Privacy Policy

Last updated: 3 June 2026

This policy explains what data Repeat Tools (“Repeat”, “we”) collects, how and where it is stored, and who can access it. It covers the Repeat web apps (including the Design System Generator at ds.repeat.tools) and the companion Figma plugin.

What we collect and store

We store only what you create or explicitly choose to sync:

• Your account email address, used for authentication.
• Your design-system projects: design tokens (colors, typography, spacing, radius, shadows, etc.), components, icons and documentation.
• Any Figma Variables, components or icons you explicitly push, pull or import through the plugin — stored in your own project.
• A SHA-256 hash of each Figma device token (never the raw token).

We do not read or collect Figma file content in the background. The plugin only reads from the Figma API when you trigger an explicit push, pull or import action.

How and where data is stored

Data is stored in a managed Supabase PostgreSQL database, and the application is hosted on Vercel. All traffic is transmitted over HTTPS. Your projects are stored as records owned by your authenticated account, isolated per-user with Supabase row-level security, so you can only read or write your own data. Passwords are not stored by us — authentication is delegated to Supabase Auth, which stores them hashed.

Who can access your data

• You. Row-level security ensures one user can never access another user’s data.
• Our backend, server-side only. Privileged operations (e.g. validating a device token) use a Supabase service-role key that is never exposed to the browser or the plugin.
• Subprocessors — Supabase (database and authentication) and Vercel (application hosting) — which process data solely to provide the service.

We do not sell your data or share it with third parties for marketing. We access data only when strictly necessary for support, maintenance, or to comply with the law.

Device tokens & security

The plugin connects using a device token generated in your account with 256 bits of cryptographic randomness. We store only its SHA-256 hash; the raw token is shown to you once and never persisted. Tokens auto-expire after 90 days and can be revoked at any time. Within Figma, the token is kept in Figma’s local clientStorage, scoped to your Figma client.

Data retention & deletion

Data is retained until you delete it. You can delete individual projects and revoke or delete device tokens directly in the app at any time. To delete your entire account and all associated data, email us and we will remove it.

Your rights

You may request access to, correction of, or deletion of your personal data by contacting us at the address below.

Contact

Questions about this policy or your data: info@repeat.tools.