Your data, explained.

1. Information we process

• Account information: your email address, the name you choose to add, account identifier and authentication information when you use connected account features. If you choose Google or GitHub sign-in, that provider shares account identity details with Supabase for sign-in.
• Your shelf: saved resource identifiers, collection names and their contents when you save them to an account.
• Access records: plan, entitlement status and expiry used to check premium access, where an entitlement exists.
• Teams: we store invitation email addresses, owner and member identifiers, invitation status and expiry, and sending attempts. Owners can see their invited members’ email addresses; recipients and members see the owner’s email. Other members cannot see your billing, saves or collections. Invitation emails are sent when the owner requests them.
• Daily usage: for plans with an allowance, we record your account identifier, resource identifiers and access day to enforce shared download and prompt limits.
• Affiliate program: if you apply, we store your selected promotion channel, public website or profile link, application note and review status. If approved, we also store your affiliate code and commission records. If you sign up through an affiliate link, we associate your account identifier with that affiliate. We record the related payment references, amounts, currency, refund adjustments and payout records. Affiliates see aggregate referrals and their own commissions, not referred customers’ email addresses.
• Messages: your email address, message and attachments when you contact us.
• Technical information: requests to the service and its providers may include IP address, browser information, requested URL, time and errors needed to deliver and secure the service.

Dodo Payments processes purchases and payment details. FrameShelf receives payment references, status and plan information to activate access and send purchase confirmations. We do not store full payment-card details or affiliate bank details.

2. Cookies and browser storage

FrameShelf uses browser storage for guest saves, collections, composer drafts, theme and the compact introduction preference. Session storage retains your selected checkout plan and attempt for up to 30 minutes so sign-in, retries and returning to checkout preserve your choice. These are not automatically shared between browsers. An explicit import action copies guest saves and collections to your signed-in account; it does not erase the guest copy.

The launch offer has the same fixed deadline for everyone. Browser storage remembers whether you saw or closed the offer; it does not extend the offer. Connected sign-in uses essential session cookies to maintain and refresh authentication. Blocking these may prevent account features from working. You can clear cookies and local storage in your browser settings, but doing so can sign you out and remove guest drafts or saves.

If you open a FrameShelf affiliate link, a first-party cookie stores its referral code for up to 30 days so a later new account signup can be attributed. It does not identify a visitor by name or track activity across other websites. Affiliate attribution is separate from optional analytics.

Where enabled, optional Google Analytics runs only after you allow analytics cookies. It measures public page visits, design-detail views, source download requests and checkout progress, with browser/device information and cookie identifiers. After server-side payment verification, it can record the purchased plan, payment reference, charged amount and currency. Private account and authentication URLs are not sent. A request does not prove a file was saved or used. We do not send profile names, account email addresses, passwords, edited content, search terms or signed download links to Analytics. Advertising features are disabled. Select Cookie settings to reject analytics or withdraw your choice; essential browsing and downloads remain available. Your choice is stored in this browser for up to 180 days. Declining analytics prevents the Google measurement tag from loading; withdrawing removes it and clears our Analytics cookies. This does not delete data already processed by Google.

3. Why we use information

We use information to provide requested account and saving features, verify access, deliver downloads, respond to enquiries, resolve technical problems, operate the affiliate program, calculate commissions and record manual payouts, prevent misuse and meet legal obligations. Where applicable law requires a legal basis, these purposes relate to providing the requested service, legitimate operational and security interests, legal obligations or consent where required.

We send account and purchase confirmations. An incomplete checkout may receive a reminder with an unsubscribe link; you can stop these reminders without losing purchase receipts or account access. Contacting FrameShelf does not subscribe you to a marketing newsletter. We do not sell your personal information.

4. Service providers and external requests

• Supabase: authentication and account-backed shelf and entitlement data when account services are connected.
• Google and GitHub: if you choose either sign-in option, that provider shares your account identity details with Supabase to authenticate you.
• Cloudflare R2: private source-package storage and time-limited download delivery where configured.
• Hostinger Mail: business correspondence, account emails and purchase confirmations.
• Dodo Payments: checkout, payment processing, receipts and payment-status notifications.
• Google Analytics: optional audience measurement after consent, where enabled. Google processes technical connection information and measurement data. See how Google uses information from sites that use its services.
• Google Fonts: the library and some previews request fonts from Google. These requests expose technical connection information such as IP address to that provider.

Hosting and infrastructure providers process requests necessary to deliver the site. We may disclose information when legally required or necessary to protect the service and users. Provider processing can occur outside your country; protections depend on applicable law and the provider’s arrangements.

See the providers’ own information: Supabase privacy, Cloudflare privacy, Hostinger privacy and Google Fonts privacy.

5. Retention and security

Guest data remains in your browser until removed or cleared by you or your browser. Account data is retained to provide the account service. Support correspondence may be retained to resolve enquiries, maintain a record of the issue and meet legal obligations. Retention also depends on operational logs and provider backup cycles; deletion from active records may not immediately remove backup copies.

We use authenticated access checks for private account data and premium downloads. No online service or storage system can guarantee absolute security. Do not email passwords, API keys or full card details.

6. Your choices and requests

You can remove saves and collections through the library. You can clear local guest data in browser settings. These actions are separate from deleting an account.

To request access, correction or deletion of account information, or to raise a privacy concern, email support@getframeshelf.com. There is currently no self-service account-deletion button. We may need to verify that a request relates to your account and explain any information we must retain. Rights and response requirements depend on applicable law.

7. Children’s information

FrameShelf is intended for people building websites, not a service directed at children. If you believe a child has provided personal information without appropriate permission, contact us so we can investigate and address it.

8. Changes and contact

We will update this policy when data practices change and show the revision date above. For questions, use our Contact us page or email support@getframeshelf.com.