ai.to.design is now free.No account needed.Install now →

PRIVACY POLICY

Last updated: September 20, 2026

This Privacy Notice describes how we handle information when you use our services ("Services"), which comprise:

  • The website at https://ai-to-design.com
  • The ai.to.design Figma plugin (the "Plugin")
  • The local MCP connector, published as @ai.to.design/figma-connector on npm (the "Connector"), which runs on your own machine via npx

Questions or concerns? Please contact us at support@ai-to-design.com.

SUMMARY OF KEY POINTS

  • The Services do not collect your content or any identifier about you. The Plugin runs inside Figma and the Connector runs on your own computer, and they communicate locally. Your HTML/CSS design content, prompts, screenshots, design data, and file paths never reach our servers.
  • They do send anonymous usage counters, and you can turn that off. So that we know which features are actually used, the Plugin and the Connector send counts of events such as "plugin opened" or "tool called". These carry no identifier of any kind — no account, installation, device or session ID — so they cannot be traced back to you or linked together. Switch them off with the "Anonymous usage data" toggle in the Plugin, or with --no-telemetry for the Connector. See Section 1.
  • No accounts. No logins. No payments. The Services are free and require no registration. We do not hold names, passwords, payment details, API keys, or user profiles.
  • Beyond that, only two limited exceptions exist: (1) if you email us, we receive your email address and your message in order to reply; (2) if you explicitly consent via the cookie banner on our website, Google Analytics 4 collects anonymous, aggregate usage of the website.
  • No sensitive information is processed.
  • No information is obtained from third parties.
  • Your rights. Depending on where you are located, applicable privacy law may give you rights over any personal information we process. To exercise them, contact us at support@ai-to-design.com.

1. WHAT INFORMATION DO WE RECEIVE?

From the Plugin and the Connector: anonymous usage counters only

In Short: They send counts of what happened, never who did it and never what you designed. You can switch this off.

The Plugin runs inside Figma. The Connector runs on your own computer. They communicate with each other locally. Neither transmits your HTML/CSS, prompts, screenshots, design data, file paths, error reports, or any identifier about you to our infrastructure. There is no user account, no login, no API key, no subscription, and no payment associated with using the Services.

The single exception is anonymous usage counters. So that we can see which parts of the Services are worth maintaining, each one periodically sends a small batch containing, per event:

  • the name of the event, from a fixed list (plugin_open, mode_switch, tool_call, render, connector_start, session_end)
  • which mode the Plugin was in (mcp or chat)
  • the name of the tool that ran, from the fixed list of tools the Services provide
  • whether it succeeded or failed (ok or error)
  • when something failed, the kind of failure — one of a fixed list such as "timed out" or "network failure" — and never the error message or a stack trace
  • the version of the Plugin or Connector
  • how many times that combination occurred
  • for the Plugin only, how long a session lasted — as a band such as "1 to 5 minutes", never an exact duration

What is deliberately absent. There is no user ID, account ID, installation ID, device ID, session ID, or any other identifier, not even a randomly generated or rotating one. There is no timestamp on the events themselves. Your IP address and browser user agent are not stored, and our server's own request logging is switched off so that they are not recorded there either. No design content, HTML, prompt text, file name, Figma file key, node ID, or API key is included.

Why failures are a category, not a message. Error messages routinely quote the thing that failed: a file name, a layer name, a fragment of your markup, sometimes a credential. Collecting them would turn these counters into collection of your content. So the Services classify a failure by its type into one of a fixed list of causes, and send only that. The classification never looks at the message text, so nothing from it can reach us even indirectly.

Why session length is a band. An exact duration is a surprisingly distinctive number, and combined with the date, country and version it would edge towards identifying a particular session. A coarse band such as "5 to 15 minutes" carries the information we actually need — whether the Plugin gets used briefly or for real work — without that risk. A session is measured from opening the Plugin to closing it, and nothing records when it happened beyond the date.

What our server adds. On arrival, our server records the date (in UTC) and the two-letter country that Cloudflare derives from the network connection, then adds the counts to a running daily total. Because no identifier exists, two events from the same person on the same day are indistinguishable from two events from different people. The result is a table of daily totals that cannot be traced back to any individual, which is why we describe it as anonymous rather than merely pseudonymous.

How to switch it off. In the Plugin, use the "Anonymous usage data" toggle, which is available in both MCP and Chat mode. Your choice is stored on your own device and persists between sessions. For the Connector, start it with --no-telemetry, or set AI_TO_DESIGN_TELEMETRY=0. The Connector also honours the standard DO_NOT_TRACK=1 environment variable without being asked.

Hosting and retention. The counters are received and stored by Cloudflare Workers and Cloudflare D1. Because the daily totals contain no personal data, they are kept indefinitely in aggregate form.

From the website: aggregate analytics, only with your consent

In Short: Only if you explicitly consent via the cookie banner does our website send any data to Google Analytics 4.

Until you click "Accept" on the cookie banner, the GA4 script is absent from the page and no analytics data is collected. When you consent, GA4 sets a pseudonymous client identifier (_ga) and collects page views, referrer, device and browser category, and approximate geographic location derived from your IP address (anonymised — your full IP is not stored). GA4 does not receive any name, email address, or other identifier you may have provided to us. See Section 5 for details and how to withdraw consent.

From emails you send us

If you choose to email us at support@ai-to-design.com, we receive your email address and the content of your message. We use this only to reply to you and to comply with any legal record-keeping obligations.

Sensitive information. We do not process sensitive information.

2. HOW DO WE PROCESS INFORMATION?

In Short: To understand which features are used, to reply to emails you send us, and (with your consent) for aggregate website analytics.

  • To understand aggregate product usage. We use the anonymous counters described in Section 1 to decide which features to improve and when an old version can be retired. They are never combined with any other data, because there is no identifier to combine them on.
  • To respond to your inquiries. We read and reply to email messages you send us.
  • To understand aggregate website usage. With your explicit consent, we use Google Analytics 4 to see aggregate, anonymous visit statistics.
  • To comply with legal obligations. Where required by law we may process information to comply with applicable legal requirements (for example retaining email correspondence).

We do not process any data from the Plugin or the Connector because we do not receive any.

3. WHAT LEGAL BASES DO WE RELY ON?

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the legal bases we rely on. For the limited processing described above:

  • Consent (Art. 6(1)(a) GDPR) for analytics cookies via Google Analytics 4. You can withdraw your consent at any time.
  • Legitimate Interests (Art. 6(1)(f) GDPR) for receiving and replying to your emails.
  • Legal Obligations (Art. 6(1)(c) GDPR) where a law requires us to process information, for example retaining records of correspondence.

4. WHEN AND WITH WHOM DO WE SHARE INFORMATION?

In Short: Only with the limited service providers needed to operate the website.

  • Cloudflare, Inc. — hosting and content delivery for the website.
  • Google LLC — Google Analytics 4, only when you have explicitly consented to analytics cookies.

Business transfers. We may share or transfer information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: Only with your explicit consent do we set analytics cookies via Google Analytics 4. No cookies are required for the website to function.

Analytics cookies (Google Analytics 4)

The GA4 script is entirely absent from the page until you actively accept analytics cookies via the cookie banner. We do not use consent-mode defaults or cookieless pings.

The following cookies are set by Google Analytics when you consent:

  • _ga — Expires after 2 years. Distinguishes unique visitors by assigning a randomly generated number as a client identifier.
  • _ga_<container-id> — Expires after 2 years. Stores and updates a unique value for each page visit to maintain session state.

GA4 collects: page URLs and navigation paths, referrer, device type, browser, operating system, and approximate geographic location derived from your IP address (anonymised — your full IP is not stored). No personally identifiable information (name, email, user ID) is sent to Google Analytics.

Data processor: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google is certified under the EU–US Data Privacy Framework. For more information, see Google's Privacy Policy.

You can withdraw your analytics consent at any time by clicking "Cookie Settings" in the footer of any page and toggling analytics off. When you revoke consent, GA4 cookies are cleared immediately and the analytics script is removed from the page.

Storage in the Plugin and the Connector

The Plugin and the Connector set no cookies and use no tracking technology. In connection with the usage counters described in Section 1, the only thing written to your device is a single flag recording that you switched them off, stored in Figma's own plugin storage. It holds no identifier, exists only once you opt out, and is there solely so that your choice survives a restart.

6. HOW DO WE HANDLE YOUR DESIGN CONTENT?

In Short: Your design content never leaves your machine.

The Plugin runs inside Figma. The Connector runs locally on your own computer. They communicate only over your local machine. HTML/CSS content, prompts, screenshots, and design data you work with are never sent to our servers, never stored by us, and never used for any purpose by us — including, but not limited to, analytics, training AI models, or service quality reviews.

7. HOW LONG DO WE KEEP INFORMATION?

Email correspondence is retained for as long as necessary to respond and to comply with legal record-keeping obligations. Analytics data in GA4 is retained under Google's default retention period, subject to your consent.

8. HOW DO WE KEEP INFORMATION SAFE?

Because the Plugin and the Connector run locally, there is no server-side transit of your design content at all. For website traffic and for the anonymous usage counters, we rely on standard transport encryption:

  • All website traffic is delivered over HTTPS.
  • The usage counters are sent over HTTPS to a dedicated endpoint that accepts nothing but the fixed set of fields listed in Section 1 and rejects anything else.
  • The website is hosted on Cloudflare's secure global network.

Despite these safeguards, no electronic transmission over the Internet can be guaranteed to be 100% secure.

9. DO WE COLLECT INFORMATION FROM MINORS?

We do not knowingly collect data from or market to children under 18 years of age. If you become aware of any data we may have received from children under 18, please contact us at support@ai-to-design.com.

10. WHAT ARE YOUR PRIVACY RIGHTS?

In some regions (like the EEA, UK, and Switzerland), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of any personal information we hold about you; (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. You can make such a request by contacting us at support@ai-to-design.com.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent

You can withdraw analytics consent at any time via "Cookie Settings" in the footer, or by contacting us using the details below.

11. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers include a Do-Not-Track ("DNT") feature. At this stage, no uniform standard for recognizing and implementing DNT signals has been finalised, so we do not currently respond to DNT browser signals on the website. Our cookie banner gives you explicit control over analytics regardless of DNT.

The Connector does honour the equivalent command-line convention: if the environment variable DO_NOT_TRACK is set to 1, it sends no usage counters and you do not have to configure anything else.

12. DO WE MAKE UPDATES TO THIS NOTICE?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top.

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at support@ai-to-design.com.