Source privacy

Updated October 14, 2026

Website content stays in your browser

Source reads images, SVGs, colors, font names, links, and other assets when you start a scan or use the asset picker. It contacts the websites and asset hosts you choose to fetch their files. It does not send scanned pages, asset URLs, page text, or extracted files to the Source licensing service.

Licensing and scan limits

Source contacts its service hosted on Cloudflare to verify access and count free scans. If you enter a Source Pro license key, it is saved locally in your browser and sent over HTTPS to that service. The service verifies your membership with Whop. Neither the extension nor its package contains the business API key or webhook signing secret.

Your public IP address is visible to Cloudflare when you connect. The service hashes it for request rate limiting. This version creates a random installation identifier, saved locally and sent to the service, to count three free scans per installation in a rolling 24-hour window. Older extension versions without this identifier share scans by network. The service stores scan identifiers and times for quota enforcement. Old scan records are removed on the next quota check after they expire; if you stop using Source, records can remain until that check. Cloudflare may retain operational logs under the account's configured retention. Webhook receipt identifiers are retained for seven days.

For Pro, the service also stores a hashed installation identifier linked to your membership to allow one active browser installation. It stores activation and transfer times, and hashes of temporary transfer codes. Codes expire after ten minutes; a successful transfer replaces the active installation. These licensing records remain until removed through a support request. Removing a local license or uninstalling does not remove the server binding. Source checks access online before scans, exports and Asset Picker actions and periodically while the extension is open.

Purchases

For automatic activation, Source creates a private purchase claim stored locally. Its hash is attached to a Whop checkout configuration. Source verifies the resulting membership before granting access; a checkout message alone never grants Pro. Pending checkout references expire on the service after 30 days. Verified access records contain the claim hash and membership identifier and remain until removed through a support request. The private claim is saved locally as an access credential and sent only to the Source service over HTTPS. It is not sent to the scanned website.

Checkout opens in a separate secure window with an embedded Whop form. Whop and its payment providers collect the email, billing and payment details you enter directly; the extension does not read those form fields. New Pro purchases are a one-time payment with no recurring charge. Whop manages purchase records and any existing monthly or yearly subscription billing. Some payment methods may open an external verification window. Source does not collect or store payment card details. Whop and Cloudflare process data under their own privacy policies. Removing your saved license does not cancel an existing subscription; use your Whop membership settings to cancel its renewal.

Welcome and license emails

Source uses the buyer email address and membership, plan, and payment-status information retrieved from Whop to verify purchases and send transactional welcome and license emails. These emails include a private license for restoring Pro access, plan information, and a purchase-management link. They are separate from Whop's order confirmations and are not marketing emails. Scanned pages, asset URLs, page text, and extracted files are not included.

Source sends these emails from designertoolboxcontact@gmail.com through Google's Gmail API. Only Source's sending account authorizes Gmail access, using permission to send email; customers do not need to connect their Gmail accounts. This integration does not request permission to read mailboxes. Google processes the recipient address and message contents to deliver and store the email under its privacy policy. Sent messages, including the license they contain, remain in the sender's Gmail Sent mailbox unless deleted separately.

While delivery is pending, Source temporarily stores the recipient address, email contents, and private license on Cloudflare to support delivery attempts. That pending payload is removed when processing finishes. Source retains the membership identifier, delivery status, message identifier, and timestamps to prevent duplicate emails and troubleshoot delivery. It also retains a hash of the license linked to the membership for restoring access. These records have no automatic expiry and can be reviewed for removal through a support request. Removing the pending payload does not delete copies held by Gmail or the recipient. Contact us at the address below for privacy or deletion requests.

Local storage and control

Options, a random installation identifier, and an entered license key are stored locally. Your workspace stores extracted asset URLs, embedded images, colors, font names, and selections locally so they remain available after you close Source. Named collections save a copy of these assets, colors and fonts, plus the collection name and save date, in this browser. They are not uploaded or synced. You can delete collections individually. A Pro transfer does not move them, and uninstalling removes them. Browser storage limits apply. Use the trash can button to clear scanned assets. A new scan replaces the previous results. You can remove the saved license in Options, revoke optional website access in your browser, or uninstall Source to remove its extension storage. Reset restores options and does not cancel an existing subscription.

Limited use

Source uses website data only to provide the asset collection features you request, and licensing data only for access, quota enforcement, and service operation. Source does not sell this data or use it for advertising or unrelated purposes. Source's use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Optional website analytics

On getsource.pro, we use Google Analytics only when you allow analytics cookies. It helps us measure visits, Get Source clicks, Pro interest, checkout starts, and visits to our activation guide. We send the page path, selected plan where relevant, and restricted campaign labels. We do not include license keys, checkout references, email addresses, scanned pages, or collected assets in these events. This website measurement does not track activity inside the extension.

Google receives technical connection information, including your IP address and browser information, when analytics is enabled. Analytics cookies help distinguish visits and are configured to expire after 60 days, with renewal on subsequent visits. Advertising personalization is disabled. See Google’s privacy policy for its processing practices.

Your analytics choice is stored in this browser for 180 days. You can change it using Analytics preferences at the bottom of any website page. Declining leaves the website usable and stops future website analytics; it does not erase previously collected records. Contact us for privacy requests. Whop checkout and the Chrome Web Store operate separately under their own policies.

Optional uninstall feedback

If you choose to send feedback after removing Source, we store the reason you select, your optional comment, a random submission reference and the submission time. No email, license key, browsing history or installation identifier is attached automatically. Please do not include sensitive information in your comment. The feedback page does not load Google Analytics. Hosting providers receive normal connection information when serving the page. An in-memory hash of the connection address may be used briefly to limit spam; it is not stored with feedback.

Feedback is used to improve Source and troubleshoot common problems. Records older than 90 days are removed when a new feedback submission is processed. Contact Source for a deletion request, with the approximate submission date and enough of your comment to identify it. Removing the extension does not cancel an existing monthly or yearly subscription.

Contact

For support and privacy requests, contact designertoolboxcontact@gmail.com.

Only download and reuse assets when you have permission from their rights holder.