Security

1. Our approach

We keep the amount of data we hold small, protect what we do hold with standard, well-understood measures, and say plainly what we do and do not do. This page should be read with the Privacy Policy.

2. Your video stays on your device

You pick a video file on your device. It is decoded and processed locally in your browser with WebGL2, recorded with the browser's MediaRecorder and saved as a download. The video, its audio, its frames and its thumbnails are never uploaded to us or to any sub-processor, and we do not store the result. There is no server-side video processing, so there is no copy of your footage on our systems that could be exposed. If you close the tab before saving, the output is lost.

3. Infrastructure

The FrameHoist website is a static site served from Cloudflare's global network. Account, credit and contact functions run in a Cloudflare Worker and store data in Cloudflare D1. We do not run our own servers.

4. Encryption in transit and at rest

• In transit: the site and its server functions are served over HTTPS with TLS only. Plain HTTP requests are redirected to HTTPS.
• At rest: the database is encrypted at rest with provider-managed encryption.

5. Passwords

We never store your password. We store a hash made with PBKDF2-SHA256 using 100,000 iterations and a random salt for each user. We cannot read your password or recover it for you.

6. Sessions and cookies

• When you sign in, we create a random 256-bit session token. Only its SHA-256 hash is stored in our database, so a database copy does not contain usable tokens.
• The token is sent in the framehoist_session cookie, which is HttpOnly (not readable by page scripts), Secure (sent only over HTTPS) and SameSite=Lax. It lasts 30 days.
• Signing out ends the session. Deleting your account deletes all your sessions.

See the Cookie Policy for details.

7. Rate limiting and request checks

• Sign-in, sign-up and the contact form are rate limited to slow down password guessing and automated abuse. The counters use a hash of the IP address combined with the email address and are kept for up to 24 hours.
• Requests that change data are checked to come from our own site (same-origin checks) to protect against cross-site request forgery.
• The site sends security headers to limit how pages can be framed, how content is loaded and what browsers may infer about it.

8. Payments

Payments are handled entirely by Stripe, which is certified PCI DSS Level 1. You enter your card details on Stripe's pages. We never see or store card numbers. We keep only a purchase record: the Stripe checkout session id, the amount, the payment intent id and timestamps. Plans are one-time payments with no automatic renewal.

9. Data retention and deletion

• Job records (file name, duration, preset, output size, status and timestamps) are deleted automatically after 90 days.
• Contact-form messages are kept for 12 months. Rate-limit counters are kept for up to 24 hours.
• Deleting your account on the Account page immediately deletes your account, sessions, plan and job records. Purchase records are kept for accounting with the link to you removed.

The full schedule is in the Privacy Policy.

10. Access control

The administration area is restricted to named accounts. Access is limited to what is needed to run the service, answer support requests and handle refunds.

11. Monitoring and logging

The service runs on Cloudflare Workers with Cloudflare's observability tools enabled, so we can see request errors and failures. Our own log lines record only the type of an error, never passwords, request bodies, video content or file contents. Rate-limit counters use a one-way hash of the network address and email, and are deleted within 24 hours.

12. Incident response

If we become aware of a security incident that affects personal data, we assess it, contain it, fix the cause, and notify affected users and the relevant authorities where required, without undue delay and within the legal deadlines.

13. Reporting a vulnerability

If you find a security problem, email support@framehoist.com with the subject “Security” and the details needed to reproduce it. We welcome good-faith research. Please:

• do not access, change or delete data that is not yours, and stop as soon as you have shown the issue;
• do not run tests that degrade the service, such as denial-of-service or heavy automated scanning;
• give us reasonable time to fix the problem before you disclose it publicly.

We do not run a bug bounty programme and do not pay rewards. We will acknowledge reports and aim to keep you informed.

14. Sub-processors

15. Certifications

{{LEGAL ENTITY}} does not currently hold independent security certifications and has not commissioned an external audit or penetration test. Stripe's PCI DSS Level 1 certification covers Stripe's own systems, which handle your card data. We will update this page if our position changes.

16. What you can do

• Use a strong, unique password and do not share it.
• Sign out on shared computers and keep your browser up to date.
• Keep your own copies of your source videos and finished files, since we do not hold them.
• Tell us at support@framehoist.com if you suspect your account was accessed without your permission.