Privacy policy

Last updated: March 26, 2026

1. Who we are and scope

This Privacy Policy explains how Bool, the operator of the Color Picker service, handles personal information when you visit or use the service. For data protection purposes, Bool is the controller of the personal information described in this policy unless a third-party provider explains that it acts as a separate controller for its own processing.

This policy applies to the Color Picker service made available on domains and subdomains we use for this product, including figma.am, www.figma.am, and preview or testing environments such as test.bool.am.

This policy applies to the user flows offered through the site, including browsing public pages, using browser-based editing tools, creating or using an account, purchasing or managing a subscription, contacting support, and using profile sync or other connected features where available.

Some features may be optional, limited to particular pages, environments, or release stages. If you do not use a feature, the related processing may not apply to you.

For privacy questions or requests, contact us at [email protected].

2. Information we process

Images and edits you use in the tools

Core editing is designed to run locally in your browser. In normal browser-based editing flows, images you open for editing are generally processed locally on your device. If you choose to use account, sync, upload, or other connected features that require server-side storage or transfer, we may process selected files, assets, profile data, or related metadata to provide those features.

Account identifiers and account profile data

If you create or use an account, we may process information such as your name, email address, display name, account or workspace identifiers, saved account preferences, and related account profile metadata. We use this information to create and manage your account, provide account-linked features, personalize the service, and communicate with you about account-related matters.

Authentication and session data

To sign you in, keep you signed in, and protect account features, we may process authentication and session-related information such as password or password-hash data, session tokens, cookie identifiers, login or access timestamps, device or browser session state, and security-related records associated with sign-in activity. We use this information to authenticate users, maintain sessions, secure accounts, prevent abuse, and troubleshoot service issues.

Pro, subscription, and checkout data

If you purchase, activate, renew, cancel, or manage a Pro or other paid plan, we may process subscription and billing-related information such as plan tier, entitlement status, customer or subscription IDs, order or transaction metadata, renewal and cancellation status, and records needed to reconcile billing events and support requests. Payment card details are collected and processed by the relevant hosted checkout, payment, or merchant-of-record provider rather than stored in full by us.

Profile, sync, and stored feature data

If you save profiles, sync settings across devices, or use account-linked storage features, we may process saved profiles, synced settings, profile versions, watermark or other uploaded assets, and metadata that links those items to your account, workspace, device, or subscription state. We use this information to provide sync, restore saved configurations, support account-linked workflows, and maintain feature history where relevant.

Preferences stored on your device

We store certain preferences in your browser, such as theme, tool settings, and your analytics consent choice. This information is typically stored using local storage or similar browser storage so the site can remember your preferences on your device.

Optional analytics data

If you consent, we use Google Analytics to understand overall usage of the site. Depending on your device and browser, this may include information such as pages viewed, approximate location derived from IP address, browser and device information, and general interaction events. We use IP anonymization in Google Analytics where supported. We do not use analytics to upload your image content.

Technical, session, and security data

We may process technical information needed to operate and secure the site, such as browser and device details, network information, log data, cookie or session identifiers, feature state, and records of actions taken to protect the service, detect abuse, troubleshoot issues, and enforce our terms.

Messages you send us

If you contact us by email, we receive the information you include in your message, such as your name, email address, and any other information you choose to provide.

3. How we use information

We use information to operate the site, remember your preferences, measure usage when you consent to analytics, provide account access, process subscriptions and hosted checkout flows, sync profiles or settings where those features are used, respond to support requests, improve the tools, comply with legal obligations, and protect the site against abuse, fraud, and technical problems.

4. Cookies and similar technologies

Essential site storage

We use browser storage that is necessary to remember preferences such as theme, tool settings, and your consent choices.

Account and session technologies

If you use account or connected features, we may also use cookies or similar technologies needed to keep you signed in, maintain session state, secure account flows, and support subscription or sync features.

Optional analytics cookies

If you allow analytics, Google Analytics may place cookies or use similar technologies to collect usage information. You can change your choice at any time by selecting Cookie settings at the bottom of the page or by using the control below on pages where analytics consent applies.

Open cookie settings

5. Legal bases where required by law

Where applicable under laws such as the GDPR or similar laws, we rely on consent for optional analytics, performance of a contract or steps taken at your request for account, subscription, and sync features, legitimate interests for operating, securing, and improving the site, and legal obligations where we must comply with applicable law.

6. Sharing

We do not sell your personal information. We may share limited information with service providers that help us operate the site or provide analytics, hosting, infrastructure, authentication, sync, customer support, or subscription and hosted checkout services, including Google Analytics when you consent and the relevant billing or checkout provider when you use paid features. We may also disclose information if required by law, to protect rights and safety, or as part of a business transfer such as a merger, acquisition, or sale of assets.

Depending on the feature you use, recipients or categories of recipients may therefore include analytics providers, hosting and infrastructure providers, authentication and session providers, cloud storage or sync providers, customer support or email providers, and payment, billing, merchant-of-record, or hosted checkout providers.

7. International transfers

Because we and our service providers may operate in more than one country, information may be processed outside your country of residence. Where required by law, we will rely on appropriate safeguards for such transfers.

8. Retention

We keep different categories of personal information for different periods depending on the feature used and the purpose for which the information was collected. Where we do not list a fixed retention period, we decide how long to keep the information based on whether the account or feature remains active, whether the information is still needed to provide the service, the sensitivity of the information, security and fraud-prevention needs, dispute-resolution needs, backup and recovery requirements, and any legal, tax, accounting, or regulatory obligations that apply.

• Browser storage and local preferences: kept on your device until you delete them, clear browser storage, or change the relevant setting.
• Authentication and session data: kept until logout, deletion, or automatic expiry. Where server-side account sessions are used, the current configured session lifetime is up to 30 days unless revoked or refreshed earlier through account activity.
• Analytics data: kept for the retention period configured in our analytics tools and reviewed periodically to make sure it is still needed for usage reporting and service improvement.
• Account records: kept while your account remains active and afterwards only as long as needed to maintain records of the relationship, support reactivation, resolve disputes, prevent fraud, enforce our terms, or comply with legal obligations.
• Subscription and checkout records: kept for as long as needed to manage the paid plan and for any additional period required for accounting, tax, audit, chargeback, fraud-prevention, and legal recordkeeping purposes.
• Profile, sync, and account-linked assets: kept while they remain associated with an active account, workspace, or feature. If you delete them, we will remove them from active use when operationally feasible, although limited backup, transactional, or audit records may persist until they are overwritten, rotated out, or no longer needed.
• Support emails and support records: kept for as long as needed to respond to your request, maintain support history, follow up on related issues, and protect the service in connection with complaints, disputes, or legal claims.
• Technical and security logs: kept for as long as needed to monitor performance, investigate incidents, detect abuse, preserve evidence, and comply with applicable legal obligations.

We review retention periodically and delete, anonymize, or de-identify personal information when we no longer need it for the purposes described above.

9. Your rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of your personal information, as well as rights to object to or restrict certain processing and to withdraw consent where processing is based on consent. You may also have the right to lodge a complaint with your local privacy or data protection authority.

Right to object

Where applicable law gives you the right to object, you may object to our processing of your personal information where we rely on legitimate interests as the legal basis. If you object, tell us what processing you object to and why, and we will review your request in accordance with applicable law.

Withdrawing consent

Where processing is based on consent, you can withdraw consent at any time. For analytics, you can do this by opening Cookie settings from the button shown at the bottom of the page or by using the button below where it appears. Withdrawal of consent does not affect processing carried out before the withdrawal.

Review analytics consent

Complaints and requests

You can contact us to exercise your privacy rights or raise a concern about how we handle your personal information. If you are not satisfied with our response, you may have the right to complain to your local privacy or data protection authority.

To exercise a privacy request, email [email protected].

10. California online tracking disclosure

At this time, we do not respond to browser Do Not Track signals in a separate way. If you consent to Google Analytics, Google may collect information about your activity over time and across websites or online services in accordance with Google's own policies. If you do not consent, we do not load Google Analytics.

11. Children's privacy

The site is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the public production service. If you believe a child has provided personal information to us, contact us and we will review the request.

12. Security

We use reasonable technical and organizational measures intended to protect information we process. However, no method of transmission or storage is completely secure.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version here and update the "Last updated" date above.

14. Contact

Operator / controller: Bool

Covered service domains: figma.am, www.figma.am, and test.bool.am when used for the Color Picker service.

Privacy contact: [email protected]