Privacy policy

Last updated September 29, 2026

The short version. We collect what it takes to run Boom.design: your account, the designs you make and the pictures you upload, your payments (through Stripe) and how you use the site. Your prompts and designs are sent to AI providers so they can generate your designs. We don't sell your information, use it for advertising or train AI models on your content. You can delete your account from Account → Profile at any time. This summary is for convenience; the full policy below is what counts.

This policy explains how Do For Tech, Inc. ("Boom.design", "we", "us"), a company registered in California, USA, collects, uses and shares personal information when you use the Boom.design website at boom.design and the designer (together, the "service"). We're responsible for that information. If you have a question about it, write to support@boom.design.

1. What we collect

Your account

Your email address and your name. If you sign up with a password, Firebase Authentication (part of Google Cloud) stores it as a secure hash, never in a readable form. If you sign in with Google, Google shares your name, email address and profile picture with us.

What you make

• the messages you write to the assistant, its replies, and each project's conversation;
• your projects, their pages and names, previews of your pages, and the files you export;
• the pictures you upload, with their file name, size and dimensions;
• the stock photos you pick, and what you search for.

Your payments

Stripe collects your card details, billing email, name and address, and your tax ID if you give one. We never see your full card number. We keep your Stripe customer ID, your plan and its status, and what you've bought, as well as your AI credit balance and its history.

How you use the service

• Usage. How many projects, uploads, exports and pages you have, how much storage you use, and the AI usage, cost and credits your messages take.
• Analytics. Google Analytics records the pages you visit and how you move through the site, the features you use (for example, that you started a project or exported a PNG), your device and browser, and your approximate location, worked out from your IP address. When you're signed in, this is linked to your account's ID and plan, never your name or email address. What you type, your designs and your files are never sent to it. It uses cookies to do this, if you allow them (see section 5).
• Request logs. Our hosting provider, Google Cloud, records standard details of each request (your IP address, browser, the address requested and the time) for security and troubleshooting.

When you write to us

Through the contact form: your name, email address and message and, if you're signed in, your account's ID and email address. Emails you send us are kept in our support inbox.

When you delete your account

The reason you give for leaving, and the note you add, if you choose to give them.

2. How we use it

• To run the service: your account, saving your projects, generating designs with AI, exports, and restoring what you've deleted.
• To bill you: taking payments, keeping your plan and credits up to date, and receipts.
• To email you about your account: a welcome email when you sign up, password resets and email verification, and notices such as your account's deletion. We don't send marketing emails. If we ever do, every one will let you unsubscribe.
• To help you when you write to us.
• To keep the service safe and working: preventing abuse and fraud, enforcing our terms, and fixing problems.
• To understand how the service is used and improve it, from analytics and usage figures.
• To meet our legal obligations, such as keeping tax and accounting records.

We don't sell your personal information, we don't use it for advertising, and we don't use your content to train AI models.

3. AI providers

When you use the assistant, we send AI model providers what it needs to do the job: your messages and the project's conversation, a snapshot of the page you're working on, and any pictures you attach to a message. The first message of a new project is also used to name the project. We don't send them your name or your email address.

We use frontier AI models from leading AI providers. Which model handles a request changes as better ones come out. The providers process your content to generate a response, under their terms for business customers, and may keep requests for a limited time under their own policies, for example to detect abuse.

4. Who we share it with

We share personal information with the service providers that help us run Boom.design. They may use it only to provide their services to us.

We may also share personal information:

• when the law requires it, such as to comply with a valid court order, or to protect the rights, property or safety of our users, the public or us;
• as part of a merger, an acquisition or a sale of our business, in which case this policy keeps applying to your information and we'll tell you beforehand;
• with your consent.

5. Cookies and your browser's storage

• Analytics cookies. Google Analytics sets cookies (_ga and _ga_…) to count visits and see how the site is used. If your browser is set to a European time zone, we ask before setting them, and until you allow them Google Analytics gets only anonymous counts that set no cookies and can't tell one visitor from another. Wherever you are, you can change your choice at any time from Cookie settings at the foot of the home page and the site's other public pages.
• Staying signed in. Firebase Authentication keeps you signed in using your browser's storage.
• Conveniences. Your browser remembers your light or dark theme, a hint that you're signed in (so the home page shows the right layout straight away), your answer about analytics cookies, and a message you started typing before signing in, which is cleared when you close the tab. These stay in your browser and aren't sent to us.

We don't use advertising cookies. You can block or delete cookies in your browser's settings. The service still works without analytics cookies, but if you clear the site's storage you'll need to sign in again. The site doesn't respond to Do Not Track signals.

6. Where your information is stored

Your information is stored on Google Cloud servers in the United States, and our providers may process it in other countries too. If you use Boom.design from outside the US, including from the European Economic Area, the UK or Switzerland, your information is transferred to the US. Where the law requires it, these transfers rely on safeguards such as the European Commission's Standard Contractual Clauses in our providers' data processing terms.

7. How long we keep it

• Your account and content: for as long as your account is open.
• Deleted projects and uploads: 30 days in the trash, where you can restore them. After that they're permanently deleted, files and all.
• A deleted account: kept for 30 days, so you can restore it by signing in. Then it's erased: your profile and sign-in, your projects, uploads and exports, your credits and usage, and your customer record at Stripe. What remains is a short record of the deletion with no name, email address or content in it: when the account was created and deleted, the plan it had, the reason given for leaving if there was one, its final usage figures, and internal account and Stripe customer IDs. We keep it to understand why people leave and to handle any later question about a payment.
• Payment records: Stripe keeps the records of payments that the law requires, even after your customer record is deleted.
• Stock photo searches: results are cached for 24 hours, without anything that identifies you.
• Messages you send us: in our support inbox for as long as we need them to help you and keep a record.
• Analytics: up to 14 months, in Google Analytics.
• Request logs: a limited time, typically 30 days.

Copies in our providers' systems and backups can take a little longer to clear after we delete something.

8. Security

• Connections to Boom.design are encrypted with HTTPS, and Google Cloud encrypts the data it stores.
• Each account can reach only its own projects, uploads and records.
• Files you upload and export are private, but they're served through long, unguessable links. Anyone who has one of those links can open that file, so share them with care.

No system is perfectly secure. If we learn of a breach that affects your personal information, we'll tell you as the law requires.

9. Your choices and rights

Wherever you live, you can:

• get your designs: export them from the designer at any time, and ask us for a copy of the personal information we hold about you;
• correct your information: change your name on Account → Profile, and ask us to correct anything else;
• delete things: delete a project or an upload (it stays in the trash for 30 days), or your whole account from Account → Profile;
• cancel a paid plan from Account → Subscription.

For anything you can't do yourself, write to support@boom.design. To protect your account, we may ask you to write from its email address, or confirm who you are in another way. We'll reply within 30 days, or tell you if we need longer and why, as the law allows.

In the EEA, the UK and Switzerland

We rely on these legal bases:

• contract, to provide the service you signed up for and bill you for it;
• legitimate interests, to keep the service safe, prevent abuse, understand how it's used and improve it, and answer your messages, having weighed these against your rights;
• legal obligation, for tax and accounting records and to answer lawful requests from authorities;
• consent, for analytics cookies and wherever else we ask for it. You can withdraw it at any time, for analytics cookies from Cookie settings at the foot of the home page and the site's other public pages.

You have the right to access your personal information, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. You can also complain to your local data protection authority.

California residents

Under the California Consumer Privacy Act, you have the right to know what personal information we collect, use and disclose, and to get a copy of it; to correct it; to delete it; and not to be treated differently for using these rights. You can ask someone else to make a request for you, with your signed permission.

In the past 12 months we've collected these categories of personal information, from you, your device, Google sign-in and Stripe, for the purposes in section 2:

We don't sell personal information or share it for cross-context behavioural advertising, and haven't in the past 12 months, including that of anyone under 16. We use your sign-in details only to provide the service. We don't share personal information with others for their own direct marketing.

10. Children

Boom.design isn't meant for children under 13, and we don't knowingly collect their personal information. If you believe a child under 13 has given us personal information, write to support@boom.design and we'll delete it.

11. Changes to this policy

We'll update this policy as the service changes. If a change is significant, we'll tell you by email or in the app before it takes effect. The date at the top of this page shows when it last changed.

12. Contact us

Do For Tech, Inc.
support@boom.design