Last updated 1 August 2026
Short version: your Figma files never leave your machine. The only data the plugin sends is a licence key and the product name, when you paste a key and whenever you reopen the plugin with one saved.
Batchwright makes exactly one kind of network request, to one address —
https://batchwright.kerdawy.dev — and only in two situations:
batchwright) and nothing
else. The reply says only whether the key is valid and which tier it unlocks, with a short
reason when it is refused.Figma enforces this. The plugin's manifest lists that one address, and Figma blocks every other host outright — the plugin could not reach anywhere else even if it tried.
Every scan, preview and edit runs inside Figma on your own machine. There is no analytics service, no telemetry, no crash reporter and no third-party script in the plugin.
The site uses no cookies, no analytics and no third-party fonts, scripts or images. Visiting it tells no one but this server that you were here.
The web server's access log keeps your IP address, the time, the page path (without the query string), the HTTP status and your browser's user-agent string. It does not log the referring page. Nginx also keeps a diagnostic error log; when a request fails, that log can include request context needed to diagnose the failure. Both exist to diagnose faults and abuse, and both are deleted after 30 days. Licence validation sends the key in a POST body, not in the URL.
Separately, the licence service writes outcome-only operational lines when it issues a key, sees a retry or stale payment event, or a checkout or webhook fails. Those lines omit licence keys, email addresses and payment reference ids. They are kept for 30 days on the same basis.
Payment is handled by Polar Software Inc., which is the merchant of record for the sale. They collect and hold what a payment needs — your name, email address, billing country and tax information, and your card details, which are processed by their payment provider. Batchwright never sees or stores your card details. Polar's own privacy policy governs that data: polar.sh/legal/privacy.
What this service stores for your purchase, and nothing beyond it:
| Field | Why |
|---|---|
| licence key | so the plugin can be told the key is paid |
| email address | to match the purchase when you ask support to recover a lost key |
| payment reference ids | the payment provider's order, customer and checkout ids, to match a refund or a dispute to the right key |
| product and entitlement | which plugin the key unlocks, and that it is a one-time purchase rather than a subscription |
| payment provider | which rail sold it |
| status | paid, refunded or revoked |
| timestamps | when the record was created and changed, when it was last checked, and the time of the last payment event — the last of these is how an out-of-order message from the payment provider is rejected |
There is no field for your name, your address, your card, your Figma account or anything you did in the plugin. If a field is not in that table, this service does not have it.
Two parties, both because the product cannot exist without them: Polar, for taking the payment, and Amazon Web Services (Frankfurt, eu-central-1), which hosts the server. Nobody buys, rents or receives this data for advertising, and there is no advertising.
Write to abdelrahman@kerdawy.dev to ask for a copy of what is stored about you, a correction, or deletion. Deleting a purchase record also retires the licence key it belongs to — say so plainly in the message so there is no confusion about that.
Purchase records are kept while the licence is valid and for seven years after, because tax rules require the sale to be provable for that long. They live on the one server described above and are not copied anywhere else. If that machine were lost, your proof of purchase would be rebuilt from Polar's own record of the order — which is why the processor's order and customer identifiers are stored beside the key — and a replacement key issued to the same email address. Logs go after 30 days.
Batchwright is a tool for professional design work and is not directed at children.
If this policy changes, the date at the top changes with it, and the change is described here. Nothing about how the plugin handles your files will be quietly loosened — that behaviour is enforced by Figma's manifest, which is public.