design-pick privacy policy

Applies to: the design-pick Chrome extension (which works on its own) and the optional design-pick command-line tool (design-pick), together "design-pick". Last updated: 2026-11-06. This policy covers the current under-review Chrome extension 0.3.2, the previous 0.3.1 build, and the optional command-line tool. Version 0.3.2 is not publicly released. Existing MIT CLI functionality is unchanged. Public distribution of the 0.3.0 command-line release candidate is pending; npm currently has 0.2.0.

Publisher: lo9os, an independent software developer based in South Korea. Contact: contact@lo9os.org.

Summary

• design-pick works on your own computer. The extension reads the element you click and builds its packet inside your browser; if you choose to pair the command-line tool, it also talks to that tool on your own machine (127.0.0.1, loopback). It sends nothing to the publisher. What the pages you open load or send on their own is separate — see "Network activity" below.
• No telemetry, analytics, advertising or design-pick account. The extension handles the element and URL context you explicitly select to build packets and verify changes. It does not enumerate your browsing history or monitor unrelated tabs. Selected text and screenshots can contain personal information shown on the page; review them before sharing.
• With the command-line tool, picked elements are written to a file in your own project folder (.design-pick/picks.jsonl). You control and can delete it. The extension alone writes no such file.
• Pro licensing: when a Pro key is saved, the extension and the Pro command-line tool validate it with Polar (polar.sh). That validation sends your license key, the product organization and benefit ids, and the device/activation information described below; the answer is cached locally. The 0.3.2 extension reads saved Pro status to decide whether to add advanced source context and verification. Basic element selection and copying work without active Pro. Without a saved key, the extension does not contact Polar. Screenshots stay in your browser. See "Pro license check".

How it works (so you can judge the claims)

1. You install the extension and click its toolbar icon on a tab. That click gives access to that one tab (Chrome's activeTab); Chrome shows no site-access prompt, and the extension asks for no all-sites permission. Basic element selection and copying are free on supported websites. In 0.3.1, source/DOM packets and open-tab rendered-property verification are also free. The 0.3.2 extension requires Pro for source-file/line hints and rendered-property comparison, alongside existing screenshot/pixel comparison. Basic selection and copying work without active Pro; the worker reads saved Pro status to select the optional advanced features. Existing MIT CLI functionality is unchanged. Chrome's restricted pages cannot run the picker regardless of license.
2. The extension runs the picker, a file shipped inside the extension, in the top-level page of that tab.
3. When you click an element, the picker sends its description to the extension's service worker, which builds a text packet. In 0.3.1 the service worker reads the page's own served files and source maps to find source files and lines. These reads remain disclosed here for that version. In the 0.3.2 review build, source reads are used only when Pro access allows advanced source context; the Free basic packet uses the already collected element details and rendered styles without fetching source files. Source reads are limited to the page's own website (no cookies or other credentials; no redirects; at most 3 seconds and 5 MB per file). A paired command-line tool may receive a pick from localhost / 127.0.0.1 and return its packet: this is available in 0.3.1 and requires Pro advanced-feature access through the 0.3.2 extension. On any other site, the extension builds the packet itself; the command-line tool receives nothing from that page.
4. The picker copies the packet to your clipboard.
5. Optional pairing: run design-pick --pair in a terminal; the extension asks you to confirm that a code it shows equals the code the terminal printed, and only then stores the pairing token.

Data the extension handles

The extension does not enumerate your browsing history or read bookmarks, cookies, passwords or form-field values, does not read pages you did not click on, does not run in tabs you did not activate it on (other than the pairing script on localhost / 127.0.0.1 pages, which acts only on the path /__picker/pair), and does not load or execute remote code (the picker is a file shipped inside the extension package; the page's files it reads are treated as data and never executed).

Data the command-line tool writes on your computer

• .design-pick/picks.jsonl in the folder you started it in: one line per pick (timestamp, page, selector, the packet, a rendered-state snapshot, and the page's origin, viewport and query string). It can contain the 60-character text snippet and file paths from your project. Add .design-pick/ to your .gitignore. At start-up the file is rotated if it has more than 200 lines (the previous one is kept as picks.prev.jsonl); delete the folder any time. Disable it with --no-queue.
• .design-pick/session.json: the per-run token and port, mode 0600, removed when the server exits.
• Pro only (applies from the Pro release): files that design-pick Pro creates. All of them stay on your computer; none is sent anywhere.
  • .design-pick/shots/ (--shots): before/after/diff pictures of the elements you picked (the element's box plus 8 px, at most 1600 x 1600 CSS px), mode 0600; the newest 200 files / 50 MB are kept. With --auth, a picture can show whatever the signed-in page shows, including account data — keep this folder out of version control and out of CI artifacts.
  • .design-pick/auth/state.json (--auth, design-pick auth login | import): the cookies and local storage of the site you signed in to (a Playwright storage state), file mode 0600 in a 0700 folder, ignored after 12 hours, one site per saved state; design-pick auth status lists names and counts, never values; design-pick auth clear deletes it. A small clear-gen marker file lives in the same folder.
  • design-pick.ci.json (design-pick ci init): the CI check's watch list — page paths and selectors of the elements you picked — meant to be committed to your repository. design-pick ci measure --out <file> writes a measurement document and, with --shots <dir>, one picture per watched element; design-pick ci compare --out-dir <dir> writes the report files. They are written where you point them; the GitHub Action keeps them as workflow artifacts in your own repository.
  • The license cache (see "Pro license check"): license.json in your per-user configuration folder, mode 0600.
• The optional MCP adapter (design-pick mcp) reads that queue and talks to the local server; it opens no network port.

Network activity

• Extension → the website of the tab you clicked on: requests for that page's own served files and source maps to build source context. These occur for the 0.3.1 source/DOM packet and, in the 0.3.2 review build, when Pro source-context access is allowed. Free basic packets in 0.3.2 do not fetch source files. No cookies are sent, and the extension never reads from another website.
• Extension → 127.0.0.1 (your own machine): only if you pair the command-line tool. Pairing, health and entitlement checks may occur; picks and verification requests from localhost / 127.0.0.1 use the paired tool where allowed by the extension version and Pro status. The 0.3.2 extension forwards advanced context and verification only with Pro access. Existing MIT CLI functionality is unchanged.
• Extension → api.polar.sh: the Pro license check, described below. Without a license key, never.
• Pages you open: whatever your own page already loads. design-pick adds no requests of its own to other servers, and does not block or change what the page loads; its scripts run as they would without design-pick.
• Command-line tool, --proxy <upstream>: forwards to the dev server you name (and fetches its sourcemaps).
• Command-line tool, --headless (optional, design-pick Pro): the tool starts your installed Google Chrome, which loads your own page the way a tab would, including whatever that page requests from the internet. The same applies to --shots, --auth (signed-in pages: the page's own scripts — analytics, ads and other third-party scripts included — run as in a normal signed-in browser, using your saved sign-in state, and can send what they read to any host; design-pick itself sends nothing there) and design-pick ci measure (all design-pick Pro).
• Install-time: npx design-pick downloads the package from the npm registry (npm's privacy policy applies). The optional launcher for non-terminal users downloads a portable Node.js from nodejs.org, only after you consent. The extension release ZIP can be loaded and replaced locally in chrome://extensions; installation and updates through the Chrome Web Store apply when its listing is published (Google's privacy policy applies).
• No other servers are contacted. There is no update ping, crash reporter or remotely reported usage counter.

Pro license check (design-pick Pro only)

Polar validation applies to Pro licensing. It is not part of the basic MIT command-line functionality. Extension element selection and basic copying remain available without active Pro. Source-file/line hints and open-tab property verification are also free in 0.3.1; those advanced capabilities require Pro in the 0.3.2 review build. The 0.3.2 worker reads the saved Pro status to choose these advanced features. With no saved key, the extension does not contact Polar.

When you enter a license key on the extension's options page, or activate or use the Pro command-line tool, it contacts Polar (polar.sh), the payment and licensing provider, at api.polar.sh over HTTPS. What is sent:

• your license key;
• the organization id and benefit id of the design-pick product on Polar (the same for every customer);
• on activation, a device label: from the extension, chrome-ext, your operating system's name and 8 hex characters of a random install number the extension made for itself (no host name, no account); from the command-line tool, your platform name plus the first 8 hex characters of a SHA-256 hash of your computer's hostname (your hostname itself is not sent);
• on later checks, the activation id Polar returned.

No page content, element data, project files, screenshots, signed-in state or CI results are ever sent. As with any HTTPS request, Polar also sees your IP address; payment and licensing data are handled by Polar under its own privacy policy.

Polar's validation response may also include customer profile and billing fields, such as email, name, billing name and address, tax identifier and a payment-method identifier. The extension and Pro command-line tool receive and parse that response transiently. They use the license fields and signed-grant metadata; the unused profile and billing fields are not cached, displayed or forwarded by design-pick.

When the extension asks: when you press "Activate" or "Re-check now" on the options page; when the browser starts; and from a background timer that wakes every 6 hours and only contacts Polar if a check is due — every 3 days during the first 30 days after activation, then every 30 days. If Polar cannot be reached, Pro keeps working for up to 14 more days with a warning. Each call is limited to 5 seconds; if Polar asks the extension to slow down, it honors a valid retry delay up to 24 hours; an invalid delay defaults to 60 seconds. "Remove key from this browser" deletes the saved record and, when Polar can be reached, releases that browser's activation. Clicking the toolbar icon does not itself contact Polar: it reads the saved answer. In 0.3.2 the pick and verification worker also reads saved Pro status to select advanced features. A saved key can still be validated by the options page or due background checks described above; without a saved key, the extension does not contact Polar.

When provisioned, the local license record also contains a signed feature-rights grant: opaque license, organization, benefit, order and product identifiers, a hash binding it to the license key, a signing-key and policy identifier, and the cutoff for included new paid features. It arrives with the normal Polar license response and is verified locally after refresh or restart. It contains no page content or screenshots and adds no network service. Production issuance of these grants is not yet enabled for the new one-time offer.

The command-line tool asks once when you run design-pick activate <key>; afterwards when design-pick Pro starts and the saved answer is older than 3 days (during the first 30 days after activation) or older than 30 days (after that), and when you run design-pick license refresh. Its saved answer (the key, a masked key tail, ids, dates, the revoked flag and any provisioned signed feature-rights grant described above) is stored in license.json in your per-user configuration folder (~/Library/Application Support/design-pick/ on macOS, $XDG_CONFIG_HOME or ~/.config/design-pick/ on Linux, %APPDATA%\design-pick\ on Windows), mode 0600; design-pick license status shows it masked and makes no network call. The extension and the command-line tool each keep their own saved answer and neither reads the other's key.

In CI (CI=true and the DESIGN_PICK_LICENSE_KEY environment variable, for design-pick ci compare and ci init) the key is sent in the same way on every run, nothing is activated and nothing is written to disk; design-pick ci measure needs no license and sends nothing.

Source: the license modules of design-pick Pro (lib/license-core.mjs, lib/license.mjs, extension/license.mjs).

What we never do

We do not sell or transfer user data to third parties, we do not use it for advertising, creditworthiness or lending, and we do not use it for anything unrelated to the single purpose of the tool (pointing an AI at the right source code). Because design-pick itself sends nothing to us or to third parties (apart from the Pro license check to Polar described above, and the requests listed under "Network activity" that only reach the page's own website), there is nothing for us to share.

Your choices

• Remove the extension in chrome://extensions — this deletes its stored pairing token, license record and screenshots.
• Remove your license key from the browser with "Remove key from this browser" on the extension's options page.
• Delete .design-pick/ in your project to remove picks and the session file.
• The extension only has access to a tab you just clicked it on, for as long as you stay on that site; you can also revoke its access to localhost / 127.0.0.1 in chrome://extensions → design-pick → Details → Site access.

Security

The local server accepts only loopback Host and Origin headers; requests from your extension must carry the paired token; the extension's service worker forwards only a short fixed list of paths. Details and limits (for example, what the token does not protect against) are in the project README, section "Security".

Children

design-pick is a developer tool and is not directed at children.

Changes

Changes to this policy will be published at this URL with a new "Last updated" date.