privacy

Personal Data

We collect the following personal information when you use exporthub and connect your Google account:

• Name (via Google OAuth profile)
• Email address (via Google OAuth profile)
• OAuth tokens to access Google Drive on your behalf

Your OAuth tokens are heavily encrypted at rest using AES-256-GCM. We do not require or collect payment information for the free version of this Service.

Non-Personal Data

We may collect non-personal information automatically to ensure the Service functions correctly, including:

• Browser type and Figma client version
• Service usage data (e.g., number of successful exports for rate-limiting purposes)
• Diagnostic error logs

We use the collected information exclusively to:

• Provide, operate, and maintain the exporthub plugin and backend API
• Facilitate the upload of your exported Figma frames to your Google Drive
• Communicate with you regarding support or critical Service updates
• Enforce fair-use rate limits to protect our infrastructure
• Comply with legal obligations

We do not read, view, or modify any existing files in your Google Drive. We only use our access to upload the files you explicitly choose to export via the plugin.

We use standard local storage mechanisms (such as Figma's `clientStorage` API and HTTP cookies for our web authentication dashboard) to:

• Maintain your active session so you don't have to repeatedly sign in
• Remember your selected Google Drive destination folder

You can clear this storage at any time by signing out from the exporthub plugin interface.

We do not sell your personal data. We may share your information only with:

• Trusted third-party infrastructure providers (e.g., Vercel, MongoDB Atlas) required to host and operate the Service
• Legal authorities when strictly required by law or to protect our rights

All infrastructure partners are required to handle data securely and in compliance with applicable privacy laws.

We retain your personal data and OAuth tokens only as long as you maintain an active account with us. We use this data strictly to provide the Service.

If you disconnect your Google Drive account via the exporthub plugin, your associated OAuth tokens are immediately deleted from our database.

We take data security very seriously. All communication between the plugin, our backend, and Google APIs happens over secure HTTPS connections. Sensitive data, including Google Drive access and refresh tokens, are encrypted at rest using industry-standard AES-256-GCM encryption.

However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Depending on your location, you may have rights under applicable data protection laws, including:

• The right to access your personal data
• The right to correct inaccurate data
• The right to request deletion of your data (which can be done by disconnecting your account via the plugin)
• The right to object to or restrict processing

You can also manage or revoke exporthub's access to your Google account at any time via your Google Account Permissions dashboard.

We may update this Privacy Policy from time to time. When we do:

• We will update the "last updated" date at the top of this page
• Significant updates will be posted on this page or communicated via email
• Continued use of the Service constitutes acceptance of the updated Privacy Policy

If you have any questions about this Privacy Policy or how your data is handled, please contact us at: support@nullab.io

By using exporthub, you acknowledge that you have read and understood this Privacy Policy.