Skip to content
All 6 kits from $99 · Everything Bundle $149

— Legal

Privacy Policy

Last updated: October 22, 2026

Open Template Forest (“OTF”, “we”, “us”) is operated by Factorx Inc, a Delaware corporation headquartered in the United States. We sell full-stack code kits and offer a free open-source UI SDK. This policy describes what we collect, why, and your choices.

The short version

  • We don’t sell your data. Ever.
  • We collect the minimum needed to run the site, process payments, and improve the product.
  • Your payment card never touches our servers — Stripe handles it.
  • You can request deletion of any personal data we hold by emailing dave@otf-kit.dev.

What we collect and why

Email address (waitlist + purchases)

If you join our waitlist or buy a kit, we collect your email so we can send you the kit license, updates, and (rarely) product news. You can unsubscribe at any time using the footer link in any email we send.

Payment information

Payments are processed by Stripe. We never see or store your card details — Stripe sends us a transaction ID, the amount, the kit you purchased, your billing email, and any campaign tags we sent with your checkout. If you arrived from a campaign link, we send that link’s tags to Stripe with your checkout and store them with your order. Stripe’s privacy policy applies to the payment flow itself.

Analytics

We use PostHog to understand which pages are useful and which features people care about. PostHog is hosted in the United States. PostHog receives your IP address. It keeps a random ID in localStorage and in a cookie. When you join the list, sign in by email, or buy a kit, we send PostHog your email address and link the activity from this browser to it.

PostHog also records page sessions. Form inputs are masked in these recordings.

We also use Microsoft Clarity, which records page sessions. If you visit from the EU, the EEA, the UK or Switzerland (or we cannot tell where you are), it loads only if you accept analytics in our cookie banner; elsewhere it loads unless you turn analytics off under Cookie settings in the footer. We send it no email and no name. Clarity records what is shown on the page, so text you see or type there can appear in a recording.

We also use Google Analytics (GA4), which receives page views and our events. It follows the same rule as Clarity, and if you reject (or turn analytics off), neither loads. While analytics are on, joining the list or buying a kit also sends GA4 a hashed (SHA-256) form of your email address. When you buy a kit, our server also sends Google Analytics a purchase record (the kit and the amount, no email address and no cookie), whatever you chose in the banner. You can change your choice any time under Cookie settings in the footer.

Server logs

Our hosting provider (Cloudflare) keeps standard server logs (IP address, user-agent, timestamp, requested URL) for security and abuse detection. Logs are retained for up to 30 days and deleted after.

Sub-processors

We rely on these third-party services. Each has its own privacy policy:

  • Stripe — payment processing
  • Cloudflare — application hosting, DNS, CDN, email forwarding
  • Render — database hosting
  • Neon — database hosting for the live kit demos (demo sign-ups)
  • Supabase — database hosting for the Booking kit demo (demo sign-ups)
  • PostHog — product analytics and session recording
  • Google — Google Analytics (GA4) and optional Google sign-in
  • Microsoft — Microsoft Clarity session recording
  • Resend — transactional email (kit license delivery)
  • GitHub — private kit repo access for buyers
  • Telegram — signup alerts to our team chat (email, source, name)

Cookies

We use cookies and browser storage for:

  • Stripe: required for the checkout flow to work
  • Sign-in: an otf_session cookie that keeps you signed in for 30 days. Google sign-in also sets a cookie that lasts up to 10 minutes, to check the sign-in response.
  • PostHog: a random analytics ID, in localStorage and in a cookie
  • Theme preference: a tiny localStorage entry remembering your light/dark mode
  • Region for the cookie banner: a sessionStorage entry, otf_region, saying whether your country needs the banner. We read the country from Cloudflare (/cdn-cgi/trace) once per visit and keep only that yes or no; it is gone when you close the tab.
  • Email box: a localStorage timestamp, so the blog sign-up box appears at most once every 7 days
  • Top banner: a localStorage flag, kept until you clear it, remembering that you closed the banner
  • Campaign tags: a local-storage entry with the link tags and landing page path, kept 30 days.
  • Affiliate code: a localStorage entry, otf_aff_ref, with the affiliate code from a link you followed (?ref=). It is kept until a newer code replaces it or you clear it. If you start checkout, we send that code to Stripe with your checkout.
  • Cookie choice: a localStorage entry, otf_consent, recording whether you accepted analytics. It stays until you clear it. A matching cookie, otf_analytics, carries the same choice to our demo sites, which record sessions with Microsoft Clarity on the same rule as this site.
  • This visit: sessionStorage entries for the page you landed on and the email you typed in checkout. They clear when you close the tab.

Google Analytics and Microsoft Clarity set their own cookies and storage only while analytics are on (after you accept in the EU, the EEA, the UK or Switzerland; by default elsewhere). If you reject or turn them off, they stop, and we delete the cookies they set. Their privacy policies apply to that storage.

We do not sell your data or buy data from brokers. Google Analytics and Microsoft Clarity are third-party scripts that set their own cookies.

Your rights

Depending on where you live (EU/UK/California/etc.), you may have the right to:

  • Access the personal data we hold about you
  • Correct any inaccurate data
  • Delete your data (right to be forgotten)
  • Export your data in a machine-readable format
  • Withdraw consent for marketing emails at any time

To exercise any of these, email dave@otf-kit.dev. We’ll respond within 30 days.

Data retention

  • Purchase records — kept for 7 years (tax/accounting compliance)
  • Marketing email list — until you unsubscribe
  • Server logs — 30 days
  • PostHog session recordings — 30 days
  • PostHog event data — kept under PostHog’s retention for our plan

International transfers

Factorx Inc is based in the United States. If you access OTF from outside the US, your data will be transferred to and processed in the US and other regions where our sub-processors operate (Stripe, Cloudflare, Render, Neon, Supabase, PostHog, Resend). Where applicable, transfers rely on Standard Contractual Clauses or equivalent safeguards under GDPR.

Children

OTF is a developer tool not directed at children under 16. We do not knowingly collect personal data from anyone in that age range.

Changes to this policy

If we materially change how we use personal data, we’ll update the “Last updated” date and, for significant changes, send an email to anyone on our list. Continued use of the site after the change is taken as acceptance.

Contact

Questions, corrections, or deletion requests:

Factorx Inc
dave@otf-kit.dev