Privacy policy

Four categories, and nothing outside them.

• Account details. Your email address, and a display name and avatar if you provide one. Authentication is handled by Supabase; we never see or store your password.
• What you create. The idea you type into the box, the site documents generated from it, every page and section, your saved snapshots, images you upload, and the sites you publish.
• Product events. A record that something happened — an idea was submitted, a project was created, a site was published or exported. See Analytics for what is attached to these.
• Messages you send us. The name, email address, topic and message from the contact form, so we can reply.

We do not collect advertising identifiers, we do not buy data about you from anyone else, and there is no third-party tracking script on this site or on any site you publish.

• To generate, store and display the sites you build.
• To let you sign in and to keep your work associated with your account.
• To publish a site when you ask us to, and to export one when you ask for that.
• To answer you when you write in.
• To understand how the product is used in aggregate — which steps people abandon, how long generation takes, which features go unused.

We do not sell your data. We do not share it with advertisers. We do not use the content of your sites for anything other than building and serving those sites.

When you submit an idea, the text you wrote is sent to OpenAI along with a description of the design system it can work within, and the model returns a proposed site. That request is what makes the product work; there is no way to use the generator without it.

We store a record of each generation — the idea, the model used, the outcome, and how many tokens it cost — so we can debug failures and understand what the generator is doing badly. If you would rather not send text to a third party, you can build entirely from templates instead; that path never calls OpenAI.

Do not put confidential information in the idea box. It is a description of a business intended for a public website, and it leaves our systems to be processed.

The processors we use, and what each one handles:

• Supabase — authentication, the database holding your projects, and file storage for images you upload.
• OpenAI — receives the idea text you submit, in order to generate a site. See the section above.
• Vercel — hosts this application, and hosts the sites you publish through it.
• GitHub — only if you use the export feature, and only to create a repository in the account you authorise.
• Unsplash — receives your search terms if you use the built-in image picker. It does not receive anything else about you or your site.

Each of these is used for the purpose described and nothing else. We add processors rarely, and this list changes in the same release that the change ships.

There is no cookie banner because there is nothing to consent to. We set two cookies:

• A session cookie, set by Supabase, that keeps you signed in. Removing it signs you out.
• A GitHub access token, set only if you connect GitHub for export. It is httpOnly — script on the page cannot read it — and it is held in the cookie rather than in our database on purpose, so that a database compromise does not hand anyone access to your repositories.

Separately, drafts you make before signing in are kept in your browser's local storage. They never leave your device until you save them to an account, which also means they are tied to that browser on that machine.

Sites you publish set no cookies at all and ship no JavaScript bundle, so they cannot track your visitors even by accident.

We record product events — an idea was submitted, a project was published — so we can see where the product is working and where people give up. There is no third-party analytics service involved; the events go into our own database.

For signed-out visitors we store a salted hashof the IP address, never the address itself. It is enough to tell two visitors apart and not enough to identify either. When no salt is configured, that field is left empty rather than being filled with an unsalted hash — an unsalted hash of an IPv4 address can be reversed by brute force in seconds, which would make it a record of people's addresses dressed up as anonymised data.

• Your account and projects — until you delete them, or until you ask us to delete your account.
• Published sites — until you unpublish them or delete the project.
• Generation records — kept while they are useful for debugging and capacity planning, then removed.
• Contact messages — kept while the conversation is open and for a reasonable period after, so we have context if you write again.

Wherever you are, you can ask us to:

• Send you a copy of everything we hold about you.
• Correct anything that is wrong.
• Delete your account and everything in it, permanently.
• Export your sites as source code — which you can also do yourself, at any time.
• Stop processing your data for a particular purpose.

Ask through the contact page and we will do it. We do not require a specific form of words, and we will not put an obstacle course in front of a deletion request.

Ownership is enforced by the database rather than by application code. Every query for a project runs under your own session and is checked by row-level security, so a bug in our code cannot quietly return someone else's work. The administrative panel reads through the same mechanism rather than around it.

Traffic is encrypted in transit. Passwords are handled by Supabase and never reach our code. Access to production data is limited to the people who need it to run the service.

No system is perfect. If you find a vulnerability, please tell us through the contact page before telling anyone else, and we will credit you if you would like us to.

Framewise is a tool for building business websites and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, write to us and we will remove it.

Our processors operate internationally, so your data may be handled outside the country you live in — including in the United States. Where the law requires a transfer mechanism, we rely on the standard contractual terms offered by those processors.

When what the product does changes, this page changes with it, in the same release. The date at the top is the last time that happened. Material changes are announced by email to account holders rather than quietly edited in.

Questions about this policy, or a request to see or delete your data, go to the contact page or to privacy@framewise.app. A person reads it.

See also our terms of service, which cover what you can expect from us and what we expect from you.