The short version
Your designs never leave Figma. The Fun Lab plugins read your file only to do their work inside Figma, and they never send file content, layer names or the text in your designs anywhere.
The plugins talk to one server of ours, the Fun Lab server (funlab-licenses.aledvascha.workers.dev), for three things only: checking a license key, sending a help request you write, and, only if you allow it, the steps you took in the plugin.
What is sent, and when
License check: when you activate a key, and about once a week after that, the plugin sends the key and your Figma user id. The server keeps only a keyed one-way hash of the id (HMAC-SHA256 with a secret key that never leaves the server, so it cannot be turned back into your id) to count the 2 Figma accounts a key covers.
Help requests: when you press Send in the Help panel, the plugin sends what you wrote, the email you typed, the plugin name and version, and your license state (for example "Lab Pro, key ending in B252").
Steps: off by default. If you turn on "Share my steps" in Help, or tick "Attach the steps from this session" when you send a request, the plugin sends the actions you took (for example "create"), their settings (numbers, switches, colors and short values), the kinds of layers selected (for example "2 FRAME"), how long each action took and any error message.
Fonts: the plugin window loads the Inter and Crimson Pro fonts from Google Fonts. Those requests carry no data from your file.
What is never sent
File content, images, layer names, text from your designs, comments, file names or links, your Figma email, your name, or anything about other people in the file. Text longer than a short value is replaced by its length (for example "text, 200 characters") before anything leaves Figma, and fields named like keys, emails, names or messages are hidden.
What stays on your computer
The plugins keep your license, the number of free runs used, your sharing choice and the last email you used for Help in Figma's own plugin storage on your computer. Boards the plugins draw are marked with plugin data so they can be updated or cleared later. None of this is sent anywhere.
Where it is kept and for how long
Everything the server keeps lives on Cloudflare (Workers, KV and D1), which holds SOC 2 Type II and ISO 27001 certifications. Payments and license keys are handled by Lemon Squeezy, our merchant of record. Help request emails are delivered by Resend.
Steps are deleted after 90 days, unless they are attached to a help request. Help requests and the steps attached to them are deleted 24 months after they are closed. License records last as long as the license.
Nothing is sold, shared with advertisers or used to train AI models.
Who is responsible
Ale's Fun Lab (Alejandro Vasquez) is responsible for the data the plugins send to the Fun Lab server, not Figma. Figma does not receive it and is not responsible for how it is handled. Questions about it go to hi@alevasquez.dev.
Who can see it
Only Alejandro Vasquez, who builds and supports Ale's Fun Lab, through a password-protected admin page. Data is read only to answer help requests, fix bugs and prevent license abuse.
The admin page needs a password and a one-time code sent by email (two factors), sessions expire after 12 hours, and sign-in attempts are limited. Connections are encrypted (HTTPS), requests to the server are rate limited, and license keys, Figma user ids and IP addresses are never stored in readable form.
Your choices and deleting your data
You can turn sharing on or off at any time in Help inside any plugin. To see or delete what we keep about you, email hi@alevasquez.dev from the address you used, or tell us the plugin and roughly when you used it. We delete it within 30 days and confirm by email. Removing a license from a Figma account (Enter license, then Remove) frees that account right away.
Reporting a vulnerability
If you find a security problem in the plugins, the Fun Lab server or this site, email hi@alevasquez.dev with the subject "Security", what you found and how to reproduce it. We confirm we received it within 3 business days, keep you updated, fix critical issues as soon as possible and within 30 days, and credit you if you want.
Please do not access other people’s data, disrupt the service or make a problem public before it is fixed. We will not take action against good-faith research that follows these rules. There is no paid bounty.
If a security incident ever exposed data, we would tell Figma right away and email the people affected as soon as we know what happened, what data was involved and what we are doing about it.