This Privacy Policy explains how DS source(“we”, “us”), the service at designsource.app, collects, uses, stores and shares personal information when you use the website, the Figma plugin and the designsource command-line tool. DS source turns a prompt into a design system: colour ramps, semantic roles, component tokens, a live preview and exports for code and Figma. Last updated .
Who we are
DS source is run by the maintainer of designsource.app, who is the data controller for the personal information described here. You can reach us at support@designsource.app.
Information we collect
We collect only what the service needs to work. Nothing is collected for advertising or profiling.
- Account information.Your email address, and a hash of your password if you sign up with one. Passwords are never stored in clear text. If you sign in with GitHub or Google we receive your email address, display name and avatar image from that provider, and we store the provider's account id and the access token it issues so the link can be recognised next time.
- Content you create. Your projects: every design token (name, tier, value and references), the AI-generated page layout if any, project names, and the project token you can use to connect the Figma plugin or the command-line tool. Your prompts to the AI and the questions you ask it are sent to the model provider as described below; the conversation itself is kept only in your browser session.
- AI provider keys. AI generation runs on API keys you create with the model providers you choose — Anthropic, OpenAI or Google — billed by them to you. We store each key encrypted with AES-256-GCM, decrypt it only for the moment a request to that provider is sent, and never return it to your browser. You can replace or remove a key at any time from your profile.
- Technical information. Our hosting provider records standard server logs (IP address, request time, requested URL, browser user agent) to operate and secure the service. We run no analytics, no tracking pixels and no advertising scripts.
How we use your information
- To create and secure your account and let you sign in.
- To store your projects and show them back to you, in the web app, the Figma plugin and the command-line tool.
- To generate design systems and answer your questions through the AI model you pick, using your own API key for that model's provider.
- To notify you about your account when something requires it, such as a sign-in problem. We send no marketing email.
- To keep the service running, debug failures and prevent abuse.
Our legal bases under the GDPR are performance of the contract with you (running the service you signed up for) and our legitimate interest in keeping it secure. We do not use your information for any purpose that is not listed here, and we do not sell it.
Who else sees your information
We share personal information only with the providers below, only to the extent needed to deliver the service, and never for their own marketing.
- AI model providers(Anthropic, OpenAI, Google). When you ask the AI for something, your prompt, the recipe or tokens it needs to see, and your own API key for the provider you picked go to that provider and to no other. That provider's privacy policy governs what happens there.
- GitHub and Google, only if you choose to sign in with them. They tell us your email, name and avatar; we tell them nothing about your projects.
- Vercel hosts the application and Neon hosts the database, both in Frankfurt, Germany (EU). They process data solely to host the service on our behalf.
- Paddle (Paddle.com Market Limited), our merchant of record, if you buy credits. They take the payment as the seller of record, so your card details go to them and never to us — we never see, hold or store a card number. They tell us that a purchase succeeded, for which account, and for how much, which is what credits the wallet. Their privacy policy governs what happens on their side.
- Figma, when you use the plugin: the plugin runs inside Figma and reads your project's tokens with the project token you paste into it. The command-line tool does the same on your machine. Regenerating the project token in project settings cuts off every copy of the old one.
We may also disclose information if required by law, or to protect the rights and safety of users and of the service.
Google user data
If you sign in with Google, the app requests Google's openid, email and profilescopes and nothing else. Google's API Services User Data Policy requires us to say plainly how that data is handled, so:
- What we access.Your Google account's email address, display name, profile picture URL and the account's Google id. Nothing from Gmail, Drive, Calendar or any other Google service.
- How we use it. To create your account, sign you in, show your name and picture in the app, and email you about your account when something requires it. Nothing else.
- How we store it. In our database in Frankfurt, encrypted at rest by the provider and in transit with HTTPS. The OAuth access token Google issues is stored so the link can be recognised; it is never shown to you or to anyone else.
- Who we share it with. Nobody. Google user data never leaves the service and is never sent to the AI model providers, Figma or any other third party. Our hosting providers process it only to run the service for us.
- How long we keep it, and how to delete it.For as long as your account or the Google link exists. Remove the Google link on the profile page and the provider account record and its token are deleted at once; delete your account and everything goes with it. You can also revoke our access from your Google Account's third-party connections page at any time.
- What we never do with it. We do not use Google user data for advertising of any kind, do not sell it or share it with data brokers, do not use it to assess creditworthiness or for lending, do not use it to train machine-learning or AI models, and do not transfer it to anyone for any of those purposes.
The same rules apply to the email, name and avatar we receive when you sign in with GitHub.
International transfers
Your data is stored in the EU (Frankfurt). AI requests go to the model provider you chose, which may process them in the United States or elsewhere; that transfer happens only when you ask the AI for something, and only for what that request needs.
How long we keep it
Account and project data are kept for as long as your account exists. Deleting a project removes its tokens and generated page immediately. Deleting your account removes everything described above, including every encrypted API key and provider link, immediately and permanently; there is no recovery period. Server logs are retained by our hosting provider for a short rolling window and then discarded.
Your rights and choices
- Access and portability. Every project can be exported from the app at any time as JSON and CSS, which together contain all the content you created.
- Correction. Your name and email can be changed on the profile page; tokens and projects can be edited at will.
- Deletion.Delete a project from its settings, or your whole account from the profile page. To also revoke a key at its provider, delete it in that provider's console.
- Disconnecting providers. GitHub and Google links, and each stored AI provider key, can be removed on the profile page without deleting the account.
- Complaints. If you are in the EU or UK you may also complain to your local data protection authority.
To exercise any of these rights, or for anything the app does not let you do yourself, write to support@designsource.app.
Security
All traffic is encrypted in transit with HTTPS. Passwords are hashed with bcrypt. AI provider keys are encrypted at rest with AES-256-GCM using a key that lives only in the server environment. Access to projects is checked on every request against the account that owns them. No method is perfect, so if you believe your account has been compromised, regenerate your project tokens and change your password at once.
Cookies and browser storage
We set one cookie: the signed session that keeps you logged in. It contains no tracking identifier and is not shared with anyone. The browser's localStorage keeps a few conveniences on your own device only, never sent to us: a paused creation flow so you can resume it, the AI model you last picked, and a prompt you typed but had not yet submitted. Clearing your browser data removes them.
Children
The service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
When this policy changes, the text and the date at the top change with it. Continuing to use the service after a change means the new text applies.
Contact
Questions about your data or this policy: support@designsource.app.