CUIS has no accounts, cookies, or telemetry in the stylesheets or controllers.
Each theme loads fonts from fonts.googleapis.com. That request shares the visitor's address with Google. If a deployment cannot make that request, self-host the Open Font License files named in NOTICE and remove the @import from the theme stylesheet.
Report a vulnerability to Rob Chappell at robchappell.contact@gmail.com.
CUIS is distributed under the MIT license. Fonts are not included. See NOTICE.