Privacy Policy

Summary

  • TrueUI runs entirely inside Figma. There is no TrueUI server, login, analytics, or sale of data.
  • You connect with your own API key (Anthropic Claude or OpenAI), or with your Claude account through the optional TrueUI Bridge, a small helper that runs only on your computer.
  • Run data goes only to the AI provider you chose. Your key, mappings, settings, and run history stay on your device.

How TrueUI works

TrueUI is a “bring your own key” tool. Your request goes directly from the Figma plugin to the provider you selected, and the returned result is applied to your selected frame using standard Figma plugin APIs.
Claude Account mode (TrueUI Bridge)

Instead of an API key, you can run the open-source TrueUI Bridge in a terminal on your own computer (npx trueui-bridge). The plugin talks to it at localhost:7878, an address that exists only on your machine.
The bridge forwards requests to Anthropic under your own Claude subscription sign-in, stores nothing, and creates no API key. The data sent is identical in both modes; only the authentication differs.

What is sent to your AI provider

When you run TrueUI, it may send: your prompt, the project context you entered (industry and short description), your mapped design system inventory (including connected workspace metadata), reference attachments you provide, and the technical context of the selected frame.
You control this content. Leave the context fields blank, or omit an attachment, and it is not sent. Nothing is sent outside of runs you start.

Third-party AI providers

Anthropic (privacy policy) and OpenAI (privacy policy) are independent third parties. Once sent, your data is handled, retained, and possibly processed in other countries under that provider’s own terms, which we do not control.

You are responsible for having the right to send your file’s content to your chosen provider, especially content belonging to others.

Your keys and local data

Your API key is stored locally in Figma client storage on your device and sent only to its matching provider. It is never sent to TrueUI.
Your mappings, settings, and run history are also stored locally. Remove them in the plugin, or uninstall the plugin, to delete them.

Security tips

  • Do not paste keys while screen sharing.
  • Remove keys from shared machines.
  • You can replace or revoke your key any time in Settings.

Figma file access

TrueUI reads the current file’s structure to index components, variables, and styles, and writes generated output only into the frame you selected. It does not load remote code or execute anything from outside the plugin package.

Network access

The plugin manifest permits only these destinations, enforced by Figma at runtime:

Retention and your rights

TrueUI keeps no server-side copy of anything. Local data persists until you delete it. The bridge holds requests in memory only during a run. Provider-side retention follows that provider’s policy.
Depending on where you live, laws such as GDPR or CCPA/CPRA may give you rights over personal data. For data held by an AI provider, contact that provider. TrueUI itself holds nothing to export or delete, and sells nothing.

Children’s privacy

TrueUI is a professional tool, not directed to children. Do not use it if you are under the age required by Figma or by your AI provider.

Security

TrueUI has no backend, stores keys locally, uses encrypted HTTPS to providers, and can reach only the declared domains plus the local bridge on your machine. No method is perfectly secure; safeguard your keys and choose what you send.

Beta status and changes

TrueUI is in beta, and behavior or documentation may evolve. We will update this policy when the data flow meaningfully changes, with a new effective date. Significant plugin updates may also be re-reviewed by Figma.

Contact

TrueUI is built and maintained by Tomer Gilat.
Email: contact@trueui.app
Latest contact details: https://trueui.app