Privacy policy
Last updated 18 October 2026
This policy explains what personal data we collect when you use Frameleaf, why we collect it, who we share it with and the rights you have over it.
In short:
- We collect what we need to run your account, show your work and keep the service safe.
- Analytics only run if you accept them in the cookie banner.
- We don't sell personal data, we don't run ads, and we don't use your uploads or activity to train AI models.
- Your channel, public works and comments are public. My list and history are private.
- You can delete your account yourself in your account settings, and ask us for a copy of your data at any time.
Who we are
Frameleaf is operated by Digital Brainwave, which is the controller of your personal data. For anything about privacy, email privacy@frameleaf.co.uk.
What we collect
Account data
Your email address, password (stored only as a secure hash), username, name, whether your email is verified and your preferences (mature content, autoplay and theme).
Profile data
Anything you add to your profile: avatar, banner, bio, website and social links.
Content you post
Works and the files that make them up, thumbnails, titles, descriptions, AI disclosures, tags, series, comments and ratings.
Activity
What you view, your progress in each work (video position, comic page and how far you've scrolled in a story), My list, your history, who you follow, your ratings and comments, your notifications, and reports you make or that are made about your content.
Support messages
What you send us in support requests and emails, and our replies.
Sign-in provider data
If you choose to sign in with Google or GitHub, we receive your name, email address, account ID with that provider and avatar.
Technical data
Your IP address, device and browser type, the pages you request and server logs. On the sign-up page, Cloudflare Turnstile checks signals from your browser to tell people from bots.
Cookies and analytics
We use essential cookies and local storage to keep you signed in and remember your settings. If you accept analytics, Google Analytics and PostHog collect information about the pages you visit and how you use the site. When you're signed in, PostHog links that information to your account ID. The cookie policy has the details.
How we use your data and why
UK GDPR requires a lawful basis for each way we use personal data. Here is what we do and the basis we rely on.
| What we do | Data used | Lawful basis |
|---|---|---|
| Create your account and sign you in | Account data, sign-in provider data | Contract |
| Host your content and show your channel | Content, profile data | Contract |
| Save your progress, list, history and follows, and send notifications | Activity | Contract |
| Send account emails, such as verification, password resets, moderation notices and support replies | Email address, account data | Contract |
| Count views and show creators their analytics | Activity, technical data | Legitimate interests: giving creators accurate numbers |
| Power search across public works, series and creators | Public content and profile data | Legitimate interests: helping viewers find work |
| Keep the service safe: moderation, reports, bot checks, security and preventing abuse | Content, activity, reports, technical data | Legitimate interests: protecting users and the service; legal obligation where the law requires it |
| Answer support requests | Support messages, account data | Contract; legitimate interests |
| Understand how the service is used so we can improve it | Analytics data | Consent |
| Meet our legal obligations and respond to lawful requests | Any data needed for the request | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time.
What's public
Some of what you share on Frameleaf is public by design. Anyone, including people without an account and search engines, can see:
- your channel: name, username, avatar, banner, bio, website and social links
- works and series you set to Public, and Unlisted ones to anyone with the link
- comments you post
- rating totals on each work
My list, your history and your progress are private to you.
Who we share data with
We use a small number of service providers (processors) who handle data on our behalf, under contracts that limit what they can do with it:
- our hosting provider, which runs our servers and database
- S3-compatible object storage, which stores uploaded media
- Resend, which sends our transactional emails
- Cloudflare Turnstile, which runs the bot check on sign-up
- Google and GitHub, only if you choose to sign in with them
- PostHog and Google Analytics, only if you accept analytics
Our search runs on Meilisearch, which we host ourselves. Its index holds public works, series and creators only.
When you play a video embedded from YouTube or Vimeo, that provider receives data from your browser under its own privacy policy.
We may also disclose data when the law requires it, to respond to valid legal requests, or to protect someone's safety. We report child sexual abuse material to the relevant authorities.
We never sell personal data. We don't run ads, and we don't share data with anyone for advertising.
AI training
We don't use your uploads or activity to train AI models, and we don't let third parties do so. We don't give or license your content to anyone for that purpose.
How long we keep data
- Account data: while your account exists. When you delete your account we erase your email address, name, username, bio, links, avatar, banner, sign-in connections, sessions, follows, list, history, ratings and notifications immediately, and delete your works, series and anything else left after 30 days.
- Content removed by moderation: 90 days, so it can be restored if an appeal succeeds, then deleted automatically. We keep it longer where the law requires or a complaint or investigation is open, for example to preserve child-safety reports.
- Server logs: up to 30 days.
- Analytics: up to 26 months, in aggregated form.
- Support records: 3 years.
View counts are stored per work per day. To stop repeat views inflating them, we count one view per viewer every 6 hours.
Your rights
Under UK GDPR, you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data erased
- restrict how we use your data
- receive your data in a portable format
- object to how we use your data, including where we rely on legitimate interests
- withdraw consent at any time, where we rely on consent
You can change much of your data yourself in your settings, and you can delete your account in your account settings by confirming your username, and your password if your account has one. Deleting your account erases your personal details straight away (see "How long we keep data") and removes you from the follower lists of the creators you followed; your email address can be used to register again. There is no self-serve export yet, so to get a copy of your data, or for any other request, email privacy@frameleaf.co.uk. We may ask you to confirm your identity, and we'll respond within one month.
If you're unhappy with how we've handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Children
You must be 13 or older to have an account. We don't knowingly collect personal data from children under 13. If we learn that we have, we delete the account and its data. If you're a parent or guardian and think your child under 13 has an account, email privacy@frameleaf.co.uk.
International transfers
Some of our service providers may process data outside the UK. When they do, we make sure it is protected by an appropriate safeguard: UK adequacy regulations, the International Data Transfer Agreement (IDTA), or standard contractual clauses with the UK Addendum.
Security
We protect your data with encryption in transit (TLS), passwords stored only as secure hashes, and access controls that limit who can see personal data. You can also sign in with Google or GitHub instead of a password. No system is perfectly secure. If a breach affects your data, we'll tell you and the ICO where the law requires.
Changes to this policy
We'll update this page when our practices change and change the date at the top. If we make a material change, we'll tell you by email or on the site.
Contact
Email privacy@frameleaf.co.uk with any question about this policy or your data. You can also reach us through our contact page.