Privacy
There is no server, so there is nothing to leak.
Last updated 2 August 2026
The short version
- When you capture a page, it goes from your browser straight to Figma's API. It doesn't pass through a server of mine, because I don't run one.
- Your Figma access token stays in your browser. I never receive it and couldn't read it if I wanted to.
- I don't sell anything, don't run ad trackers, and never use what you capture to train a model. Mimic isn't AI — it reads the DOM.
Who I am
I'm the person who builds Mimic — a Chrome extension that turns a web page into editable Figma layers. It's a one-person project. When this policy says "I", that's who's responsible for it, and the address at the bottom reaches me directly.
What the extension reads
When you press capture, Mimic reads the page currently open in that tab: the text, the computed CSS, the layout geometry, the inline SVG markup, the fonts in use, and the URLs of any images. That's the same information your browser already used to paint the page. It's how the export can be pixel-accurate instead of approximate.
To make that work on any site, part of the extension loads on every page you open. I'd rather tell you that outright than have you find it in the manifest. It sits idle until you press capture — it doesn't read, transmit or store anything from pages you never capture, and it builds no record of where you've been.
Mimic can also see the addresses and titles of your open tabs. That's what lets it name a capture after the page it came from and send the result to the right place. It stays on your machine; there is nowhere for it to be sent.
When you do capture, the result goes to one of two places, both of them yours: Figma's API, using the credentials you supplied, to build the file you picked — or a file saved to your own computer, if you export instead. It doesn't go anywhere else, and I keep no copy.
Your Figma access token
Mimic needs a Figma personal access token to write layers into your file. You paste it into the extension, and it's stored in your browser's local extension storage on your own machine. It's used for one thing: signing the requests that create your layers.
I never receive it — there's no endpoint of mine for it to be sent to. You can revoke it at any time from your Figma account settings, which immediately stops the extension from being able to write anything.
Pages behind a login
Mimic can capture applications you're signed into, because it works with the session your browser already has. You never type a password into the extension, and it never handles your credentials. It has no idea who you're logged in as — it just reads what's on screen.
Worth being blunt about: if sensitive data is visible on the page, it's visible to the capture too. That's what redaction is for.
Redaction happens before anything leaves
You can mark elements for redaction, and that runs inside the capture, not as a cleanup pass afterwards. The redacted content is never part of the payload sent to Figma — it isn't uploaded and then hidden, it simply isn't in the file.
This matters for anyone capturing customer records, internal dashboards, healthcare or finance screens. The redaction can't be undone by someone who later opens the Figma file, because the underlying data was never in it.
The website
mimic-it.design has no analytics, no cookies, no tracking pixels, and no third-party scripts. The demo video is served from this same domain rather than embedded from a video platform, specifically so that watching it doesn't hand your visit to anyone else.
The site is hosted on Netlify, which keeps standard server access logs (IP address, timestamp, browser user agent) for security and abuse handling. That's Netlify's infrastructure logging, not something I query or build profiles from.
Who else is involved
Three services, each doing one job:
| Service | What it does | What it sees |
|---|---|---|
| Figma | Receives your capture and creates the layers | The page you captured, under your own Figma account |
| Lemon Squeezy | Handles checkout as merchant of record | Your payment details, name, email, billing country |
| Brevo | Sends the occasional build-notes email | Your email address, only if you typed it in |
On payment: I never see your card number. Lemon Squeezy processes the transaction and passes me a receipt record — your name, email, and country, which is what's needed for support and sales tax. On email: every message has an unsubscribe link, and unsubscribing removes you from the list rather than muting you.
What I don't do
Stated plainly, because these are the questions worth asking of any capture tool:
- I don't sell or rent your data to anyone, ever.
- I don't share it with advertisers, data brokers, or ad networks.
- I don't use your captures — or anything else you do in the extension — to train machine learning models. Mimic is deterministic DOM extraction; there is no model in the pipeline to train.
- I don't build behavioural profiles, and I don't record your screen or session.
- I don't use your data to determine creditworthiness or for lending purposes.
Those last points are also my declaration under the Chrome Web Store's Limited Use requirements, which govern how extensions may handle what they access.
Deleting your data
Most of it isn't mine to delete, which is the point. Everything the extension stores — your token, your settings, your export count, and the font data it caches so repeat captures don't re-parse the same typefaces — lives in your browser on your own machine. Uninstalling the extension removes all of it. You can also clear it from Chrome's extension settings without uninstalling.
Anything you exported as a file is an ordinary download sitting in your downloads folder. It's yours, I never saw it, and deleting it is between you and your operating system.
For the two things that do sit with a third party: unsubscribe removes you from the email list, and emailing me will get your Brevo record and your Lemon Squeezy customer record deleted, minus the invoice data that tax law requires be kept.
If you're in the EU or UK, GDPR gives you the right to access, correct, export, or erase your data, and to object to how it's processed. In California, the CCPA gives you comparable rights, including the right to know what's collected and to opt out of its sale — which is simple here, because nothing is sold. Email me and I'll handle it; I don't charge for requests and I don't require you to prove anything beyond controlling the address in question.
Children
Mimic is a professional design tool and isn't directed at children. I don't knowingly collect anything from anyone under 16.
Changes
If this policy changes in a way that affects what's collected or where it goes, I'll update the date at the top and say so in the build notes rather than quietly editing the page. The version you agreed to is the one that was live when you installed.
Contact
Privacy questions, deletion requests, or anything in here that reads as vague: hello@mimic-it.design. It's a real inbox and I answer it myself.