Privacy

Last updated: August 12, 2026

The plugin

Legibly analyzes and fixes your designs entirely inside Figma, on your machine. Your layers, colors, styles, and variables are never uploaded to us. There is no server that receives your design data, and scanning and fixing work without an account.

The network is used for exactly one thing: checking whether you have a Pro licence. The plugin's Figma manifest declares "allowedDomains": ["https://api.legibly.design"], which Figma enforces — the plugin cannot reach any other host, ours or anyone else's. You can read that line in the manifest before you install it, and we would rather you did.

If you never buy Pro, the plugin never contacts us at all.

If you connect and buy Pro

Connecting uses Figma's own sign-in with the current_user:read scope — the narrowest one there is. It lets us read your Figma user id and nothing else: not your files, not your teams. We never see your Figma password, and the access token Figma issues is used once to read that id and then discarded rather than stored.

  • What we store: your Figma user id, the email address you give the payment form, which plan you bought, and the dates your licence runs between. A record of each payment notification — its transaction and order reference, status and amount — so a repeated notification cannot charge you twice.
  • What we never store: anything from your designs. No layers, no images, no measurements, no file names.
  • Usage records: so we can tell whether anyone is using Legibly, we keep a line saying that your licence was checked on a given day, that a checkout was started, paid, refused or refunded. Each line holds the date, your Figma user id, which of those events it was, and whether it succeeded — nothing else. A licence check writes at most one line per day, however many times you open the plugin.
  • Card details: handled by Flitt, a PCI-DSS Level 1 payment provider, and never seen by us.
  • Buying on this website: signing in with Figma here sets one cookie, lgb_session, on api.legibly.design. It holds a signed token with your Figma user id, cannot be read by any script, and expires after 24 hours or when you sign out. A second cookie, lgb_oauth, lasts the ten minutes of the sign-in and only proves that the sign-in began in your browser. Both are strictly necessary for the purchase you asked for, and nothing else is set.
  • Legal basis (GDPR Art. 6): performance of our contract with you — we cannot give you the licence you paid for without recording that you have one.
  • Legal basis for the usage records (GDPR Art. 6): our legitimate interest in knowing whether the product works and is used. They are read by us alone, are never combined into a profile, and are never sold or shared.
  • Retention: the licence record is kept while the licence runs and afterwards for as long as tax and accounting law requires us to keep proof of the sale.
  • Rate limiting: our API counts requests per IP address for ten minutes at a time so it cannot be hammered. Those counters expire on their own and are not used for anything else.

There is no account to create, no password to choose, and no profile behind any of this. Your Figma user id is the only identifier we hold.

This website

The site does not use advertising trackers or third-party analytics cookies, and it collects nothing of its own. The only data it handles is the Figma sign-in and checkout described above.

Who else touches this data

  • Vercel — hosts this website and our licence API.
  • Flitt — takes the payment and tells our API that it succeeded.
  • Resend — delivers the emails we send you, such as replies from billing@legibly.design.

That is the whole list. There is no analytics service, no error tracker, and no advertising network in the plugin or on this site.

Your rights

If you are in the EU, EEA, or UK you have the right to access, rectify, erase, restrict, and port your data, and to object to processing. Write to hello@legibly.design and we will answer within 30 days. You also have the right to complain to your national data protection authority.

Contact

The data controller is Glinc, a project of Giorgi Lomidze, registered in Georgia as an Individual Entrepreneur. Registered address: Georgia, Shida Kartli, Khashuri, Borjomis st. N 106.

Questions about this policy, or any request above: hello@legibly.design.