Privacy Policy

Zero asset retention

Layout constraints are solved in ephemeral server memory over encrypted TLS 1.3. We never store, log, or database your inspected designs, components, or website content.

Enterprise and staging safe

Engineered for confidential staging environments, internal design systems, localhost dev servers, and private Figma files. Nothing you inspect is stored or logged on our servers.

Sandboxed local storage

Component Vault bookmarks, saved color swatches, and offline license tokens reside exclusively inside your browser’s sandboxed chrome.storage.local.

Manifest V3 strict

Zero remote script injection, zero dynamic eval(), and zero background activity without user invocation. Built under Chrome security mandates.

Kutor Labs (“we”, “our”, or “us”) is dedicated to safeguarding user privacy. This Privacy Policy governs your use of Moa: Web to Figma & Design Inspector on Google Chrome.

1. Core principle: ephemeral cloud compilation

Moa operates on a strict ephemeral processing, zero-retention architecture. Heavy DOM constraint graph solving and Auto-Layout compilation execute in ephemeral server memory over encrypted TLS 1.3 to guarantee sub-second synthesis without freezing your browser:

• Zero permanent asset storage: We never save, log, database, or sell your inspected HTML, CSS, images, SVG vectors, or synthesized Figma components. All AST payloads are processed ephemerally in active memory and discarded immediately upon response.
• No browsing history tracking: We do not record, monitor, or sell your web browsing activity, navigation history, visited URLs, or session cookies.
• No form or credential interception: Moa strictly excludes all password inputs (type="password"), credit card numbers, CVV fields, and protected authentication forms from inspection. We never record typed keystrokes or sensitive form values.
• Safe for enterprise and confidential environments: Because zero design assets or company data are retained, designers and engineers can freely inspect internal staging environments, private design systems, and authenticated dashboards with complete peace of mind.

2. Information we collect and process

A. Anonymous aggregated product analytics (PostHog)

To diagnose runtime exceptions, monitor compiler reliability, and ensure compatibility across Chromium updates, Moa collects non-personally identifiable (Zero-PII) telemetry events via PostHog REST Capture:

• Technical metadata: Browser type (Google Chrome, Brave), browser version, operating system (macOS, Windows, Linux), screen pixel ratio, and extension build version.
• Aggregated feature counters: Anonymized interaction counts (e.g. element inspect activated, copy to Figma triggered, OKLCH palette generated, Component Vault card saved, error count).
• Random anonymous identifier: A randomly generated client token (usr_...) stored strictly in your browser sandbox to calculate active daily usage without identifying the individual user.

B. Voluntary customer feedback and bug reports (Discord webhook)

When you submit feedback or bug reports via the in-app feedback dialog:

• We receive the message you author, your optional email address (if provided for follow-up support), and basic technical environment details (extension version, OS).
• This data is transmitted securely to our internal developer triage channel solely to resolve your issue. It is never shared with third parties or used for marketing.

C. Pro licensing and payment processing (Dodo Payments)

Commercial licensing and payments for Moa Pro ($19.50 Lifetime Deal) are fulfilled by Dodo Payments Inc. (our Merchant of Record):

• Payment details (such as credit card numbers and billing addresses) are collected directly by Dodo Payments over TLS 1.3 encryption and processed in compliance with PCI-DSS Level 1 standards. Kutor Labs never stores or handles your payment credentials.
• We store only your order identifier, customer email, license token, and activation timestamp to validate software access.

3. Data retention and deletion

You retain full control over your local data. You may delete all saved Vault components, swatches, and license tokens at any time by clearing Moa’s extension data in Chrome settings (or uninstalling the extension).

To request deletion of your license email or support records, please contact us at [email protected]. Requests are fulfilled within 7 business days.

4. Contact

For privacy inquiries or technical questions regarding this policy:

Kutor Labs
Email: [email protected]
Website: https://kutorlabs.com/moa