Privacy Policy
Who operates this service
Frame-zi is operated by Collin Baker in Wisconsin, United States. This policy covers frame-zi.com, its Android app and its installed web app. For privacy questions or requests, contact the operator at [email protected]. Effective date: October 29, 2026.
Age requirements
Accounts are for people aged 13 or older. Users aged 13–17 need a parent or legal guardian’s permission and agreement to the Terms of Service. Higher local age or consent requirements also apply. The age screen records a self-declared age group and guardian-permission statement, not a birth date or identity document. It is not verified age assurance or verified parental consent. We do not offer accounts for children under 13. If you believe we hold a child’s personal information, contact us so we can restrict the account, investigate and remove data as appropriate. Do not send a child’s identity documents or sensitive information by email.
Information collected
Account data includes email, display name, password hash and salt, verification status, and account identifiers. A nickname may be used as your display name. We store your selected age group, policy versions and acceptance time. Optional profile fields include your avatar, handle, biography, pronouns, studio, location, time zone, links and status. Avoid precise locations, school details and contact information, especially for younger users.
Workspace and safety data
We store documents, boards, roadmaps, moodboards, embedded images, previously uploaded files, comments, chat messages, reactions, tasks, activity records, versions, sharing permissions, email invitations, friendships, blocks and safety reports. Collaboration processes online presence, cursors and editing activity. Hosting and security services also process technical request information such as IP address, browser information, timestamps and logs. Security rate-limit keys in the application use hashed IP addresses or emails; infrastructure providers may separately process original request data.
Teams, playtest forms and game reports
Teams store membership, roles and invitations. Team owners may authorize admins to manage membership; joining gives access to the team folder. Weekly goals, dialogue graphs, localization tables and game-jam settings are stored as workspace data. A table owner can publish selected question names through an unlisted feedback link. Anyone with the link can see those questions. Submitted answers, game bug reports and optional screenshots are stored in the owner’s table and visible to people with table access, and processed by Frame-zi and its providers. Public form respondents must complete the eligibility screen before submitting. Game developers must obtain appropriate age eligibility, guardian permission where required and reporting permission before using the report integration, and provide their own privacy information. The examples do not send player names or account IDs; screenshots start disabled. Do not request reports from children under 13 or collect sensitive personal information.
Why we use information
We use information to authenticate accounts, deliver verification and recovery emails, store and synchronize work, enforce sharing permissions, support social features, respond to requests, investigate abuse, maintain security and comply with applicable legal obligations. We do not use workspace content to train an AI model in this application. Payments and subscription checkout are currently paused. No payment card information is collected by the current Frame-zi app.
Who can see your information
Your display name, avatar and handle identify you in collaboration and exact handle/email lookup. Detailed profile fields are shown to you and accepted friends. Email addresses are not generally shown to other users; resource owners can see addresses associated with sharing and pending invitations. Shared-folder permissions can give people access to documents within that folder. Owners control sharing. Conversations are visible to their members; adding a member to a channel exposes its history. Recipients can copy, export or screenshot content they can access. Removing access does not erase their copies. Blocking stops direct conversations and friend requests, but does not revoke existing shared-document or channel membership. Manage those permissions separately.
Service providers and other disclosures
Cloudflare hosts the app, database, real-time services, file storage and security infrastructure. Resend delivers account verification and password-reset emails and processes recipient addresses and delivery information. Google provides optional sign-in and the fonts loaded by the website. Provider processing may occur in the United States and other countries. We may disclose information when reasonably necessary to comply with law, protect people or the service, investigate abuse, or carry out a legally permitted business transfer with appropriate notice. We do not sell personal information or share it for cross-context behavioral advertising.
Google sign-in
When you choose Google sign-in, we request basic identity information: name, email and account identifier. We store the identifier and account email needed to connect your account. Google access and refresh tokens are not saved by Frame-zi. This integration does not request Gmail, Drive, contacts or calendar access. Existing password accounts require an explicit authenticated connection rather than being silently linked by matching email. Revoking access at Google does not delete your Frame-zi account.
Cookies, browser storage and external content
Essential cookies maintain sign-in, protect Google sign-in and remember a short-lived account-eligibility check. HTTPS sign-in cookies are Secure and HttpOnly and normally expire after 30 days. Eligibility cookies last up to 30 minutes; an under-age restriction cookie lasts up to 24 hours. Local browser storage remembers interface preferences. The service worker does not cache authenticated API responses or uploaded files for offline use. External images or links chosen by users can cause requests to third-party hosts, which may receive IP and browser information; do not load links you do not trust. Website fonts also cause requests to Google. Clearing local storage or uninstalling the app does not delete server data.
Tracking choices
The app does not include advertising trackers or behavioral analytics. It therefore does not change these practices in response to Do Not Track or Global Privacy Control signals. Essential security processing still occurs. External sites and providers have their own practices.
Retention and deletion
Account and workspace information is retained while needed to provide the account and its shared work, until deleted or a deletion request is processed, subject to safety and legal exceptions. Trash retains documents until you permanently delete them. Versions and collaboration records may contain earlier content. Automatic document history is bounded to 60 versions; named versions remain until the document is permanently deleted. Verification links expire after 24 hours, reset links after 30 minutes and Google sign-in flows after 10 minutes. Expired authentication and rate-limit records are removed by daily cleanup. Unaccepted invitations expire and are removed after 90 days. Safety reports are normally removed after 180 days unless information is separately preserved for an active investigation or legal requirement. Provider logs, recovery systems and backups follow the provider’s own retention; we cannot promise instant erasure from every backup. Shared content and copies retained by other users may not be removed by deleting your account.
Your choices and requests
You can edit your profile, remove friends, block people, manage sharing, export individual documents using the app’s controls, delete messages where supported, and permanently delete owned documents from Trash. For access, correction, a copy of your data, account deletion, a privacy complaint or a guardian’s request, email [email protected] from your account address. We may ask for reasonable verification of ownership and clarify shared-content handling. Do not send passwords. We will respond as required by applicable law. Some data may need to be retained to meet legal obligations, resolve disputes, protect others or investigate abuse; we will explain applicable limits. Legal rights depend on your location and the law’s applicability.
Security and changes
The service uses HTTPS, password hashing, authenticated access controls and other safeguards. Workspace content is not end-to-end encrypted; the operator and service providers can technically access stored content when needed to operate or protect the service. No service is completely secure. Do not store passwords, payment card data, medical records or other highly sensitive information here. Material changes will be reflected in the effective date, with in-app review when account requirements change. Review this notice before using changed features.
Provider policies
Cloudflare · Resend · Google.
Last updated October 29, 2026.