New A1 Pro: unlimited saves, priority submissions and more →
A1 Gallery

Privacy policy

Last updated: July 2026

A1 Gallery is operated by A1 Gallery (“we”, “us”). This policy explains what personal data we collect, why we collect it, and your rights around it. We keep things simple: we collect as little data as possible and never sell it.

What data we collect and why

Your account

When you make an account we store your email and your name. You can add a profile photo, but that’s up to you. We use this to sign you in, show your name on your account, and keep your saved work tied to you.

There are three ways to log in: a one-time link sent to your email, your Google account, or a passkey (Face ID, Touch ID, or your device’s PIN). Sign in with Google and it shares your email, name, and profile photo with us — nothing else. Use a passkey and the secret never leaves your device; we only ever store the public half.

Emails

We send two kinds of email: a weekly roundup of the best sites, and the odd product update about A1. Both are optional and separate — pick either, both, or neither, and change your mind any time from your account or the unsubscribe link in any email. Your email is handled by MailerLite (our email platform). The legal basis is your consent.

Analytics

We use Google Analytics to understand how the site is used (pages visited, time on site, general location by country). This data is anonymised and aggregated — we cannot identify you individually. Google Analytics sets cookies in your browser to enable this. The legal basis is our legitimate interest in improving the site.

When you’re signed in we also keep a first-party log of your activity (the pages you view and searches you run) tied to your account, so we can see how A1 is used and improve it. Delete your account and this log is unlinked from you. The legal basis is the same — our legitimate interest in improving the site.

What you save

When you save a site, section, or page — or add one to a board — we store that against your account so it’s there when you come back. Boards can be private or public. Make a board public and anyone with the link can see its name and what’s in it, but never your email.

Pro subscription

If you go Pro, the payment runs entirely through Polar.sh. We never see or store your card details. We keep a record of your subscription status — active or cancelled — so we know what you have access to. Polar.sh’s own privacy policy covers your payment data.

Submitting a website

To submit a site you need an account, so we already have your email — there’s no separate field for it. We store the site link and anything you tell us about the creators, and use it to review and reply. Pay to skip the review queue and that payment runs through Polar.sh too; we don’t see your card details.

The MCP server

The MCP server at /api/mcp needs a free A1 account, so calls are tied to the same account you sign in with on the site. For each call we log which tool ran, the search terms sent to it, how long it took, which client made it — Claude Code, Cursor, and so on — the request IP, and your user id. Daily counts per tool and per account go to Upstash Redis and expire after 90 days.

We use it for rate limits, to spot abuse, and to work out which searches return nothing useful. We never see your conversation. The server only receives the arguments your agent sends it — a search term, a slug, a filter — and returns gallery data. Your prompts, your files and the rest of the chat stay with your agent.

Third-party processors

We use the following services that may process personal data on our behalf:

  • MailerLite — email delivery (EU-based, GDPR compliant)
  • Google Analytics — anonymised site analytics
  • Google — sign-in, only if you choose to use your Google account
  • Cloudflare — content delivery and storage for profile photos
  • Hetzner — website hosting and infrastructure
  • Polar.sh — payment processing for Pro and paid submissions
  • Upstash — rate limiting and usage counters for the MCP server

None of these services are permitted to use your data for their own marketing.

Cookies

Two kinds. Analytics cookies (via Google Analytics) collect anonymised data about how the site is used. And if you log in, a session cookie keeps you logged in as you move around — it isn’t used to track you across other sites, and it clears when you sign out. No cookies are used for advertising. You can clear or block cookies in your browser any time.

How long we keep your data

  • Account data — kept until you delete your account. Delete it and your saves, boards, and profile photo go with it.
  • Newsletter email addresses — kept until you unsubscribe
  • Usage analytics — while you have an account we keep a log of your activity (pages viewed, searches) to understand how A1 is used. Delete your account and that log is unlinked from you, so what remains can’t be traced back to you. Aggregate analytics in Google Analytics follow its standard 26-month retention.
  • Submission data — kept for as long as reasonably necessary to process and respond

Your rights

Under GDPR you have the right to access, correct, or delete any personal data we hold about you. You also have the right to withdraw consent at any time (for example, by unsubscribing from the newsletter). To exercise any of these rights, email us at [email protected] and we will respond promptly.

You can also delete your account yourself, any time, from your account settings. That removes your saves, boards, profile and personal details, and unlinks your activity so it’s no longer tied to you. We keep only anonymous, aggregate statistics — for example that a subscription was cancelled and roughly how much it was used — which don’t identify you.

If you have concerns about how we handle your data, you also have the right to lodge a complaint with your local data protection authority.

Changes to this policy

We may update this policy occasionally. Any significant changes will be noted with an updated date at the top of this page.

Contact

For any privacy-related questions, contact us at [email protected].