Privacy Policy

FRGMT Labs, Inc. ("we," "us," or "our") operates FRGMT at frgmt.app. This Privacy Policy explains how we collect, use, and protect information when you use our Service, and when your clients view what you deliver through it. By using FRGMT, you agree to the collection and use of information as described in this policy.

Information you provide:

• Account information: name, email address, and password, or your Google account name and email if you sign in with Google
• Profile information: display name, studio name, avatar, brand colors, social links, specialties
• Billing information: payment method details processed securely by Stripe; we do not store card numbers or payment credentials
• Payout and print setup information: if you join the affiliate program or sell prints, the details Stripe needs to pay you, which Stripe collects and holds, and the ship-from name, address and phone number you enter for print orders
• Content: photos, videos, and other files you upload to the Service, with their file names and the folder, view and comment information you add
• Communications: messages you send to our support team, beta feedback, and newsletter sign-ups

Information collected automatically:

• Usage data: views created, deliveries sent, files uploaded, features accessed, and actions taken within the Service
• Delivery engagement data: when your clients open a delivery or share link, download files, play an embed (with the website it was played on), leave comments, or mark Selects. These records use a random identifier stored in the client's browser, not a name or IP address.
• File checks: when an uploaded file's contents do not match its type, we record the file name, its claimed and detected type, and what we did with it, so we can spot disguised files
• Device and technical data: browser type, operating system, IP address, and referring URLs, in the logs of our hosting providers. FRGMT does not store visitors' IP addresses itself.
• Performance data: page load timings, measured on every page by Vercel Speed Insights without cookies. It is essential to running the Service and is never used for advertising.
• Desktop application data: file sync activity, watch folder configurations, and upload events generated by FRGMT Desktop
• Cookies and similar technologies, described in §10

Information about your clients and other visitors:

When you share content with clients through FRGMT, we process information about them on your behalf:

• email addresses you enter for delivery notifications, or that a client enters to open a delivery or to save their Selects;
• comments a client leaves, with the name they choose to give (a name is optional unless you require one on a React view);
• files a client sends you through an upload link;
• for print orders, the buyer's name, email address, shipping address and phone number if given, and the order details. Payment details go to Stripe and are not stored by us.

We use information to:

• Provide, operate, maintain, and improve the Service
• Process payments and manage your subscription; process print orders and pay studios and affiliates
• Send transactional communications including receipts, delivery notifications, comment and Selects notifications, storage and retention warnings, and password resets
• Send our newsletter, if you have opted in; you can unsubscribe at any time
• Track storage usage and enforce plan storage limits
• Administer referral and affiliate programs
• Respond to your support requests and to reports
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with applicable legal obligations

Artificial intelligence and machine learning. We do not use your uploaded content, or your clients' comments, to train, develop, or improve any artificial intelligence or machine learning model, and we do not let any provider listed in §5 do so. We do not sell your personal information, and we do not use your content for advertising.

If you arrive through a referral or affiliate link, we store the referral code in a cookie for 30 days so it can be applied when you sign up. If you participate in the FRGMT referral or affiliate program, we collect and store referral code usage, referral events, and associated account relationships. This data is used to calculate and apply referral discounts and affiliate compensation.

We use these providers to run the Service. Each receives only what it needs for the work described, is bound by contract to protect it, and may not use it for its own purposes.

• Supabase: database and sign-in. Receives account, team, folder, view, comment, client email, order and log records, and password hashes.
• Cloudflare: file storage (R2), content delivery, image resizing, and the systems that build zip downloads, extract video frames and make playback copies. Receives every uploaded file and the copies made from it, and visitors' IP addresses and requests as they pass through.
• Vercel: application hosting, page performance measurement, and visitor analytics on our marketing pages (only after you accept cookies there). Receives requests to the app, including IP addresses, in its logs; page timings; marketing page visits.
• Stripe: subscription billing, client print payments, and payouts to studios and affiliates (Stripe Connect), including the identity checks Stripe requires. Receives name, email, billing and payout details, and print order amounts.
• Resend: sending email. Receives recipient email addresses and email contents.
• WHCC: printing and shipping print orders. Receives the print files for each order, and the buyer's name, shipping address and phone number if given.
• Dropbox and Google: importing files you choose, only when you connect an account; Google also for Google sign-in. Receive the requests needed to list and download the files you pick; for sign-in, Google confirms your name and email to us.

We share information only:

• with the providers in §5, to operate the Service;
• with the studio you are dealing with, if you are a client: your comments, Selects, downloads, print orders and the email you entered are shown to that studio;
• with law enforcement, regulators, or courts when we receive valid legal process such as a subpoena, court order, or warrant, or when we believe in good faith that disclosure is needed to prevent an imminent risk of death or serious physical injury. Unless the law forbids it, or telling you would put someone at risk or hinder an investigation, we tell you before we disclose your information in answer to legal process;
• with a successor entity in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections.

We do not share your information with advertisers or data brokers.

When you deliver content to clients through FRGMT, we process their data on behalf of you, the account holder. Your clients' interaction with delivered content (views, comments, Selects, downloads) is logged and made available to you through your FRGMT dashboard. We process this data solely to provide the Service to you. If a client asks us about their data, we will refer them to you, and help you answer.

• Account, content and client data: while your account is open.
• Files you delete: 30 days in Trash, then permanently deleted.
• After a paid plan ends: the highest-resolution video playback copies are removed at day 60, a final warning email is sent at day 80, and every file is deleted at day 90. The account and its other records (folder and view names and settings, file names, comments, Selects, client email addresses and delivery activity) stay until you delete the account.
• After you delete your account: files, folders, views, comments, team data, file check records and connected-account tokens are deleted at once. Billing records are kept as tax law requires.
• File check records: 90 days, or until the account is deleted if that is sooner.
• Hosting provider logs: as set by each provider.
• Billing records: as required by applicable tax and accounting law.

We implement industry-standard security measures including encryption in transit and at rest, access controls, API token authentication for desktop and third-party integrations, and regular security reviews. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

We use cookies and browser storage only to run the Service. We do not use advertising cookies.

• Sign-in cookies: keep you signed in, until you sign out or the session expires.
• Workspace cookie: remembers which team you are working in, for 30 days.
• Delivery access cookie: remembers that a visitor entered a delivery's password, for 30 days.
• Embed access cookie: remembers access to a password-protected embed, for 12 hours.
• Referral cookie: applies a referral code at sign-up, for 30 days.
• Beta invite cookie: completes a beta invitation, for 1 hour.
• Cookie choice: remembers your answer to our cookie banner, for 1 year.
• Analytics (Vercel Analytics): counts visits to our marketing pages, only after you accept, without third-party cookies.
• Browser storage on deliveries: a random identifier so a client can see their own comments and Selects, the name they chose for comments, and a Selects link, until the visitor clears their browser.
• Browser storage in the app: display preferences such as sort order, until cleared.

Page performance measurement (Vercel Speed Insights) runs on every page, uses no cookies, and is part of running the Service. You can control cookies through your browser settings, though disabling certain cookies may affect your ability to use the Service.

Depending on your location, you may have rights regarding your personal data including the right to access, correct, delete, or export your data, and to object to or restrict some uses. You can delete your account at any time from your settings. To exercise these rights, contact us at [email protected]. We will respond to verified requests within 30 days. We may refuse or delay a request where the law requires us to keep the data.

The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If you are under 18, do not use the Service or provide any information to us. If we learn we have collected personal information from a user under 18, we will delete that information promptly. If you believe a minor has provided us with personal information, contact us at [email protected]. Photos and videos of minors uploaded by a studio are the studio's content and are covered by the studio's own obligations; they are not information we collect from a minor.

FRGMT is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

FRGMT lets you connect third-party accounts, such as Dropbox and Google Drive, to import your media directly into the Service. When you connect an account, we store the OAuth access (and, where applicable, refresh) tokens that authorize FRGMT to access the files you choose to import. We do not receive or store your third-party account password or login credentials. We use these tokens solely to perform the imports you request. You can disconnect a connected account at any time from your settings, which revokes FRGMT's access with the provider and deletes the stored tokens; deleting your FRGMT account does the same. Your use of a connected service is also subject to that provider's own terms and privacy policy.

Google Drive. FRGMT connects to Google Drive using the drive.file scope, which grants access only to the specific files you individually select through the Google Picker. FRGMT cannot see, list, or access any other files in your Google Drive. We use the files you select for a single purpose: to download them and import them into your FRGMT library at your request. We do not use Google user data for advertising, we do not sell it, we do not use it to train AI or machine learning models, and we do not share it with third parties except as needed to provide the import (for example, our cloud storage provider that holds your imported files). When you disconnect Google Drive, or delete your FRGMT account, we delete the stored tokens and revoke FRGMT's access with Google.

FRGMT's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We may update this Privacy Policy at any time. We will notify you of material changes via email or in-app notification. The date at the top of this policy indicates when it was last updated.

For privacy questions, data requests, or concerns, contact us at [email protected].