Privacy Policy
Last updated: August 3, 2026
1. What we collect
To provide the service, FrameSet stores: your name, your email address, your password (as a bcrypt hash — never in clear text), and the content you create (projects, palettes, typography and brush specifications). If you sign in with Google, we store your Google account identifier and the name and email address Google shares with us; we never see your Google password. If you turn on two-factor authentication, we store your authenticator secret encrypted (never in clear text) and your recovery codes hashed, the same way passwords are. Some features never send us anything at all: palette files you import, images you extract colors from and the screen eyedropper are processed entirely in your browser — none of it is uploaded to our servers.
2. What we use it for
Your data is used solely to operate FrameSet: authenticating you, displaying your projects, sending transactional emails (verification codes, password-reset codes and security alerts), and generating your exports. We do not sell your data, and we do not use it for advertising.
3. Cookies
FrameSet uses first-party cookies only, strictly for authentication and security: an access token, a refresh token (both HttpOnly, inaccessible to scripts) and a CSRF protection token. There are no advertising or cross-site tracking cookies. A local preference also remembers your light/dark theme choice.
4. Public sharing
You may generate a public share link for a project. Anyone with that link can view the project's reference sheet — its colors, typography and brush specifications — without an account, along with your display name shown as a "Made by" credit. When a share link is pasted into a chat or social platform, that platform is also served a small preview image of the project (its name, your display name and its palette) — the same information as the page itself, nothing more. Your email address and account details are never exposed. You can revoke a share link at any time from the project; once revoked, the link — and its preview image — stops working immediately.
5. Third-party services
A few external services are involved: Google Fonts (to list and preview the typefaces you pick for your projects, and to fetch them again when embedding them in your PDF exports) and Google Sign-In (only if you choose to continue with Google, under Google's privacy policy). Transactional emails are delivered through our email provider. To keep the service reliable, technical error reports (an error message, a request identifier and technical context — never your password or the content of your projects) may be processed by our error-monitoring provider, Sentry. Like most services, our servers also keep short-lived technical logs (including IP addresses) used solely for security and rate limiting.
6. How your data is protected
Passwords are hashed with bcrypt, one-time codes and recovery codes are stored hashed, sessions use HttpOnly cookies with short lifetimes and server-side revocation, and every sensitive action (password or email change, new sign-in method, enabling or disabling two-factor authentication, regenerating recovery codes) triggers a security alert email. You can add an optional second authentication factor (a code from an authenticator app) from your profile at any time. All traffic is encrypted in transit (HTTPS).
7. Retention and deletion
Your data is kept for as long as your account exists. Deleting a project, a color or a standard does not erase it immediately: it is kept in a recoverable trash for 30 days, so you can undo an accidental deletion, then permanently purged. Deleting your account from your profile page is different — it is immediate and permanently removes your account and all associated projects, bypassing the trash. You can also update your name, email and password at any time.
8. Your rights
Depending on where you live (e.g. under the GDPR), you may have rights of access, rectification, portability and erasure over your personal data. Most of these are available directly in the app; for anything else, write to axelle.tempier@gmail.com.
9. Changes to this policy
We may update this policy from time to time; the "Last updated" date above reflects the latest revision. See also the Terms of Service.