01 · TL;DR
This site is a statically generated marketing page. There are no user accounts, no login, no cookies, and no product data on it. The only telemetry is Vercel Web Analytics, an aggregate pageview counter that sets no cookie and no client-side identifier. There is no advertising and no third-party SDK beyond that.
The plugin is a separate surface: it runs inside Figma and talks to the Figma API and to the sync provider you configure. Your tokens do not pass through any server of ours. The only personal data processed directly is what you voluntarily send through the contact form or by email, plus the standard server logs of the host.
02 · Who's responsible
The data controller in the sense of Art. 4(7) GDPR is:
03 · What data exists, and where it lives
There are two surfaces: this site, hosted at tokens.daes.app, and the Figma plugin, which runs on your machine. What each one handles:
clientStorage on your machineWe never receive a copy of your tokens. The plugin talks to the Figma API and to the provider you configured; there is no intermediate service in that path.
04 · This marketing site
The pages you are reading (tokens.daes.app) are statically generated. Apart from the contact endpoint there is no application code and no database. The host (currently Vercel) writes standard HTTP access logs: IP address, user agent, requested path, response code, timestamp. These are retained by the host for roughly 30 days for abuse and security purposes under Art. 6(1)(f) GDPR (legitimate interest in operating the site).
The site includes Vercel Web Analytics, an aggregate pageview counter. It is cookieless, sets no client-side identifier, and does not use localStorage or browser fingerprinting. Visitors are de-duplicated for the day via a hash of IP and user agent with a daily-rotating salt that Vercel discards; after rotation the hash is unrecoverable. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in basic reach measurement).
Fonts are self-hosted. Next.js downloads Geist and Geist Mono at build time and serves them from this domain, so loading a page makes no request to a font CDN.
05 · The contact form
Submitting the form on /contact sends your name, email address, chosen topic, and message to the controller by email over SMTP. The data is used only to answer you. Legal basis: Art. 6(1)(b) GDPR where your message concerns a potential or existing use of the product, otherwise Art. 6(1)(f) (legitimate interest in responding to enquiries).
The form is protected by a simple arithmetic question and a hidden field that bots tend to fill in. Neither stores anything in your browser. Messages are kept in the controller's mailbox for as long as needed to handle the matter and to meet any retention obligations.
06 · The Figma plugin
The plugin runs inside Figma's plugin sandbox. Your tokens are stored on the Figma file itself. When you connect a sync provider, the access token and repository settings are stored in Figma's clientStorage, scoped to the plugin. Those credentials stay on your machine and are not transmitted to us.
Pushing or pulling tokens is a direct request from the plugin to the provider you configured (for example the GitHub or GitLab API). The plugin does not phone home.
08 · Third parties
The following third parties are involved, either directly or as a result of your own configuration:
If you point the plugin at a remote URL instead of a Git provider, that host sees the plugin's requests in the same way any HTTP server would. Choosing it is your decision, not ours.
09 · Your rights under GDPR
To the limited extent your personal data is processed here, you have the right to:
- Request access (Art. 15)
- Request correction (Art. 16)
- Request deletion (Art. 17)
- Restrict processing (Art. 18)
- Data portability (Art. 20)
- Object to processing (Art. 21)
- Lodge a complaint with a supervisory authority. The competent one is the data protection authority of the controller's federal state
For tokens and files inside your Figma workspace or your repository, those rights are between you and those providers, and we have no access to act on them.
10 · Contact
Privacy questions, deletion requests, or anything else: contact@daes.app. Replies usually take about 24 hours on a weekday.
11 · Changes to this notice
If this notice changes, the version and effective date at the top get bumped. The current version is 1.0, effective July 27, 2026.