Privacy Policy

Last updated: September 12, 2026

This Privacy Policy explains how Reframe (“Reframe,” “we,” “us,” or “our”) collects, uses, discloses, and protects information when you visit our website, use the Reframe Framer plugin, use the Reframe CLI, create an account, purchase a plan, or otherwise interact with our services (collectively, the “Services”).

Please read this policy together with our Terms of Service. By using the Services, you acknowledge that you have read this Privacy Policy. Where applicable law requires consent, we will request consent separately; this policy does not replace a consent notice.

1. Who is responsible for your information

The data controller or other responsible entity is the Reframe business operating the Services. References in this policy to “Reframe” mean the operator of reframe.elxr.studio.

For privacy questions, requests, or complaints, contact us through the feedback channel linked in the Services or through the contact information published at reframe.elxr.studio.

If you use Reframe on behalf of a company or another organization, that organization may be the controller of information it provides to Reframe, and Reframe may process it as a service provider or processor under the organization’s instructions. In that situation, your organization’s privacy notice and agreement with Reframe may also apply.

2. Information we collect

We collect information that you provide, information generated by your use of the Services, and limited information from third parties. The exact information depends on which features you use.

2.1 Account and identity information

When you register, authenticate, or maintain an account, we may collect:

your name or display name;
your email address;
your profile image, if provided by an authentication provider;
account identifiers, session identifiers, and authentication timestamps;
sign-in, sign-out, verification, and security events; and
information needed to respond to account-support requests.

If you sign in through Google, GitHub, or another supported provider, we receive the information that provider makes available under your authorization and its privacy terms. We do not receive your third-party password.

2.2 Framer projects, component exports, and generated files

When you publish or export a component, we may process information necessary to deliver that export, such as:

the component or export identifier;
the component name, project identifier, owner identifier, and version information;
exported source, generated TypeScript or JavaScript, JSX, CSS, assets, metadata, property definitions, variants, and dependency information;
export history, checksums, revision information, and update status; and
technical logs associated with creating, retrieving, or updating an export.

The Services are designed for developer workflows. You should not publish personal data, secrets, credentials, private keys, access tokens, database passwords, or other information that you do not want processed as part of a component export. You are responsible for reviewing component content before publishing it.

2.3 CLI and device-authentication information

When you use the Reframe CLI, we may process:

the CLI version and command-related diagnostic information;
the export IDs, project paths, component names, and version choices you request;
a short-lived device authorization request and approval code;
an access token or session credential stored by the CLI after you authenticate; and
error and audit information needed to secure the CLI workflow.

The CLI should obtain authentication credentials at runtime through the existing authentication flow. Do not place credentials in source files, committed configuration, generated components, shell history, or issue reports.

2.4 Payment and transaction information

If you purchase a paid plan, Reframe and Polar, our payment processor, may collect:

the plan, billing interval, amount, currency, and transaction status;
billing name, billing address, tax information, and invoice information where required; and
limited payment-method details, such as a card brand or last four digits.

Full payment-card numbers and security codes are handled by Polar and are not stored by Reframe. Polar’s privacy notice and terms apply to its processing of payment information.

2.5 Usage, device, and log information

When you use the website or Services, we may automatically receive:

IP address, approximate region, browser and operating-system type;
device identifiers, request identifiers, language, time zone, and referring URLs;
pages or API endpoints requested, timestamps, response status, and performance information;
authentication, security, rate-limit, and abuse-prevention events; and
crash reports, diagnostic logs, and feature usage information.

We use this information in aggregated or limited form to operate, secure, troubleshoot, and improve the Services. We do not use it to make decisions about a person’s eligibility for housing, employment, credit, insurance, or other similarly sensitive opportunities.

2.6 Cookies and similar technologies

We may use cookies, local storage, pixels, and similar technologies for:

authentication and session continuity;
remembering preferences such as theme settings;
security, fraud prevention, and abuse detection;
measuring site performance and understanding which pages are useful; and
storing choices about optional cookies or communications.

Strictly necessary technologies may operate because they are needed to provide a requested feature. Where required by law, we will ask before using optional analytics, advertising, or similar technologies. You can control cookies through your browser and any preference controls we provide, although disabling necessary cookies may prevent parts of the Services from working.

3. How we use information

We use information for the following purposes:

3.1 Provide and maintain the Services

We use information to create and secure accounts, authenticate users, publish and retrieve exports, deliver CLI functionality, maintain version history, process updates, provide customer support, and communicate about the operation of the Services.

3.2 Process transactions

We use billing and transaction information to provide paid features, confirm purchases, issue receipts, prevent payment abuse, calculate taxes where applicable, manage renewals, and handle refunds or chargebacks.

3.3 Secure and improve Reframe

We use logs and technical information to detect abuse, protect accounts, investigate incidents, debug failures, improve performance, understand aggregate product usage, and develop new features. We may use de-identified or aggregated information for analytics and reporting.

3.4 Communicate with you

We may send transactional messages such as sign-in notices, security alerts, export status, service changes, billing notices, and support responses. If we send optional product or marketing messages, you may unsubscribe using the mechanism in the message. You will still receive essential service communications.

3.5 Comply with law and protect rights

We may process and disclose information when reasonably necessary to comply with law, respond to lawful requests, enforce our agreements, protect the rights and safety of users or others, prevent fraud, or establish, exercise, or defend legal claims.

4. Legal bases for processing

Where data-protection law requires a legal basis, our bases may include:

Contract: processing needed to create your account, provide exports, deliver the CLI workflow, fulfill a purchase, or perform our agreement with you;
Legitimate interests: operating, securing, supporting, measuring, and improving the Services, provided those interests are not overridden by your rights;
Consent: optional communications, non-essential cookies, or other processing for which we request your permission; and
Legal obligation: records and disclosures we must maintain or make under applicable law.

You may withdraw consent where processing relies on consent. Withdrawal does not affect processing that occurred before withdrawal and may not stop processing based on another lawful basis.

We do not sell personal information for money. We may share information in the following limited circumstances:

5.1 Service providers

We use vendors that help us operate the Services, such as hosting, databases, authentication, email delivery, error monitoring, analytics, customer support, content delivery, and security providers. Polar processes payment and transaction information on our behalf. These providers may process information only as needed to provide services to us and under contractual or other safeguards appropriate to the relationship.

5.2 Your instructions and public or collaborative features

We share information when you direct us to do so, when you choose to publish an export, or when a feature is intentionally collaborative. Review component content and project permissions carefully before publishing. Reframe is not responsible for information you choose to make public through your project, code repository, deployment, or another service.

5.3 Business transfers

Information may be transferred as part of a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction. We will apply appropriate protections and provide notice where required.

5.4 Legal, safety, and enforcement disclosures

We may disclose information to courts, regulators, law-enforcement authorities, professional advisers, or other parties when legally required or when reasonably necessary to protect people, property, the Services, or our legal rights.

6. International transfers

Reframe and its service providers may process information in countries other than the country where you live. Those countries may have different data-protection rules. Where required, we use an appropriate transfer mechanism, such as an adequacy decision, contractual safeguards, or another lawful mechanism, and we apply reasonable protections to transferred information.

7. Retention

We keep information only for as long as reasonably necessary for the purposes described here, including providing the Services, maintaining export history, resolving disputes, preventing abuse, complying with accounting and legal obligations, and enforcing agreements.

Retention varies by category. Account and transaction records may be retained while your account is active and for a reasonable period afterward. Export records may remain available according to the product’s versioning and deletion behavior. Security and diagnostic logs may be retained for shorter or longer periods depending on their operational and incident-response value.

When information is no longer needed, we delete it, anonymize it, or securely isolate it where deletion is not immediately practical. Backups may retain residual copies until they are rotated out.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, and destruction. Measures may include encrypted transport, access controls, authentication protections, logging, least-privilege practices, dependency and infrastructure maintenance, backups, and incident-response procedures.

No service, transmission, or storage system is completely secure. You are responsible for protecting your account credentials, reviewing generated exports, avoiding secrets in component content, and notifying us promptly if you believe your account or token has been compromised.

If we determine that a security incident requires notice under applicable law, we will provide notice in the manner and timeframe required by law.

9. Your privacy rights and choices

Depending on where you live and subject to legal exceptions, you may have rights to:

request access to personal information we hold about you;
request correction of inaccurate or incomplete information;
request deletion of information;
request restriction or objection to certain processing;
request portability of information you provided to us;
withdraw consent where processing is based on consent;
opt out of certain marketing communications or optional cookies; and
lodge a complaint with your local data-protection authority.

To make a request, contact us using the privacy contact described in Section 1. We may need to verify your identity and authority before responding. We will not discriminate against you for exercising a right, although some features may not work if the information needed to provide them is deleted or restricted. Authorized agents may submit requests where allowed, but we may require proof of authorization.

If you are in California or another jurisdiction with sale, sharing, targeted-advertising, or sensitive-information rights, we will honor applicable rights based on the information we collect and the laws that apply to our business. Our current practice is not to sell personal information for money. If that practice changes, we will update this policy and provide any required choices.

10. Children’s privacy

The Services are intended for developers and are not directed to children. We do not knowingly collect personal information from children where doing so is prohibited by applicable law. If you believe a child has provided personal information, contact us so we can investigate and delete it when required.

11. Third-party services and links

The Services may link to Framer, authentication providers, Polar, social networks, documentation, repositories, image hosts, or other third-party services. Their privacy practices are governed by their own policies. Reframe does not control and is not responsible for third-party privacy or security practices.

12. Privacy of exported code and assets

The CLI writes generated files into the project directory you choose. Once written, those files may be copied, committed, deployed, indexed, backed up, or processed by tools outside Reframe. Reframe cannot control what happens to files after they leave our systems. You should inspect exports for credentials, personal information, licensed assets, third-party notices, and project-specific restrictions before using or distributing them.

13. Do-not-track and global privacy controls

Browsers may send “Do Not Track” or similar signals. Because there is not one consistent technical standard for interpreting those signals, Reframe may not respond to every signal in the same way. Where applicable law requires recognition of a recognized opt-out preference signal, we will provide the required handling.

14. Changes to this Privacy Policy

We may update this policy when the Services, law, vendors, or data practices change. We will post the revised version and update the “Last updated” date. If a change is material and notice is required, we will provide additional notice through the Services or by email. Your continued use after the effective date means the updated policy applies to future use, subject to any consent requirement.

15. Contact

For privacy questions, requests, or concerns, use the feedback link in the Reframe interface or contact the privacy address published at reframe.elxr.studio. Please include enough detail for us to identify the relevant account or request, but do not send passwords, access tokens, private keys, or other secrets.

On this page