Privacy and security

Every plugin in the suite processes your design work entirely on your machine. The only network request any of them can make is a license-key check with Dodo Payments, and that request never carries design data. Both facts are enforced by Figma, not just promised.

Enforced by the platform

Each plugin with a Pro tier declares exactly one reachable domain (Favicon Forge declares none at all):

{
  "networkAccess": {
    "allowedDomains": ["https://live.dodopayments.com"],
    "reasoning": "Validates Pro license keys with the payment provider (Dodo Payments). Only the license key the user enters is sent, never any design data."
  }
}

Figma enforces this declaration at runtime: the plugin is technically unable to contact any other host. Client work, unreleased brands and NDA material never leave your computer. Anyone can confirm this by opening the manifest, and the Community listing shows the same domain.

The one request, in full

Name
Activate
Type
when you paste a key
Description
Sends the license key you typed and a device label (the plugin name and today's date) to Dodo Payments' public license endpoint. Dodo returns a device instance id and the purchase email.
Name
Validate
Type
about once a day
Description
Sends the key and the instance id to confirm the subscription is still active. If you are offline the check is skipped and Pro keeps working for a 7-day grace period.
Name
Deactivate
Type
when you free a seat
Description
Sends the key and instance id so the seat becomes available on another device, then deletes the local record.

If you never buy Pro, the plugin never makes a successful network request at all: there is no key to validate, so the code path is never reached.

What the plugins store

Name
License record
Type
Figma client storage
Description
After activation: the key, its device instance id, the purchase email returned by Dodo Payments, and the last validation timestamp. Stored only on your machine, deleted by Deactivate device.
Name
Presets
Type
Figma client storage
Description
Print Ready's saved PDF presets live in Figma's local storage for the plugin. Nothing syncs to any cloud by the plugins themselves.
Name
Frame metadata
Type
inside your .fig file
Description
Print Ready stores bleed and margin values as plugin data on frames it creates. The data travels with the file and is visible to nobody else.

There are no accounts, no analytics and no telemetry. Purchase data (name, email, payment method, invoices) is handled by Dodo Payments under its own privacy policy; we see the purchase email, subscription status and key activations in the Dodo dashboard and use them only for support.

Auditable by design

Each plugin is plain JavaScript in two files with no dependencies and no build step, so a security review is a straight read of exactly the code that runs. The licensing code is one clearly marked section at the end of code.js, identical across the suite. The automated test suites validate every binary output format byte by byte.