Privacy Policy

The short version

We collect what’s needed to run Tulpar and bill you, and nothing for advertising. Your designs are used to generate your component and deleted within an hour. Your Figma token is never stored on our servers. We don’t sell personal data.

Who is responsible

Mamuti Aishan, East Providence, Rhode Island, USA, operates Tulpar and is responsible for your data. Contact: hmamut39@gmail.com.

What we collect

• Your GitHub account: your GitHub ID, username, name and primary verified email, when you sign in.
• Your plan: trial or Pro, how many generations you’ve used, and, if you subscribe, your Stripe customer ID and subscription status. Your card details go to Stripe and never reach us.
• What you submit for a run: the screenshot or Figma frame, the component name and the design system you chose.
• Run records: for each generation, the time, design system, kind of input, result, number of attempts, AI tokens used, duration and your username. These help us run the service and see what it costs. They don’t contain your design, your code or your Figma token.
• Technical data: your IP address is used briefly, in memory, to enforce rate limits. Our hosting provider may keep standard access logs.

How long we keep it

• Screenshots and generated code: kept in memory while your run is shown, and deleted within one hour. Working files on disk are deleted when the run finishes.
• Figma frames: to avoid reading the same frame from Figma again, frame data (its structure and text) may be cached on our server. Ask us and we’ll delete it.
• Your Figma token: used for your run only and never stored on our servers. If you tick “Remember in this browser”, it is stored in your own browser only.
• Account and plan data: kept while your account exists. Ask us to delete it at any time; Stripe keeps billing records as the law requires.
• Design systems you add from npm: these are public packages, kept so everyone can use them.

Who else receives data

• OpenAI receives your design and the instructions for writing the component, to generate it. We send requests with storage turned off, and under OpenAI’s API terms this data isn’t used to train its models.
• Figma receives the request for the frame you link, made with your token or ours.
• GitHub handles sign-in. Stripe handles payments. Fly.io hosts Tulpar in the United States. Cloudflare provides the domain’s DNS.
• Google Fonts: the site loads its font from Google, which receives your IP address when it does.

We don’t sell personal data or use it for advertising. We only disclose it if the law requires.

Cookies and browser storage

Two cookies, both needed for sign-in: tulpar_session keeps you signed in (30 days), and tulpar_oauth_state protects the sign-in step (10 minutes). Your browser also remembers your framework choice and, only if you ask, your Figma token. There are no advertising or analytics trackers.

Your rights

Wherever you live, you can ask for a copy of your data, to correct it, or to delete it, by writing to hmamut39@gmail.com. We answer within 30 days. Depending on where you live (for example in the EU, the UK or California), you may have further rights, including complaining to your data-protection authority.

Where data is processed

Tulpar and its providers process data in the United States. If you use Tulpar from elsewhere, your data is transferred there.

Children

Tulpar isn’t meant for anyone under 16, and we don’t knowingly collect their data.

Changes

If we change how we handle data in a way that matters, we’ll say so on the site before it applies.