Privacy Policy

1. Introduction

This Privacy Policy describes how PixToCode (operated by Zarko Savic, based in Uzice, Serbia) ("we", "us", "our") collects, uses, and protects your personal information when you use our Figma plugin and website at pixtocode.com ("Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address when you sign up
• Payment Information: Processed by Lemon Squeezy (our Merchant of Record) — we never see or store your credit card details
• Figma Content: Design files (PNG images and structural data) you submit to be converted to code
• Refine Instructions: Plain-English prompts you type when refining previously generated code
• Team Seat Emails: If you subscribe to the Team plan, the email addresses you add to your seat whitelist are stored so we can authorise plugin access for those members. Soft-deleted seats retain their per-seat free-retry counter to prevent rotation abuse.
• Project Context — GitHub Connection (optional): If you connect a GitHub repository through our GitHub App ("pixtocode-context"), we store the installation identifier, the selected repository name and default branch, and the design tokens + path aliases extracted from the repository's stylesheets (e.g. tokens.css, theme.scss, tailwind.config) and tsconfig.json. The GitHub App private key is never stored in our database — it lives only in Vercel encrypted environment variables and is used at request time to mint short-lived (1 hour) installation tokens. We request contents:read and metadata:read scopes only; we cannot push, modify, or delete anything in your repository.
• Project Context — Manual Tokens (optional): If you prefer not to connect GitHub, you can paste a JSON blob of design tokens directly on the dashboard. We store that JSON in the same database row as a GitHub-derived context, with a marker indicating it came from manual entry rather than a repository scan.
• Project Context — Custom Stylesheet Paths (optional): If you tell us which additional paths in your repository contain stylesheets, we store that list and rescan those files when you trigger a refresh.

2.2 Information Collected Automatically

• Usage Data: Number of code generations, frameworks used, UI library preset chosen, timestamps
• Generation History: When you generate code while signed in, the plugin saves a history entry containing the resulting code, the framework, the UI library preset, your custom prompt, the source frame's name and dimensions, and a small JPEG thumbnail (≤512px) of the source frame. Entries are visible only inside your account.
• Subscription Metadata: Lemon Squeezy subscription and customer identifiers, the customer portal URL Lemon Squeezy generates for self-service billing, current and pending seat tiers for Team accounts, and renewal dates. Used to display your billing status on the dashboard and apply scheduled downgrades at the next renewal.
• Card Display Data: The brand (e.g. "visa") and last four digits of the card on file. These come from Lemon Squeezy on request and are shown on the dashboard so you can confirm which card will be charged. We never see, store, or process full card numbers, expiry dates, or CVVs — that data lives only with Lemon Squeezy as our PCI-DSS Level 1 Merchant of Record.
• Technical Data: IP address, browser type, Figma client ID (for anonymous trial tracking)
• Authentication Cookies: Session tokens via Supabase Auth (for logged-in users only)

3. How We Use Your Information

We use your information to:

• Provide the code generation service
• Track usage against your subscription plan limits
• Process payments through Lemon Squeezy
• Send essential account and billing emails
• Prevent abuse and enforce rate limits
• Improve the Service quality

4. Third-Party Services

We use the following third-party services to operate PixToCode:

• Supabase — Authentication, database, and history storage (servers in Ireland, EU)
• Vercel — Web hosting
• Anthropic (Claude AI) — AI processing of your design files to generate and refine code. If you have an active Project Context, we include the extracted design tokens and path aliases as part of the prompt so generated code matches your project's conventions; the request never contains your GitHub installation token, your repository's source code, or any raw file contents — only the parsed token/alias summary.
• GitHub — Optional. Only used if you connect a repository through our "pixtocode-context" GitHub App. We call the public GitHub API to list and read stylesheet/config files in the repository you authorised, and we sign the requests with short-lived installation tokens minted on demand. We do not call GitHub for users who have not connected a repository.
• Lemon Squeezy — Payment processing and billing (Merchant of Record)
• Resend — Transactional emails
• Cloudflare — DNS and email routing
• Google Analytics — Website usage analytics, loaded only after you accept analytics cookies (see the Cookies section below). Not used in the Figma plugin.
• esm.sh, unpkg, jsDelivr — Public CDNs used by the "Preview in browser" iframe to load React, Tailwind, and related runtime libraries. No PixToCode account data is sent.
• CodeSandbox — Optional. When you click "Preview in browser" for an Angular component, or for React output that targets Material UI, Chakra UI, Ant Design, or shadcn/ui, the generated component code is sent to CodeSandbox via their public Sandbox Define API so a sandboxed playground can boot. No PixToCode session, license key, or email is sent.

Each provider has their own privacy policy. We only share the minimum data necessary for each service to function.

5. How Long We Keep Your Data

• Submitted Designs (PNG + structure): Sent to Anthropic for processing. The raw PNG is not permanently stored on our servers; a small JPEG thumbnail derived from it is saved with the corresponding history entry (see below) so the entry remains recognisable.
• Generated Code & History Entries: Each generation creates a history entry (code, framework, UI library preset, custom prompt, thumbnail, frame name and dimensions). Entries are stored in your account in our Supabase database (Ireland, EU) so you can revisit, copy, or load them back into the plugin. For individual plans, we keep your last 20 history entries. For the Team plan, history is bucketed per seat email — each seat (including the admin's own email) keeps its own 20 most recent entries; older entries are dropped automatically as new ones come in. You can also delete individual entries from the plugin's History tab at any time, and deleting your account removes all entries immediately.
• Refine Inputs: The plain-English instructions you submit when refining code are sent to Anthropic with the existing code and are not stored on our servers as standalone records.
• Project Context Records: Repository identifier, default branch, scanned file paths, parsed design tokens, path aliases, and any manually pasted token JSON are stored in your account in the project_contexts table until you disconnect the integration (Disconnect button on the dashboard), clear your manual tokens, or delete your account. Disconnecting also revokes our installation token, removes the row, and stops any further scans for that account.
• Account Data: Kept while your account is active, plus 30 days after deletion
• Usage Logs: Retained for 12 months for billing and fraud prevention
• Payment Records: Retained as required by tax law (typically 7 years)

6. Your Rights (GDPR / CCPA)

You have the right to:

• Access: Request a copy of your personal data
• Correction: Correct inaccurate data
• Deletion: Request deletion of your account and data
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing activities
• Withdraw Consent: Withdraw consent at any time

To exercise any of these rights, email us at support@pixtocode.com. We will respond within 30 days.

7. Data Security

We implement industry-standard security measures including HTTPS encryption, secure password hashing, and row-level security on our database. However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

For the GitHub integration specifically: the GitHub App private key is held only in Vercel encrypted environment variables — never written to our database, never logged, and never returned in any HTTP response. Installation tokens are short-lived (≈1 hour), minted just-in-time per request, and never persisted. The GitHub App is configured with read-only permissions (contents:read, metadata:read) so a credential leak on our side could not be used to push code or alter your repository. The install handshake is protected by a single-use state token to prevent CSRF, and each project_contexts row is bound to its owner via Postgres row-level security so other accounts cannot read it.

7a. Internal Support Actions

In limited situations — typically when you ask us to apply a refund or fix a billing edge case that Lemon Squeezy can't roll back automatically — a member of our staff may make changes to your account on your behalf (for example, force-downgrading a Team subscription back to its previous seat tier). Every such action is recorded in an internal audit log (admin_actions) capturing the staff email, the action, the affected account, the change applied, and the reason. The audit log is used solely for accountability and is retained for at least 12 months.

8. Cookies

We use essential cookies for authentication (session management) via Supabase Auth. These are always active and required for the Service to work.

With your consent, we also use Google Analytics to understand how the website is used (for example, which pages are visited and which features are popular). Google Analytics sets its own cookies. We ask for your consent through a banner the first time you visit, and analytics cookies are onlyset if you click "Accept". If you decline, no analytics cookies are stored and Google Analytics is not loaded. You can change your choice at any time by clearing your browser's site data for pixtocode.com. We do not use advertising cookies and we do not sell your data.

9. Children's Privacy

PixToCode is not intended for users under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us data, please contact support@pixtocode.com.

10. International Data Transfers

Your data may be transferred to and processed in countries outside of your country of residence, including the United States (Anthropic, Vercel, GitHub) and European Union (Supabase, Lemon Squeezy). We ensure appropriate safeguards are in place for such transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by email and by updating the "Last updated" date above.

12. Contact Us

For privacy questions or requests, contact: