What leaves your Mac, and what never does.

You generate or change a design

Your prompt and what you attached go to Anthropic or OpenAI, through the Claude Code or Codex that is already on your machine. The composer's ideas come the same way.

A design is on screen

The app loads what the page links to: Tailwind from jsDelivr, fonts from Google Fonts, sometimes a photo from Unsplash.

You point Playdo at a website or a web image

A browser on your machine opens that site, or Playdo downloads that image into your project.

You press Create link

That design is uploaded to Playdo's share service, where anyone with the link can open it.

You remove a photo's background for the first time

After asking, Playdo downloads a 19 MB model, once. The photo itself stays on your machine.

You sign in, or open the app

Your email goes to Playdo's account service, which sends you a code. After that the app asks it whether you're signed in and which plan you have.

Each one is spelled out below.

• The canvas is a small server inside the app, on your own Mac. It listens on localhost only, and it takes changes only from its own page.
• Designs are HTML files in .playdo/ in your project folder, beside DESIGN.md. Images you attach and websites you capture are saved there too. The docs list every file.
• Each design runs in a sandboxed frame, so a design's own scripts can't call the canvas's server.

Playdo has no model of its own. It starts the Claude Code (or Codex) command line tool that is already on your machine and signed in, and that tool talks to Anthropic (or OpenAI) under your plan. What they keep is set by your agreement with them, not by Playdo.

A run sends:

• your prompt, with Playdo's own design instructions
• your project's DESIGN.md
• the images and website captures you attached
• the design's HTML, when you change it, branch from it or ask for another screen like it

None of it passes through a Playdo server. There isn't one between you and the model.

The composer's ideas are a run of the same kind, and an empty canvas asks for a batch when it opens. That request carries no design: only the ideas you have already seen, so they aren't repeated, and for ideas about a frame, the prompt that made it.

Hand-off adds nothing new: your coding agent reads the design from your disk, through an MCP server that runs on your machine.

One limit is deliberate. Codex runs with a shell that can read files, so Playdo never hands it text from a website: not a captured reference, not an imported page.

Showing a design means the app fetches what the page links to:

cdn.jsdelivr.net

Tailwind's browser build, the script that writes the page's CSS.

fonts.googleapis.com
fonts.gstatic.com

The design's web fonts.

images.unsplash.com

A photo, in designs that use one.

These are requests for public files. Those hosts see them as they see any visit: your network address and the file asked for. Your design and your prompt are not part of them.

It is the same wherever a design is shown: on the canvas, while a screenshot or an export is made, in a share link someone opens. A page you imported from the web also keeps loading its images, fonts and styles from the site it came from.

An exported HTML zip has its CSS written out, so it no longer needs Tailwind's script. Its web fonts and web photos still load online.

• A website you add as a reference, or a page you import, is opened by a browser already on your machine: Chrome, Edge or Playwright's Chromium, in a fresh window with none of your logins. The site sees a visit from your network address. The capture is saved in your project.
• An image you add by its web address is downloaded by Playdo on your machine and saved in your project. It downloads from public addresses only, never from your own network.
• A Figma file, or a paste from Figma, is read on your machine. No Figma account or API is involved.

Sharing is the one time a design goes to a Playdo server, and it starts with a button. Nothing is uploaded until you press Create link.

What goes up

The frame, or every finished screen of its flow, as HTML. With it: the screens' names and sizes, a title, and the project images those screens use.

Where it goes

Playdo's share service, a Cloudflare Worker that keeps the files in R2 storage.

Who can open it

Anyone with the link. The address is random and the page asks search engines not to list it, but treat a link as public to whoever holds it.

Comments

Anyone with the link can pin a comment. Its text, its place on the design and the name they typed are kept with the share until you resolve it.

How long

30 days from when you made or last updated it. Then the link stops working and its files are cleared from storage.

Stop link

Deletes the pages, the images and the comments at once.

The key

Updating or stopping a link takes a token. It stays in .playdo/shares.json in your project, which git ignores; the service keeps only a hash of it.

Limits

The service counts requests per network address, 10 shares and 20 comments a minute, to slow abuse. The address is not stored with a share or a comment.

Removing a photo's background uses a model that isn't in the app. The first time, Playdo asks, then downloads the model and its runtime (19 MB, from a GitHub release and the npm registry), checks each against a known hash and keeps them in your cache folder. The photo is processed on your Mac and is never uploaded.

Playdo needs an account. The account service is a Cloudflare Worker with its own database, and this is what it keeps:

• your email address, and the name you give yourself
• your plan
• a sign-in code while it is live: stored as a hash, good for ten minutes and five tries
• your sessions, so you can sign out of one Mac from another

The sign-in itself is kept in a file in your config folder on your Mac, readable only by you. The app sends it to the account service to check your plan. Nothing about your designs goes with it.

Paying isn't open yet. When it is, a payment provider will take the card, Playdo won't see or keep the number, and this page will name the provider.

On the Team plan, a project you choose to share with a workspace syncs its files through the account service, so they reach your teammates' Macs. The service keeps those files, every version of them, and who is in the workspace with which role. Projects you don't share stay as local as any other.

• The waitlist keeps the email address you give it, which page's form you used and the time. It is for one email when the app is ready.
• The site sets no cookies and runs no analytics or tracking scripts. Its fonts and videos come from the site itself, so reading it makes no request to anyone else.
• It is hosted on Cloudflare, which handles each request and, like any host, keeps its own request logs. The waitlist is a Cloudflare D1 database.

Your designs are plain files: open .playdo/ in your project folder and they are all there. Any network monitor shows the rest. The app talks to its own canvas on localhost and to the account service, and the designs load the files listed above.