Privacy Policy
Learn how we collect, use, and protect your personal information.
Last updated: January 1, 2026
At Frostleaf, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services. Please read this policy carefully. If you disagree with its terms, please discontinue use of the site.
1. Information we collect
We collect information you provide directly to us, such as when you create an account, update your profile, or contact us for support. This may include:
- Your full name and email address
- Profile information such as a username and avatar
- Billing information, including payment method details
- Communications you send us, such as support requests or feedback
- Any other information you voluntarily choose to provide to us
1.1 Automatically collected data
We also automatically collect certain information when you use our services, including:
- Log data
- IP address and approximate geolocation
- Browser type and version
- Pages visited and time spent on each page
- Device information
- Hardware model and operating system version
- Unique device identifiers
- Usage data such as features used and actions taken
1.2 Data we do not collect
We explicitly do not collect:
- Precise GPS location
- Contacts or address book data
- Camera or microphone data
- Biometric data of any kind
2. How we use your information
We use the information we collect to provide, maintain, and improve our services. Specifically, we may use it to:
- Create and manage your account
- Process transactions and send related information
- Send administrative information such as confirmations and updates
- Respond to your comments, questions, and support requests
- Send promotional communications, if you have opted in to receive them
- Monitor and analyze usage patterns to improve the service
- Detect, investigate, and prevent fraudulent transactions
- Comply with legal obligations
We will never sell your personal data to third parties. Your information is used solely to provide and improve the services you signed up for.
3. Cookies
We use cookies and similar tracking technologies to track activity on our service and hold certain information. Cookies are files with a small amount of data that may include an anonymous unique identifier.
3.1 Types of cookies we use
- Essential cookies — required for the service to function, including session authentication via HttpOnly cookies
- Preference cookies — remember your settings such as theme and language
- Analytics cookies — help us understand how you interact with our service
3.2 Cookie lifetime summary
| Cookie name | Type | Purpose | Expires |
|---|---|---|---|
session_id | Essential | Maintains your login session | Session |
refresh_token | Essential | Renews your access token securely | 30 days |
theme_pref | Preference | Stores your light/dark mode preference | 1 year |
_analytics | Analytics | Tracks anonymised usage patterns | 90 days |
You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, some parts of the service may not function correctly.
4. Data sharing and disclosure
We do not sell, trade, or rent your personal information. We may share your information only in the following limited circumstances:
- Service providers — trusted third parties who assist in operating our website, processing payments, or delivering services, bound by confidentiality agreements
- Legal requirements — when required by law or to protect our rights, property, or safety
- Business transfers — in connection with a merger, acquisition, or sale of assets, with prior notice to you
- With your consent — for any other purpose with your explicit consent
5. Data retention
We retain your personal data for as long as your account is active or as needed to provide you with our services. The table below summarises our retention periods by data category:
| Data category | Retention period | Reason |
|---|---|---|
| Account information | Until account deletion | Service delivery |
| Billing records | 7 years after last transaction | Tax and legal compliance |
| Support conversations | 3 years | Quality assurance |
| Log data | 90 days | Security monitoring |
| Analytics data | 24 months (anonymised) | Product improvement |
You may request deletion of your account and associated data at any time by contacting us. Note that some information may be retained beyond that period to comply with legal obligations.
6. Data security
We implement appropriate technical and organizational measures to protect your personal information. These measures include:
- Encryption
- All data in transit is encrypted using TLS 1.2+
- Data at rest is encrypted using AES-256
- Authentication
- Passwords are hashed with bcrypt (cost factor 12)
- Refresh tokens are stored in secure, HttpOnly, SameSite cookies
- MFA is available for all accounts
- Regular security audits and penetration testing
- Strict role-based access controls for internal systems
No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.
7. Third-party services
7.1 Services we use
| Provider | Purpose | Data shared |
|---|---|---|
| Google OAuth | Social sign-in | Email, name, profile picture |
| Stripe | Payment processing | Billing details, transaction history |
| Postmark | Transactional email | Email address, name |
| Sentry | Error monitoring | Anonymised error traces |
Each provider has their own privacy policy governing their use of your information. We encourage you to review those policies directly.
8. Your rights
Depending on your location, you may have the following rights regarding your personal data:
- Access — request a copy of the data we hold about you
- Correction — request that we correct inaccurate data
- Deletion — request that we delete your personal data
- Portability — request your data in a machine-readable format
- Objection — object to certain types of processing
8.1 How to submit a request
- Log in to your account and visit Settings → Privacy
- Select the type of request — Access, Correction, Deletion, or Export
- Submit the form; you will receive a confirmation email
- We will respond within 30 days in accordance with applicable law
9. Children's privacy
Our service is not directed to individuals under the age of 13. We do not knowingly collect personally identifiable information from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete such information from our servers immediately.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of any changes by:
- Posting the updated policy on this page
- Updating the Last updated date at the top
- Sending an in-app notification or email for material changes
11. Contact
If you have any questions or concerns about this Privacy Policy, please contact us at:
- Email: privacy@frostleaf.com
- Website: frostleaf.com/contact