Privacy Policy

This policy explains what personal information Framewave collects, why, and the choices you have. It is provided in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). The entity responsible for your personal information is the operator of Framewave (see our Terms), reachable at cunners123@gmail.com. We aim to collect the minimum needed to run the product.

What we collect

• Account data — your email address and a securely hashed password, stored by our authentication provider when you create an account.
• Anonymous device id — if you use Framewave without an account, a random cookie (fw_uid) identifies your device so free AI credits can be metered. It contains no personal information.
• Usage counts — how many AI generations you have used this month, keyed to your account or device id.
• Projects and brand kits — stored locally in your browser by default. On plans with cloud sync they are stored on our servers, linked to your account.
• AI prompts — the text you submit to AI features is sent to our AI provider to produce the result. Don’t include sensitive personal data in prompts.
• Billing data — payments are handled by Polar, our merchant of record. We store only your plan and Polar customer / subscription references — never card details.

What we don’t do

We don’t sell your data, run third-party advertising, or use third-party analytics trackers.

Service providers (processors)

These providers process data on our behalf to run the service:

• Supabase — database and authentication (hosted in London, UK).
• Vercel — application hosting (USA).
• Amazon Web Services — video rendering and temporary storage of finished exports (London, UK), deleted automatically after a short retention period.
• Anthropic — AI model provider that processes your prompts for the AI features (USA).
• Polar Software Inc. — merchant of record for payments, taxes and invoicing.

Some of these recipients are overseas — mainly the United States, and the United Kingdom (where our database and rendering run). As required by APP 8, we take reasonable steps to ensure overseas recipients handle your personal information consistently with the APPs, relying on their contractual commitments and data-privacy certifications.

Why we collect it

We collect personal information only where it is reasonably necessary for our functions and activities (APP 3) — specifically to:

• Provide the service you signed up for — accounts, rendering, cloud sync and billing state.
• Run it reliably and fairly — metering free usage, preventing abuse and keeping the service secure.
• Meet our legal obligations — records our merchant of record must keep for tax purposes.

Cookies

We use only strictly necessary cookies — no advertising cookies:

• fw_uid — anonymous device id for free-tier metering.
• sb-…-auth-token — your sign-in session (set by Supabase when you log in).

Retention

Account data and cloud projects are kept while your account exists. Rendered export files are deleted automatically within days. Usage counts are kept per calendar month. If you delete your account (email us), we delete your personal data within 30 days except what billing law requires Polar to retain.

Your rights

Under the Australian Privacy Principles you can ask for access to the personal information we hold about you (APP 12) and ask us to correct it if it’s wrong (APP 13). You can also ask us to delete it or send you a copy. Email cunners123@gmail.com and we’ll respond within a reasonable time (generally within 30 days). If you’re not satisfied with how we’ve handled your information, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au); if you live elsewhere, you can also contact your local privacy regulator.

Changes

We’ll update this policy as the product evolves and note the date at the top; material changes will be announced in the app or by email.