Privacy Policy
Last updated: October 14, 2026
DAS is a real-time design environment operated by AD& (“DAS”, “we”). This policy explains what data we handle, why, and what stays entirely on your device. The short version: DAS is local-first. Your projects, images, and edit history live in your browser. We do not store your creative work on our servers, except a project you choose to share by link. If you connect an AI assistant, what it asks for passes through our connector on its way to the assistant and is not kept.
What we collect, and why
Your work stays on your device
Projects, images, edit history, and settings are stored locally in your browser (IndexedDB and localStorage), not on DAS servers. They leave your device only when you use a feature that needs them, each described below: an AI feature, a share link, or an AI assistant you connect. You control them: export backups as .das files, or delete them by removing projects or clearing browser storage. Because this data exists only on your device, we cannot recover it for you if it is lost.
Voice input works the same way: if you use it, your microphone audio is transcribed on your device by a downloaded browser model. The audio is not recorded, stored, or sent anywhere. The browser asks for microphone permission before the first use, and you can revoke it at any time in browser settings.
Share links
If you share a project by link, DAS uploads what you chose to share to our storage so the link can open it: the project file, which anyone with the link can open in DAS and copy, or a picture of it. A preview image for link previews goes with it. We store with it when it was made, its size and the project’s name, and, when you are signed in, your account identifier and the project’s identifier, so that you can revoke it. Anyone with the link can open it; links are long random strings and are not listed anywhere. A link does not expire. Unshare deletes it and its files. A link made while signed out cannot be revoked in the app: write to us and we delete it.
Account
Sign-in is handled by Clerk, our authentication provider. Clerk processes your email address, optional name, and session tokens. We store your account identifier and email in our database to link your purchases (a license or a subscription) to your account.
Billing
Payments are processed by Stripe. We never see or store your card details. We store the state of your license or subscription (plan, status, and for a subscription its billing period), your purchase history, and an audit log of billing events; these are required for accounting and for resolving billing disputes.
AI features
AI requests happen only when you invoke an AI feature; nothing is sent in the background. When you use one (image generation, magic erase, the command palette), the relevant image data and your prompt are sent through our servers to the AI provider, Google (Gemini models), RunPod (GPU-hosted models), or TypeSafe (command understanding), processed, and returned to you. TypeSafe receives text only: the command you typed or spoke and basic context about your selection (such as the type of the selected object and which effects are active), never image data. We do not store your images or prompts after processing, and they never enter our analytics or error logs. Avoid including sensitive personal data in prompts.
AI assistants (the DAS connector)
You can connect an AI assistant of your choice, such as Claude, ChatGPT or Codex, to DAS through our connector at mcp.das.app (see Connect an AI assistant). Nothing here happens unless you connect one.
- Signing in. When you connect, you approve the assistant on a DAS page and sign in through Clerk. From that sign-in the connector takes and keeps only your DAS account identifier: not your email address, not your name. Two cookies on mcp.das.app tie that sign-in to your browser; they last at most 10 minutes and are deleted once used.
- The connection. We store a record of each connection: your account identifier, the assistant app, the permissions you granted, when you granted them, and the address its access is sent to. The keys the assistant uses are stored only as one-way hashes, and they contain your account identifier. A connection record is deleted within 30 days of the assistant’s last use.
- Sessions. For each session an assistant opens, we keep your account identifier, the name and version the assistant reports, the number of its tool calls and the time of the last one, and when the session started. A session is deleted when the assistant ends it, or after 30 days without a tool call.
- What the assistant receives. An assistant works in your open DAS tab. When it calls a tool, the request and the result pass through the connector and are held only until the call is done; we do not keep or log them. Depending on the tool, the result contains your project names, dates and sizes, the kinds, names and positions of objects on your canvas and which ones are selected, or an image of your canvas. The assistant’s provider (for example Anthropic for Claude, or OpenAI for ChatGPT and Codex) receives it and handles it under its own privacy policy. These providers are not our service providers: you choose them, and they act for you.
- Your DAS tab. While you are signed in, a DAS tab asks the connector whether your account has connected an assistant, when it loads and when you return to it. It sends your sign-in token, which is checked and not stored. Switching the connection off in the account panel stops this in that browser. While a tab is connected, it holds a connection open to the connector, which keeps a random identifier for the tab until it disconnects; opening it takes a one-time ticket that lasts 60 seconds.
- Images from the web. If an assistant adds an image by its web address, your browser fetches it from that site, which sees your IP address as with any web request.
- Logs. The connector’s error messages can include your account identifier. We see them only live, while looking into a problem; they are not stored.
To disconnect, remove the DAS connector in your assistant. To stop one browser from taking an assistant’s work, switch “This tab” off in the account panel. To have your connection records deleted at once, write to help@das.app; a session still open then ends within 30 days, because no tool call can reach it.
Error reports
To find and fix crashes, the app sends us error reports: the error message and stack trace, app version, browser user agent, the page path (never query strings), a per-tab session identifier, and your account ID if signed in. Our server additionally stores a one-way hash of your IP address for rate limiting, abuse prevention, and security monitoring; the IP itself is never stored. Error reports are deleted after 90 days. You can turn error reporting off at any time in the app: open the info panel and toggle “Error reports”.
Abuse limits
To protect the service, our servers count requests per IP address, and per account when you are signed in. These counters are deleted within an hour.
Usage analytics, only with your consent
We use Google Analytics (via Google Tag Manager) to understand how DAS is used. It loads only after you accept the cookie banner. If you decline, or simply never accept, no analytics script loads and no analytics cookies are set; declining after a previous accept also deletes the analytics cookies. app.das.app additionally uses Cloudflare Web Analytics, a privacy-focused, cookieless analytics service that does not track you across sites.
Fonts
The app loads typefaces from Google Fonts when a project or the font picker uses them. Like any web request, a font load sends your IP address and browser metadata to Google. Google Fonts sets no cookies, and Google states these requests are not used for advertising. This is a functional data flow independent of your cookie choice.
Waitlist
If you join the waitlist, your email address (and name, if given) is stored with Loops, our email service, and used only to contact you about DAS access and updates. Unsubscribe at any time via the link in any email or by writing to us.
Cookies and local storage
| Name | Purpose | Type |
|---|---|---|
| __session, __client (Clerk) | Keeping you signed in | Strictly necessary |
| _ga, _ga_* (Google) | Usage analytics | Only after consent |
| __Host-oauth-consent-*, __Host-oauth-upstream-* (mcp.das.app) | Tying an assistant’s sign-in to your browser, for at most 10 minutes | Strictly necessary, only when you connect an assistant |
| das-consent | Remembers your cookie choice | Strictly necessary (localStorage) |
| das_mcp_auto_off | Remembers that you switched the assistant connection off | Functional (localStorage, never sent to us) |
| das-theme, das-telemetry-optout, other das-* keys | App preferences, license cache, your projects | Functional (localStorage / IndexedDB, never sent to us) |
Service providers
| Provider | Purpose | Data involved |
|---|---|---|
| Clerk | Authentication | Email, name, session tokens |
| Stripe | Payments | Payment details (held by Stripe), email |
| Cloudflare | Hosting, CDN, databases, cookieless web analytics, the AI connector | Request metadata, error reports, billing audit logs, shared projects, connector records (see AI assistants) |
| Neon | Account, license and subscription database | Account ID, email, license or subscription state, and any AI provider key you add (stored encrypted) |
| AI processing (Gemini); font delivery (Google Fonts); analytics after consent | Images/prompts during AI requests; IP and browser metadata on font loads; usage events after consent | |
| RunPod | AI processing (GPU models) | Images during AI requests |
| TypeSafe | AI processing (command understanding) | Command text and basic selection context during AI requests |
| Hugging Face | On-device AI model downloads | IP and browser metadata when you download a browser AI model |
| Loops | Waitlist and product emails | Email, name |
Legal bases (EEA/UK)
- Contract: account, billing, and providing the service you signed up for, including the AI connector when you connect an assistant.
- Consent: analytics cookies, waitlist emails.
- Legitimate interests: pseudonymous error reports (keeping the product working), font delivery, rate limiting and abuse prevention.
Retention
- Error reports: deleted after 90 days.
- Account, license and subscription records: for as long as you have an account, plus what bookkeeping law requires for billing records.
- AI inputs (images, prompts): not stored after processing.
- Share links: until you revoke them.
- Request counters for abuse limits: within an hour.
- AI connector: a connection record within 30 days of its last use; a session when the assistant ends it or after 30 days without a tool call; tool requests and results not kept; sign-in cookies at most 10 minutes.
- Your projects: on your device, under your control.
Your rights
Depending on where you live (including under the GDPR and CCPA), you can request access to, correction of, deletion of, or a copy of the personal data we hold about you, object to or restrict certain processing, and withdraw consent at any time. Write to help@das.app; we respond to every request. You can also lodge a complaint with your local data protection authority. We do not sell personal data.
International transfers
Our providers operate globally (primarily in the EU and US). Where data leaves the EEA/UK, transfers rely on adequacy decisions or standard contractual clauses maintained by each provider.
Children
DAS is not directed at children under 16, and we do not knowingly collect their data.
Changes
We will update this policy as DAS evolves and change the date at the top. For significant changes we will notify you in the app.
Contact
Questions about this policy or your data: help@das.app