Skip to content

FISYCO

Public beta

Privacy Policy

Version 1 · in effect since November 7, 2026

1. Overview

This Privacy Policy explains how FISYCO ("Service") collects, uses, and processes personal data.

2. Data We Collect

Account Information

  • Email address
  • Name
  • Workspace information

OAuth Data

  • Access tokens
  • Repository metadata
  • File metadata

Code and Design Data

With your authorization the Service reads files from your connected repositories and Figma files at a single commit or version. From them it keeps an index of facts — component names, props, styles, design token usage and the differences between design and code — not copies of your files. Every read of your code is listed in an access log that you can see for 90 days. Short excerpts of source code are sent to an AI provider only by the features described in section 6.

Generated Data

  • Pull request metadata
  • Synchronization logs
  • Drift detection results

Uploaded / Stored Files

  • Screenshots
  • Avatars
  • Preview assets

Technical Data

  • IP address
  • Browser type
  • Usage logs

Blog Newsletter

Subscribing to the blog newsletter is optional and separate from a FISYCO account. For each subscriber we store:

  • Email address
  • Language of the subscription
  • Which form was used (an article page or the blog index)
  • Timestamps for the consent, the confirmation email, the confirmation itself, and the unsubscribe
  • The confirmation link token, kept only as a fingerprint and replaced whenever a new subscription request is made, and the unsubscribe link token, which can only unsubscribe that one address

We do not store the IP address or browser of a subscriber. Subscriptions use double opt-in: no newsletter is sent until the address is confirmed from the link in the confirmation email. Every newsletter carries an unsubscribe link that needs no account and no password.

3. Payment Data

The Service is free during the public beta and no payment provider is connected, so no payment data is collected. If paid plans are introduced, this Policy will be updated to name the payment provider before any payment is taken.

4. How We Use Data

We use collected data to:

  • Provide the Service
  • Generate pull requests
  • Detect design and repository changes
  • Authenticate users
  • Improve system functionality
  • Ensure system security

We do not sell user data.

5. Sub-processors and Infrastructure Providers

We rely on the following third-party sub-processors to operate the Service. Each processes only the data required for its function, and integrations are activated only with your authorization.

  • Render.com — application hosting, the PostgreSQL database and Redis (background job queues and caching), all in the United States (Oregon)
  • Cloudflare R2 — file and asset storage
  • OpenAI — AI-assisted features described in section 6, through the OpenAI API
  • Sentry — error tracking for our servers; request bodies, headers, cookies, user details and AI inputs and outputs are not sent to it
  • Resend — delivery of transactional email, such as address confirmation, password reset, workspace invitations and blog newsletter messages
  • Cloudflare Web Analytics — aggregate usage measurement on our public pages; it sets no cookies and does not track visitors across sites
  • Google — Google Analytics on our public pages, loaded only after analytics cookies are accepted and never before. Advertising uses are switched off: Google signals and the collection of user-provided data are disabled, and the advertising consent types stay denied permanently
  • Google — sign-in with a Google account (OAuth), when you choose it
  • GitHub, GitLab.com, Bitbucket Cloud — sign-in and repository integrations (OAuth and app installations)
  • Figma — design source integration (OAuth tokens, file and component metadata)
  • Slack — only if you add a Slack notification channel; notifications are posted to the Slack workspace you choose

OAuth integrations operate only with user authorization.

6. AI-Assisted Processing

Some features of the Service use a large language model. The model provider is OpenAI, called through the OpenAI API. FISYCO sends it only what each feature needs:

  • Component health analysis — after each index of a connected codebase, and when you re-run it: the component’s name and file path, its computed health facts (metric values, accessibility findings, design-versus-code style differences, token usage), and the component’s declaration file, cut to 24,000 characters.
  • Variant matching — after each index: component and property names, Figma variant names and values, and the names, types and values of the component’s props in code. No source code is sent.
  • Change summaries — when a synced Figma component changes noticeably: the component name and the list of changed properties with their old and new values and token names. When you create a pull request for a library run: the library name, the counts of added, changed and removed assets and up to five asset names per group. No source code is sent.
  • Design patches — only when you set a code connection to fix differences automatically: the component’s source files (up to six), the design differences to fix and the conventions of your repository. The result is offered as a pull request for your review.

Under OpenAI’s API terms, data sent through the API is not used to train OpenAI models; OpenAI may keep it for up to 30 days to monitor abuse. FISYCO stores the results — health summaries and recommendations, variant-matching proposals, change summaries and proposed patches — together with the facts they were made from, but not the source code that was sent. Results are deleted with the code connection, project or workspace they belong to.

Design patches run only when you turn them on for a code connection. Health analysis and variant matching run for every connected codebase and can be switched off for your workspace on request to privacy@fisyco.com. Change summaries contain design metadata only and run for every synced library.

7. Data Retention

Data is retained only while the account is active.

The code access log is kept for 90 days. Results of AI-assisted features are kept until the code connection, project or workspace they belong to is deleted.

Google Analytics event data is kept for 14 months and then deleted by Google. Its cookies — _ga and _ga_* — are deleted as soon as analytics cookies are declined, which can be done at any time on our Cookie Policy page. Page addresses are sent to it without their query string, and no event carries anything that identifies a person.

A newsletter subscription is kept until it is cancelled. After an unsubscribe we keep the record, marked with the time of the unsubscribe, so that an old link cannot subscribe the address again; it is removed entirely on request to privacy@fisyco.com. An address that is never confirmed is deleted after 30 days: nobody consented to it, and the confirmation link stops working long before that.

Upon account deletion, associated data is permanently deleted from our systems without retention, except where required by law. As part of deletion we also, on a best-effort basis, remove the third-party webhooks we created and delete stored integration assets. Where the provider supports it (for example GitHub and GitLab), we revoke the OAuth access tokens we held; for providers that do not offer a token-revocation API (for example Figma and Bitbucket), the tokens are deleted from our systems and expire according to the provider.

8. Security

We implement:

  • Encrypted connections (HTTPS)
  • Secure storage of OAuth tokens
  • Access control mechanisms

9. User Rights

Users may request:

  • Access to their data
  • Correction of inaccurate data
  • Deletion of personal data

Requests may be submitted to privacy@fisyco.com.

10. International Transfers

Our servers and databases are hosted in the United States. Data may also be processed outside the user’s country in other jurisdictions where our sub-processors and infrastructure providers operate. Where data is transferred internationally, we rely on the safeguards and contractual terms offered by those providers.

11. Changes to This Policy

We may update this Privacy Policy periodically. Continued use of the Service after updates constitutes acceptance of the revised Policy.

12. Contact

  • privacy@fisyco.com
  • legal@fisyco.com