.vamos.ist/r/. It is read by the CLI, the MCP server and anyone who opens the URLs. Requests to it are logged like any other request to the site (see Server logs).

CLI and local MCP server

npx vamos-ui and npx @vamos-ui/mcp run on your own computer. They contain no telemetry and never send your project files, code or usage data to us. They make network requests only for the work you ask for:

• reading item JSON from the registry (https://ui.vamos.ist/r, or the registry you configure);
• installing npm packages through your package manager, which talks to the npm registry you use;
• brand import <url> and the MCP tool import_design_system with a URL: fetching the page you name, its stylesheets and logo files, from your computer.

Hosted MCP server (mcp.vamos.ist)

The hosted server answers Model Context Protocol requests. It has no accounts and no sign-in, and it is stateless: every request is handled on its own and nothing is kept between requests.

What it receives

• Tool calls sent by your AI client: the tool name and its arguments. Depending on the tool, arguments are a search query, an item or block name, a screen description, a colour, a code snippet you asked it to check, or page HTML/CSS you asked it to read. Your AI client decides what to send; the server cannot read your files, your chat or anything else on your device.
• Connection details every web server sees: the IP address that made the request (when you use Claude or ChatGPT, this is usually the AI provider's server rather than your own address), time, path, status code, response size and user agent.

How it is used

Arguments are processed in memory only to compute the tool's answer and are discarded when the response is sent. The server application does not write tool arguments or results to disk or to its logs; its process log contains start-up messages and unexpected errors. To answer, the server reads the public registry from ui.vamos.ist; it does not call any other service. The tools are read-only: they cannot change anything on your computer or in any account.

The AI client you use (for example Claude or ChatGPT) is operated by its own provider and has its own privacy policy. It decides when to call the server and what to show you.

Server logs

The web server in front of the docs site, the registry and the MCP server (Apache) writes an access log entry for each request: IP address, date and time, method and URL, status code, bytes sent, referrer and user agent. It does not log request bodies, so MCP tool arguments are not in these logs. We use the logs to keep the services running and secure: to diagnose errors, detect abuse and attacks, and see aggregate load. We do not combine them with other data or use them to identify visitors. Our legal basis is our legitimate interest in operating a secure service (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

Who we share data with

• Hosting: the provider we rent our server from stores the files and logs on our behalf, as part of hosting the server.
• Authorities: only when the law requires it.

We share no data with anyone else and we do not sell it. The third-party providers on some example pages (see Docs site) receive requests directly from your browser, not from us.

Retention

Access logs are archived by the hosting control panel once a month and the archive is deleted at the end of the following month, so an entry is kept for at most about 60 days. The MCP server writes no request content to its process log. Logs connected to a security incident may be kept longer, only as long as needed to investigate it. MCP tool arguments and results are not retained at all.

Your rights

Depending on where you live (for example under the GDPR or Türkiye's KVKK), you can ask for access to, correction of or deletion of personal data about you, object to its processing, and complain to your data protection authority (in Türkiye, the KVKK Board). Because we hold no accounts, we can only find log entries if you tell us the IP address and approximate time. There is no automated decision-making.

The services are developer tools, not directed at children, and we do not knowingly collect data from children.

Changes

If we change what we collect, we update this page and the date at the top before the change takes effect. The history of this page is public in the repository.

Contact

• Questions about this policy: open an issue at github.com/sametburaksari/vamos-ui/issues. For a request that involves your personal data, do not post the data publicly: open an issue saying you have a privacy request and we will reply with a private way to continue.
• Security problems: report them privately through GitHub private vulnerability reporting. See Security.

Türkçe özet

Vamos UI'ı İstanbul'daki dijital ajans Vamos yayımlar ve bu hizmetler için veri sorumlusudur. Dokümantasyon sitesinde (ui.vamos.ist) hesap, çerez, analitik veya reklam yoktur; tema tercihleri yalnızca tarayıcınızda (localStorage) tutulur. Bazı örnek sayfalar Unsplash, Google Fonts ve jsDelivr'dan dosya yükler; bu sağlayıcılar IP adresinizi görür. CLI ve yerel MCP sunucusu bilgisayarınızda çalışır, telemetri göndermez. Barındırılan MCP sunucusu (mcp.vamos.ist) yapay zekâ istemcinizin gönderdiği araç adını ve argümanlarını yalnızca yanıtı hesaplamak için bellekte işler, saklamaz. Web sunucusu her istek için IP adresi, zaman, adres, durum kodu ve tarayıcı bilgisini kaydeder; bu kayıtlar güvenlik ve işletim amacıyla (KVKK m. 5/2-f, meşru menfaat) tutulur; aylık arşivlenir ve arşiv bir sonraki ayın sonunda silinir, yani kayıtlar en fazla yaklaşık 60 gün saklanır. Veriler satılmaz; yalnızca barındırma sağlayıcısı (bizim adımıza) ve yasal zorunlulukta yetkili makamlar erişebilir. KVKK m. 11 kapsamındaki haklarınız için GitHub issues üzerinden kişisel veri paylaşmadan başvurun; size özel bir iletişim yolu bildiririz. İngilizce metin esastır.