Privacy Policy

Techiebutler ("we", "us", or "our") operates FreeFrame at freeframe.io. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our collaborative media review platform.

1. Information We Collect

We collect information in the following ways:

• Account information: When you register, we collect your email address and, if you choose Google OAuth, your name and profile picture from your Google account.
• Media files: Videos, images, and audio files you upload for review, along with associated metadata such as file names, sizes, and formats.
• Comments and annotations: Timestamped comments, drawing annotations, and approval decisions you create during media review.
• Usage data: Browser type, IP address, pages visited, and feature usage to help us improve the service.
• Referral source: If you reached us through a tagged marketing link, the platform it came from (for example instagram) and its campaign label, recorded on your account when you sign up.
• Device information: Operating system, screen resolution, and browser version for compatibility and debugging purposes.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the FreeFrame platform.
• Authenticate your identity and manage your account.
• Process and deliver media files for collaborative review.
• Send transactional emails such as magic login codes, workspace invitations, and review notifications.
• Monitor service health, detect abuse, and ensure platform security.
• Respond to support requests and communicate service updates.

3. Marketing Communications

Product announcements and marketing emails are sent only with your consent, and every such email includes a one-click unsubscribe. You can update your email preferences at any time from your account settings; transactional emails (such as sign-in codes and billing receipts) are not marketing and are always delivered.

4. Data Storage & Security

Your media files are stored in S3-compatible object storage (such as AWS S3, Cloudflare R2, or Backblaze B2, depending on the deployment). All files are stored with unique, non-guessable keys and are only accessible via time-limited presigned URLs.

Application data (account details, comments, project metadata) is stored in a PostgreSQL database. All data is encrypted in transit using TLS/HTTPS. We follow industry-standard security practices including JWT-based authentication, bcrypt password hashing, and strict access controls.

We implement organizational and technical measures to protect your data against unauthorized access, alteration, disclosure, or destruction.

5. Third-Party Services

We use the following third-party services:

• Stripe: Processes subscription payments. Stripe handles your card details directly; we never see or store your full card number. We retain only non-sensitive billing metadata (customer and subscription identifiers, plan, and status).
• Google OAuth: If you choose to sign in with Google, we receive your email, name, and profile picture from Google. Google's privacy policy applies to information they process.
• Amazon Web Services (AWS SES): We use AWS Simple Email Service to send transactional emails. Your email address is shared with AWS for this purpose.
• Cloud infrastructure providers: We use cloud providers (such as AWS, Cloudflare, or similar) for hosting, storage, and content delivery. These providers process data on our behalf under strict contractual obligations.
• Google Analytics: We use Google Analytics 4 to count page views and understand which parts of the site are used. It receives your IP address, browser and device details, the address of the page you are viewing, and that page's browser tab title, which on a project or asset page is the project or file name. We do not send Google your email address, your account identifier, your comments, or your media files. See 6. Cookies and Analytics below for what we redact from page addresses before they are sent, and which pages are excluded entirely.

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

6. Cookies and Analytics

FreeFrame stores the following in your browser:

• Authentication cookies: We store JWT access and refresh tokens in cookies to keep you signed in across sessions and subdomains.
• Theme preference: We store your light/dark mode preference in local storage.
• Analytics cookies: Google Analytics 4 sets its own cookies (_ga and related) on the freeframe.io domain to recognize a returning browser and count visits. These are set on freeframe.io and its subdomains, including before you sign in, but not on the share and invitation pages described below.
• Attribution cookie: If you arrive through a tagged marketing link, we store which link brought you in a cookie named ff_attr, set on freeframe.io and its subdomains for 90 days. It records your first and your most recent tagged visit, and for each one it holds the platform name (for example instagram), a short campaign label, and the time you arrived. It never contains your name, your email address, or anything else that identifies you. If you create an account, we copy it onto that account so we can tell which platforms bring people to FreeFrame, and then clear the cookie.

Before a page address is sent to Google Analytics we redact it: share and invitation links have their token replaced with a placeholder, and every query parameter is dropped except campaign and advertising-click tags (utm_*, ref, gclid and similar) and the tab you are on. The same redaction is applied to the address of the page you came from, which your browser would otherwise attach to the next page's analytics event. Analytics is not loaded at all on share pages or invitation pages, so those addresses are never sent. Google Analytics does also receive the browser tab title of the page you are viewing, which on a project or asset page is the project or file name. We do not use advertising cookies, tracking pixels, or cross-site trackers.

If you would rather not be counted, Google publishes a browser opt-out add-on at tools.google.com/dlpage/gaoptout, and blocking analytics scripts in your browser or extension of choice has no effect on how FreeFrame works.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data and account.
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Restriction: Request that we limit the processing of your data in certain circumstances.
• Objection: Object to the processing of your data for certain purposes.

To exercise any of these rights, contact us at [email protected] for privacy-specific inquiries, or [email protected] for general support. We will respond within 30 days.

8. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law.

Media files and associated comments are retained for the lifetime of the project they belong to. When a project or organization is deleted, all associated media and data are permanently removed from our storage within 30 days.

Billing records. Where you hold a paid subscription, we retain invoices and subscription history for as long as required for tax and accounting purposes.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of FreeFrame after changes are posted constitutes acceptance of the updated policy.

10. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at: