Privacy Policy

1. Scope and who we are

DSH Themes is an independent community project for discovering, comparing, creating, reviewing, and installing verified themes for the DeepSeek Harness Web UI. It is not affiliated with or endorsed by DeepSeek AI.

This policy applies to the DSH Themes website and its first-party APIs. The operator of each deployment is responsible for the personal data processed by that instance. GitHub, DeepSeek Harness, upstream projects, sponsors, and other linked websites apply their own privacy terms.

2. Information we process

Depending on the features you use, we may process:

• Account data: name, email address, avatar, email-verification status, encrypted or provider-managed credentials, account roles, sessions, and invite status.
• Social sign-in data: when Google or GitHub sign-in is enabled and you choose it, the provider returns the basic identity data needed to create or match your account, such as a provider account identifier, name, email address, and avatar. We do not receive your Google or GitHub password.
• Creator and community data: public handle, display name, biography, source links, themes, Full Skin drafts, manifests, previews, license and attribution declarations, submissions, moderation decisions, favorites, reports, and support messages.
• Sponsor data: applicant contact details, placement request, destination URL, artwork submitted for review, review history, and inventory status.
• Technical and security data: request time, route, response status, browser and device information, IP-derived or signed-cookie rate-limit identifiers, download counters, integrity records, and diagnostic logs needed to operate and protect the service.
• Preferences: language, light/dark/system appearance, consent choices, and similar local or cookie-based settings.

Please do not submit secrets, private keys, unnecessary personal data, or content you are not authorized to share.

3. Public information

Content intended for publication may become public. This can include your creator handle and profile, theme or Full Skin name, description, preview images, manifest metadata, source and license links, attribution, compatibility evidence, version history, and moderation status. Public content may be indexed by search engines and copied or archived by third parties.

Drafts, unpublished media, private sponsor assets, and account administration data are access-controlled and are not intentionally published. Publication follows the review and authorization rules described by the service.

4. How and why we use information

We process information only for purposes connected to the service, including to:

• authenticate users, maintain sessions, and secure accounts;
• provide catalogs, comparison tools, Token Lab, Learn, Studio, submissions, favorites, reports, sponsor workflows, downloads, and support;
• validate files, licenses, provenance, compatibility fingerprints, and artifact integrity;
• review, publish, reject, pause, archive, or remove community and sponsor content;
• prevent abuse, enforce rate limits and quotas, investigate incidents, and maintain audit records;
• measure reliability and improve accessibility, performance, and usability; and
• comply with applicable legal obligations and valid requests.

The legal basis depends on your location and the feature involved. It may include performing our agreement with you, obtaining your consent, complying with the law, or pursuing legitimate interests such as security, moderation, and service improvement where your rights do not override those interests.

5. Cookies and local storage

The site may use:

• essential authentication and session cookies;
• a locale cookie and local appearance preference;
• a signed anonymous download-client cookie used for rate limiting and accurate download counting;
• OAuth state or callback cookies needed to complete a sign-in you initiate; and
• analytics or similar optional cookies only when the deployment operator has enabled the relevant integration and applicable consent requirements are met.

Blocking essential cookies may prevent sign-in, secure downloads, or saved preferences from working. You can clear cookies and local storage through your browser, although doing so may sign you out or reset preferences.

6. Google and GitHub sign-in

Social sign-in is shown only when the deployment operator configures and enables the provider. DSH Themes requests only the identity information needed for authentication and account matching. We use provider data only for the purposes described here. We do not sell it or use it to train advertising models. You can revoke access in the provider's account settings. Revoking access does not delete your local DSH Themes account; account deletion is handled separately.

7. Files, images, and theme artifacts

Uploaded images are validated, normalized, stripped of unnecessary metadata where supported, and stored under controlled paths. Draft and sponsor assets are access-controlled until an authorized publication or active placement makes the exact approved asset public. Published theme packages, manifests, preview images, and integrity metadata may remain available as part of the public release and provenance record.

External showcase previews are fixed-revision editorial copies displayed with source and review status. They do not make an external project a verified or installable DSH Themes release.

8. Service providers and disclosures

We do not sell personal data. A deployment may use service providers for hosting, databases, object storage, email delivery, authentication, analytics, or security. Those providers process data only as needed to deliver the configured service and under their own contractual and legal obligations.

We may also disclose information when reasonably necessary to comply with law, respond to a valid legal request, protect users or the service, investigate abuse, or enforce our Terms of Service. Public content is disclosed by its nature.

9. International processing

The website, its deployment operator, and configured providers may operate in different countries, so data may be processed outside your country. Where required, the operator is responsible for using an appropriate transfer mechanism and safeguards. Provider locations and safeguards depend on the deployment configuration.

10. Retention

We keep personal data only for as long as reasonably needed for the purposes described above, including account operation, publication history, moderation, security, dispute resolution, and legal compliance. Retention varies by record type and deployment configuration.

When an account or record is deleted, some information may remain temporarily in backups, security logs, or legally required records. Published artifacts, attribution, and moderation evidence may need to be retained or de-identified to preserve release integrity, license compliance, and the safety of users who installed a release.

11. Security

We use safeguards such as access controls, secure session cookies, content validation, rate limits, integrity checks, private storage for unpublished artifacts, and least-privilege administrative roles. No online service can guarantee absolute security. Keep your credentials secure and report suspected misuse promptly.

12. Your choices and rights

Subject to applicable law, you may be able to access, correct, export, delete, restrict, or object to the processing of your personal data, and withdraw consent where processing relies on consent. You may also have the right to complain to your local data-protection authority.

You can update available profile data in account settings, manage provider authorization with Google or GitHub, and request additional help through the signed-in support channel or the project contact channel. We may need to verify your identity before fulfilling a request. Some requests may be limited where retention is required for security, legal, license, or public-release integrity reasons.

13. Children

The service is not directed to children below the minimum age at which they may consent to online services in their jurisdiction. If you believe a child has provided personal data without valid authorization, please contact the deployment operator.

14. Changes to this policy

We may update this policy as the project or its configured providers change. The latest revision date appears above. Material changes should be communicated through the website or another appropriate channel before they take effect when required by law.

15. Contact

For privacy questions or requests, use the signed-in support channel available on this deployment or the contact channel published in the DSH Themes project repository. Include enough information to identify the relevant account or content, but do not send passwords, private keys, or other secrets.