How we handleyour data

DS ARC reads your documentation to run one check, keeps the results for 14 days, and then deletes what it read. It never writes to anything of yours. Nothing you give it is used to train a model. The only thing we keep longer is the report itself, so the link keeps working, and — only if you tick the box — some anonymised numbers for a yearly industry report.

A sample of your documentation: up to 40 pages, chosen across your sections rather than crawled in order. Depending on how you point us at it, that is a public site we fetch, files you upload (unpacked in your browser — a zip never leaves your machine), a zeroheight styleguide read through its API, a GitHub repository read through GitHub’s API, or a published Storybook’s docs pages.

The text of those pages is sent to Anthropic’s API (the model named on your report) to run the eight jobs and to write the questions for them. Anthropic does not train on what is sent through its API. We do not send it anywhere else.

Your documentation, as we read it — the crawled text and the agent’s full transcripts — for 14 days, then deleted.

The report — the scores, the findings and the short transcript excerpts shown on the page — for the same 14 days, while the link is live. When the link expires, the findings and excerpts are deleted too; what stays is the two scores and the date, so a later run can show how the score moved. You can unpublish the link at any time from the report page; the data is retained for the 14 days, so if that was done in error, email us and we put it back.

A salted hash of your IP address, never the address itself, so one person cannot run the tool hundreds of times a day. It is not linked to you.

Your email address, only if you unlock the full report. It goes into zeroheight’s CRM so we can send you the report and its PDF. Marketing email only ever follows the consent you give on that form, and you can unsubscribe from any message. Signing in with zeroheight or GitHub does not store your account’s email anywhere.

When you sign in with zeroheight or GitHub, we read only the styleguide or repository you choose, only for this check, and only to read — we cannot write to it. The access token is encrypted, held only while the run is reading your documentation, and deleted as soon as that reading is finished or the run fails — and we ask the provider to revoke it at the same time. A sweep deletes any token older than an hour regardless. The sign-in cookie in your browser lasts 30 minutes and is cleared when you submit. We do not keep the token, reuse it, or use what we read for anything other than the report you asked for. If you are a zeroheight customer: we already hold your documentation to run zeroheight; this check is a separate purpose, and it only happens because you started it here.

Every report lives at an unguessable address. It is marked so search engines do not index it, it expires 14 days after the run, and you can unpublish it from the report page. Anyone with the link can see the free part of the report; the full report needs an email address. A public grade attached to a named company would be a problem for you and for us, which is why none of this is listed anywhere.

Each time you start a check there is a box: include this run, anonymised, in zeroheight’s annual State of Design System Documentation report. It is off by default, and ticking it changes nothing about your report.

If you tick it, we keep the numbers from the run — the two scores, how each of the eight jobs went, which guidelines passed, how many pages and components were sampled, and which kind of source it was — and we drop everything that could identify the system: its name, its URL or domain, the page text, the transcripts, the component names, and your email. What is left cannot be traced back to a system. We publish it only as totals across many systems (“agents picked the right component 62% of the time”), never as a single row.

You can withdraw a run from the corpus at any time by emailing community@zeroheight.com with the report link.

DS ARC is made by zeroheight Ltd, and zeroheight’s privacy and cookie policy applies to everything on this page. For anything about your data — to see it, correct it, delete it early, or withdraw from the benchmark — email community@zeroheight.com.