Privacy Notice

Effective 2026-11-03

This notice describes what ChameleonUI.io, the Chameleon website operated by Materia Technologies, Inc. ("Materia", "we", "us"), records about visits to it and calls to its MCP server, why, and how to stop it, and what it keeps for an account you sign in to (section 8). What the site stores in your browser is set out in the Cookie Policy, published at https://ChameleonUI.io/legal#cookie-policy.

Table of Contents

1. What we measure, and why

We measure five things: which pages people read and how long they keep them open, which of our own links brought them, how fast those pages are for the people reading them, when something on the site breaks, and how AI assistants use the tools our MCP server offers them (section 2). We use the answers to improve the site and its documentation, and for nothing else.

We do not identify you, profile you, or follow you to another site. We use no advertising, no analytics cookies, and no third-party analytics product. The data is not sold, and it is not shared with anyone outside Materia.

We rely on our legitimate interest in understanding how the site is used so that we can improve it. In the United Kingdom this measurement falls under the exception for statistical purposes in the Privacy and Electronic Communications Regulations, which requires this notice and a free way to object; section 7 is that way.

2. What we record

What Where it comes from What it holds
Page requests Our own server, as each request arrives The time, to the second; the visit key (section 3); the page path (for an address that is not one of our pages, only that it was not), with llms.txt and llms-full.txt, our indexes of the site for AI assistants, counted as pages; whether the page was loaded whole or by the site's own navigation or read as text; the response status; the domain of the referring site; the kind of device (desktop, tablet, phone, or an automated client such as a search engine's crawler); the country; how long the server took to respond; which of our servers answered, and which of its two copies; which version of the site's content it served; and, when you followed a link we tagged for one of our own campaigns, that campaign's name
Requests at Cloudflare Cloudflare, which sits in front of our server and sees every request to the site The time, the page path, the response status and whether Cloudflare answered from its cache, without your IP address, browser or referring site; and whether your browser sent Global Privacy Control or the ChameleonOptOut cookie, which is kept only so that we can leave the record out (section 7)
Page speed A small script of our own on each page, which sends a report when you leave the page or switch away from it, and, if you come back and leave again, another with the measurements that changed since; a page brought back from your browser's back-and-forward cache counts as a new page view and reports afresh The name and value of each measurement (Largest Contentful Paint, Interaction to Next Paint, Cumulative Layout Shift, and how long the page was visible since the last report, up to half an hour), the page path, the hour, which of our servers answered and which of its copies, and which version of the site's content it served
Script errors The same script, which reports errors in the scripts the page runs when you leave the page or switch away from it The kind of error and its message, cut to 200 characters (an error your browser says came from one of its extensions, or from its own pages, is not kept), with everything from the first quotation mark to the last, e-mail addresses, long numbers and identifiers, and the query string of any web address or path removed before it is kept; the file, line and column it came from; your browser's family; the page path; the hour; which of our servers answered and which of its copies; which version of the site's content it served; and how many times the page saw it
Code examples The same script, which reports how the page's interactive code examples behaved when you leave the page or switch away from it For each example that started on a page you viewed (an example starts by itself, and runs its code once, when it comes into use on the page, whether or not you change it): whether it ran as Web, React or Blazor; how long it took to become ready, to prepare your code and to show the result; whether the result appeared or failed; and whether a failure was in preparing your code or in running it; with the page path, the hour, which of our servers answered and which of its copies, and which version of the site's content it served. Never the code itself, and never an error's message, which can quote the code
Content Security Policy reports Your browser, which reports to us when it blocks something on a page The time; what was blocked and the rule that blocked it; whether the rule blocked it or only reported it; the page path; the file and line that tried; your browser's family (such as Firefox); which of our servers answered, and which of its copies; which version of the site's content it served; and how many times the same report arrived
Calls to our MCP server Our own server, when an AI assistant calls one of the tools offered by our MCP server, the service at /mcp that answers AI assistants' questions about Chameleon (its documentation, a check of their code, colors and themes, and facts about the product) using the Model Context Protocol Totals for each hour, never a list of calls: the tool called; the name the calling program gives itself, or the first word of the user agent it sends, kept only when it is at most 40 characters of letters, digits, spaces, ., _ and -, with no run of five digits, and was seen at least twice in the hour; how often each such program connected; whether the call succeeded, failed or was refused for arriving too fast; how long it took and how long the answer was, each as a range; whether the answer came in parts; which release of the documentation it asked about, when it is one we published; and, where they apply, the component it asked about, the kind of each problem our code check found in the code it sent, whether a contrast check passed, and whether a search found nothing; how often the server's description of itself and the site's catalog for AI assistants were read; and which of our servers answered, and which of its copies. Never the question, the code, the colors or the answer, and no IP address, visit key or browser. A call that sends Global Privacy Control or the ChameleonOptOut cookie is not counted (section 7). These totals are deleted within 33 days, and no longer-kept total is made from them
Availability An outside service that checks whether the site answers Whether it answered, and how quickly
Our proxy's operating log The proxy in front of our application, for every request, to keep the servers running The time, the method, the page path when the request was answered (otherwise nothing), the response status, the size of the response and how long it took; no IP address, browser, referring site, cookie or query string. It is not used for measurement, and like every individual record it is deleted within 33 days
Our application's operating record Our server, for each request to one of its programming interfaces and each call it makes to another service, to keep the site and its payments working The time, to the second; the interface as it is declared, never the address requested, or the service called; the method; the response status or the error; and how long it took. No page path, IP address, browser, cookie, query string or visit key. Our server also records its own load once a minute, which holds nothing about any visitor

The page speed, script error and code example reports carry no identifier of any kind, not even the visit key. Each report stands alone and cannot be linked to another. Your browser sends this site's cookies with the report, as it does with every request to the site. Our server looks only at ChameleonOptOut, and nothing from any cookie is kept with the report. The hourly totals of MCP calls carry no visit key either, and nothing from any cookie.

3. The visit key

Page requests carry a visit key, so that we can tell that several pages were read in the same visit. It is made by combining your IP address and your browser's user agent with a secret value that we hold only in memory, and scrambling the result so that it cannot be reversed. The IP address and the user agent are then discarded.

The secret value is replaced every day and never stored, so the key changes every day. Two visits on different days cannot be linked, by us or by anyone else.

This is a pseudonymous identifier, not an anonymous one. Within a single day, it distinguishes one visitor's requests from another's. We describe it that way because that is what it is.

4. What we never record

5. How long we keep it

Individual records are deleted within 33 days, our proxy's operating log among them. Before then they are combined into totals, such as the number of times a page was read on a given day or its typical loading time, and only those totals are kept beyond 33 days. A total is a count or a typical value for a day, a page and a kind of device, for a day and one of our campaigns, for a day, a page and a kind of code example, or for a day and a kind of Content Security Policy report or script error. It keeps no visit key, so it cannot be linked to a visitor, though on a quiet day a total can be a count of one.

6. Where it is kept, and who sees it

The records are kept in storage we control, provided by Cloudflare, Inc. as our processor. Only the people who run the website at Materia can read them. Nobody else receives them, and no vendor's dashboard holds a copy of them.

Cloudflare carries every request to the site, and keeps its own records of them for security and its own analytics, under its own terms. Those are Cloudflare's records, not the ones this notice describes, and we do not receive them.

7. Opting out

You can stop all of this measurement at any time, free of charge, in either of two ways:

A call to our MCP server is left out of the count when it sends Global Privacy Control or the ChameleonOptOut cookie. An AI assistant sends them only when its own software is set to, so a choice made in your browser does not reach it.

Opting out does not affect anything else: every page, the documentation and your account work as before.

Cloudflare's records of requests reach us with a note of your choice. We leave those records out of every count and total, and they are deleted with the other individual records. Two things continue whatever you choose: your browser still sends the Content Security Policy reports described in section 2, because that is how we learn a page is broken, and our proxy's operating log still records each request, because that is how we keep the servers running. Neither carries the visit key nor anything else that could tell us who sent the request.

8. If you have an account

Sections 1 to 7 describe the measurement of visits, which is the same whether or not you are signed in. When you sign in, we also keep what we need to run your account and any Chameleon license it belongs to. Clause 18.1 of the Chameleon Software License Agreement refers to this section.

What we keep:

Why: to sign you in, to issue and check the licenses your organization holds, to manage its seats and members, and to keep a record of who changed them.

Who else processes it, for us: Auth0 (Okta, Inc.) signs you in, through the provider you choose there, such as GitHub, LinkedIn, Google or Microsoft; Postmark (ActiveCampaign, LLC) sends the emails we send you, such as an invitation to an organization; Cloudflare, Inc. stores the record of license grants. The rest is kept on our own servers and in backups we control. Payments are taken by Stripe, which acts as the seller of record under its own terms: your payment details go to Stripe, and we never receive them.

If you sign in with Google: Google gives us, through Auth0, your name, your email address, the address of your profile picture, an identifier for your Google account, and whether Google has verified your email address. We ask for no other access to your Google account. We use this information only to sign you in (a new account needs a verified email address), to show you who is signed in, and to run your account and license as this section describes. We do not sell it or use it for advertising. We share it only with the processors named above; with Stripe, which receives your email address when you buy a license, as the seller of record; with anyone you invite to an organization, whose invitation names you by your email address; and, if you belong to an organization, with its administrators, who see your email address. The people who run the website at Materia read it only to administer your account or license. Our use of information received from Google complies with the Google API Services User Data Policy, including its Limited Use requirements. You may ask us to delete your account as section 9 describes, and you can withdraw our access at any time in your Google Account, under third-party connections.

How long: for as long as your account exists, and the records of license grants and changes for as long as the license they concern and any dispute about it. You may ask us to delete your account at any time.

If you write to us through the contact form, we receive your name, email address, any telephone number you give and your message, by email through Postmark, and keep them as long as the conversation needs them.

9. Your rights

You may ask us what we hold about you, ask us to correct it, and ask us to delete it. For your account, we will do so unless we must keep a record to administer a license your organization holds. For the measurement of visits, because we keep no IP address and the visit key changes every day, we will usually be unable to find any record that is yours, and we will tell you so. You may also complain to your data protection authority; in the United Kingdom that is the Information Commissioner's Office.

10. Changes to this notice

If we change this notice we publish the revised version on this page with a new effective date. We publish a change that does not affect the substance, such as a correction to wording, without moving the effective date.

11. Contact

Questions about this notice go to chameleon@materia.tech, or to Materia Technologies, Inc., 5201 Feather Lane, Tilghman, MD 21671-1195, USA.