Legal
Privacy Policy
This policy explains what personal data FrameHoist handles, why, who processes it, how long we keep it, and what rights you have. The most important point: your video never leaves your device.
Last updated: 24 October 2026
1. Who we are
The controller of your personal data is {{LEGAL ENTITY}}, a {{LEGAL FORM}} with its registered office at {{REGISTERED ADDRESS}} (company number {{COMPANY NUMBER}}, {{COUNTRY}}). We run FrameHoist at https://framehoist.com. For any privacy question, write to support@framehoist.com.
This policy applies to the FrameHoist website and service. It follows the UK GDPR and the EU GDPR where they apply to you.
2. The short version
- Your video file, its audio, its frames and its thumbnails are processed in your browser and are never uploaded to us or to any service provider. We do not store the enhanced result either.
- We store only what is needed to run your account, credits, payments and support: your name, email, a password hash, session tokens (hashed), your plan and credits, purchase records, job records (including the file name you gave) and contact-form messages.
- We use no analytics, no advertising cookies, no tracking pixels and no fingerprinting.
- We never use your content to train AI models, and we do not sell or share personal data.
3. Data we collect
This is the complete list of personal data we hold, and where it comes from.
| Data | Source | What it is for |
|---|---|---|
| Account: name, email address, password hash | You, when you sign up | Creating and securing your account. We never store your password itself, only a hash made with PBKDF2-SHA256 (100,000 iterations) and a random salt for each user. |
| Session tokens | Generated by our server when you sign in | Keeping you signed in. The token is random and 256 bits long, and only its SHA-256 hash is stored. The browser keeps it in the framehoist_session cookie. |
| Plan, credits and purchase records | Our server and Stripe | Giving you access and credits. Purchase records hold the Stripe checkout session id, amount, payment intent id and timestamps. We do not receive your card number. |
| Job records | You, when you start a job | Managing credits and showing your history: the file name you gave, duration, preset, output size, status and timestamps. The video itself is not included. |
| Contact-form messages | You, when you write to us | Answering your question: your name, email address and message. |
| Rate-limit counters | Generated by our server | Preventing abuse of sign-in, sign-up and the contact form. We store a hash of your IP address combined with the email address, not the plain IP address. |
| Email correspondence | You, when you email support | Handling refund requests, account requests and support. |
Your browser also sends technical information (such as its address and request details) to our hosting provider whenever you load a page. Cloudflare processes this to deliver the site and keep it secure.
4. What stays in your browser
- The video you select, its audio, its frames and thumbnails. They are decoded, processed and recorded locally in your browser (WebGL2 and MediaRecorder) and saved to your device as a download. If you close the tab, the output is lost.
- Your colour-theme choice, stored in your browser's local storage under the key
theme. - The
framehoist_sessioncookie, if you are signed in.
We cannot see, recover or delete any of this because it never reaches us. You control it through your browser and your device.
5. Why we use your data (legal bases)
| Purpose | Legal basis (UK GDPR / EU GDPR) |
|---|---|
| Creating and running your account, sessions, plan, credits and job records | Contract (Article 6(1)(b)): needed to provide the service you asked for |
| Processing payments and recording purchases | Contract; legal obligation (Article 6(1)(c)) for accounting and tax records |
| Security, rate limiting and preventing abuse and fraud | Legitimate interests (Article 6(1)(f)): keeping the service and its users safe |
| Answering contact-form messages and support emails, handling refunds | Contract where you are a customer; otherwise legitimate interests in responding to you |
| Keeping accounting records after account deletion (anonymised) | Legal obligation |
| Anything else that depends on your choice, for example optional cookies if we ever add them | Consent (Article 6(1)(a)), which you can withdraw at any time. We do not currently use any such cookies. |
Where we rely on legitimate interests, we have weighed them against your rights. You can object (see section 10).
6. How we use your data
- To provide the service: sign you in, reserve and return credits, link plans to your account and show your job history.
- To take payments and keep the records the law requires.
- To protect the service: rate limiting, abuse prevention and security monitoring.
- To reply to you and send service messages such as replies to your requests.
- We do not use your data for advertising or profiling, we do not make decisions about you by automated means that have legal or similarly significant effects, and we never use user content to train AI models.
7. Sub-processors and sharing
We share personal data only with the providers below, who process it on our behalf or, in Stripe's case, for payments. We do not sell personal data. We may disclose data where the law requires it or to protect rights and safety.
Swipe sideways to see all columns.
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, the account database (D1) and the Worker that handles sign-in, credits and the contact form. Your video is not sent to Cloudflare | United States / global network | Standard Contractual Clauses |
| Stripe, Inc. | Payment processing | United States / EU | Standard Contractual Clauses |
Neither provider receives your video. If we change providers, we will update this table.
8. How long we keep data
| Data | Retention |
|---|---|
| Account, plan and credits | Until you delete your account. Deletion on the Account page is immediate. |
| Session tokens | Up to 30 days, or until you sign out or delete your account |
| Job records (including file names) | 90 days, then deleted automatically, or immediately if you delete your account |
| Purchase records | Kept for accounting and tax purposes. After account deletion the link to you is removed and the record is kept in anonymised form. |
| Contact-form messages | 12 months |
| Support emails | Kept while needed to handle your request and any follow-up, and no longer than the period the law requires or that is needed to deal with a dispute |
| Rate-limit counters | Up to 24 hours |
| Your video, its frames and the enhanced output | Never held by us |
When you delete your account, we immediately delete your account, sessions, plan and job records.
9. International transfers
Our providers operate globally, so your personal data may be processed outside the UK and the EU, including in the United States. Where that happens we rely on an approved safeguard: the UK International Data Transfer Agreement or UK Addendum, the EU Standard Contractual Clauses, or the Data Privacy Framework where the provider is certified. The safeguard each provider relies on is listed in the table in section 7. You can ask us for details by emailing support@framehoist.com.
10. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased (you can also delete your account yourself on the Account page);
- restrict how we use your data in certain cases;
- receive your data in a portable format;
- object to processing based on legitimate interests; and
- withdraw consent at any time where we rely on it, without affecting earlier processing.
To exercise a right, email support@framehoist.com from the address on your account. We may need to verify your identity. We will respond within one month, and can extend that period by up to two further months for complex requests, in which case we will tell you. We do not charge a fee unless a request is clearly unfounded or excessive. We cannot retrieve your video or its output, because we never receive them.
11. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to the supervisory authority in your country or the authority where {{LEGAL ENTITY}} is established ({{COUNTRY}}). In the UK this is the Information Commissioner's Office (ICO), ico.org.uk.
12. US state privacy notes
If you live in a US state with a privacy law, such as California, you may have the rights to know, access, correct, delete and receive a copy of your personal data, and to opt out of sale, sharing and targeted advertising. We do not sell or share personal data, and we do not use it for targeted advertising. We do not knowingly collect sensitive personal data. You will not be treated differently for exercising a right. To make a request, email support@framehoist.com.
13. Children
FrameHoist is for people aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, email support@framehoist.com and we will delete it.
14. Security
We protect personal data with encrypted connections, hashed passwords, hashed session tokens, rate limiting, same-origin checks and restricted access. Because your video never leaves your device, it cannot be exposed through our systems. The Security page describes our measures in detail.
15. Cookies and local storage
We set one strictly necessary cookie, framehoist_session, after you sign in or sign up, and we store your colour-theme choice in local storage. We use no analytics, advertising or tracking cookies. See the Cookie Policy.
16. Changes to this policy
We may update this policy as the service or the law changes. We will post the new version here with a new “Last updated” date and, for material changes, give notice on the site or by email to your account address.
17. Contact
{{LEGAL ENTITY}}, {{REGISTERED ADDRESS}}. Email support@framehoist.com (support hours: Mon to Fri, 09:00 to 17:00 UTC), or use the contact page.
Questions? Contact {{LEGAL ENTITY}} at support@framehoist.com, via our contact page.