Framewave← Back to app

Privacy Policy

Last updated: 29 July 2026

This policy explains what personal information Framewave collects, why, and the choices you have. It is provided in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). The entity responsible for your personal information is the operator of Framewave (see our Terms), reachable at hello@framewave.app. We aim to collect the minimum needed to run the product.

What we collect

  • Account data — your email address and a securely hashed password, stored by our authentication provider when you create an account.
  • Anonymous device id — if you use Framewave without an account, a random cookie (fw_uid) identifies your device so free AI credits can be metered. It contains no personal information.
  • Usage counts — how many AI generations you have used this month, keyed to your account or device id.
  • Projects and brand kits — stored locally in your browser by default. On plans with cloud sync they are stored on our servers, linked to your account.
  • AI prompts — the text you submit to AI features is sent to our AI provider to produce the result. Don’t include sensitive personal data in prompts.
  • Billing data — payments are handled by Polar, our merchant of record. We store only your plan and Polar customer / subscription references — never card details.

What we don’t do

We don’t sell your data and we don’t run third-party advertising. We use one analytics tool, Google Analytics, and only if you agree to it — see Analytics and cookies below. Decline and nothing is loaded from Google at all.

Service providers (processors)

These providers process data on our behalf to run the service:

  • Supabase — database and authentication (hosted in London, UK).
  • Vercel — application hosting (USA).
  • Amazon Web Services — video rendering and temporary storage of finished exports (London, UK), deleted automatically after a short retention period.
  • Anthropic — AI model provider that processes your prompts for the AI features (USA).
  • Polar Software Inc. — merchant of record for payments, taxes and invoicing.
  • Google LLC — Google Analytics (USA), and only if you accept analytics cookies. It receives the pages you visit, approximate location derived from your IP, and basic device/browser details. We don’t send it your name, email, prompts or project contents.
  • Sentry — error monitoring (USA). When something in Framewave fails, we send the error message, the technical stack trace, the page it happened on and your account identifier so we can diagnose it. We have disabled the collection of IP addresses and request headers, and we don’t send the contents of your projects. Error records are deleted after 30 days.

Some of these recipients are overseas — mainly the United States, and the United Kingdom (where our database and rendering run). As required by APP 8, we take reasonable steps to ensure overseas recipients handle your personal information consistently with the APPs, relying on their contractual commitments and data-privacy certifications.

Why we collect it

We collect personal information only where it is reasonably necessary for our functions and activities (APP 3) — specifically to:

  • Provide the service you signed up for — accounts, rendering, cloud sync and billing state.
  • Run it reliably and fairly — metering free usage, preventing abuse and keeping the service secure.
  • Meet our legal obligations — records our merchant of record must keep for tax purposes.

Analytics and cookies

Strictly necessary cookies are always set, because the service cannot work without them. They carry no advertising:

  • fw_uid — anonymous device id for free-tier metering.
  • sb-…-auth-token — your sign-in session (set by Supabase when you log in).

Analytics cookies are optional and off until you accept them. We use Google Analytics to understand which pages and templates get used, so we know what to improve. We ask before loading it: until you choose “Accept”, no request is made to Google and no _ga cookie is set. If you decline, that is the end of it — we don’t fall back to another tracker.

  • _ga, _ga_… — Google Analytics, to tell repeat visits apart from new ones. Set only after you accept.

We have not enabled Google Signals, advertising features or ad personalisation, so your data isn’t used to build advertising profiles. Google Analytics is operated by Google LLC (USA) and acts as our processor. You can change your mind at any time using Cookie settings in the footer of any page; declining stops future collection.

Your choice is remembered in your browser’s local storage (not a cookie). Clearing your browser data resets it, and we will ask again.

Retention

Account data and cloud projects are kept while your account exists. Rendered export files are deleted automatically within days. Usage counts are kept per calendar month. If you delete your account (email us), we delete your personal data within 30 days except what billing law requires Polar to retain.

Your rights

Under the Australian Privacy Principles you can ask for access to the personal information we hold about you (APP 12) and ask us to correct it if it’s wrong (APP 13). You can also ask us to delete it or send you a copy. Email hello@framewave.app and we’ll respond within a reasonable time (generally within 30 days). If you’re not satisfied with how we’ve handled your information, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au); if you live elsewhere, you can also contact your local privacy regulator.

Changes

We’ll update this policy as the product evolves and note the date at the top; material changes will be announced in the app or by email.