FramePath

Privacy Policy

Audience: End users of the FramePath application on iOS, iPadOS, and macOS.

Effective date: 5 October 2026

#1. Who we are

FramePath ("FramePath", "we", "us", or "our") is an application designed for filmmakers and screenwriters to plan scripts, scenes, shot lists, and storyboards.

The data controller for the purposes of the EU General Data Protection Regulation 2016/679 ("GDPR") and the UK General Data Protection Regulation ("UK-GDPR") is:

  • Controller: Miikka Putaala (sole proprietor), publisher of FramePath
  • Postal address: [Postal address — to be completed before publication]
  • Privacy contact: privacy@framepath.fi

We have not appointed a Data Protection Officer because the scale and nature of our processing does not require one under Article 37 GDPR. The privacy contact above is the single point of contact for all data-protection matters.

#2. Scope

This Privacy Policy explains what personal data FramePath collects when you use the FramePath application on iOS, iPadOS, or macOS (the "App"), how we use it, with whom we share it, and what rights you have over it.

This policy does not cover:

  • Apple's own processing of your Apple ID, device data, or App Store transactions (see Apple's Privacy Policy);
  • the content you create in the App, which is stored in your own iCloud account and is not accessible to us except as described in Section 4.

#3. Personal data we collect

We deliberately collect the minimum data needed to operate the App. The categories below describe everything we collect.

3.1 Account data (collected only when you sign in)

  • Apple user identifier — an opaque, team-scoped identifier returned by Sign in with Apple. We never receive your real Apple ID.
  • Email address — only if you choose to share it during Sign in with Apple. Apple may give us a "private relay" forwarding address rather than your real address; we treat both the same.
  • Display name — only on first sign-in, and only if you choose to share it.
  • Firebase user ID (UID) — an internal identifier generated by Firebase Authentication when your Apple credential is exchanged. This is the key we use to look up your wallet and entitlements.

3.2 Subscription and wallet data

  • Subscription state and entitlement — whether you hold an active "Pro" subscription, managed via RevenueCat and bound to your Firebase UID.
  • Token wallet balance — a server-side counter (in Firebase Firestore at users/\{uid\}) recording your remaining AI tokens and whether your welcome allotment has been granted.
  • Purchase history — receipt-validation records held by RevenueCat and Apple. We do not store credit-card or payment-instrument data; Apple handles payment.

3.3 AI-generation content (only when you use AI features)

When you ask the App to generate shots for a scene, the App sends the following to our Firebase Cloud Function ask_claude, which forwards it to Anthropic's Claude API:

  • the scene description you typed (up to roughly 1,000 characters);
  • optionally, the list of scene elements (locations, props) you've defined for that scene;
  • optionally, the list of character names relevant to that scene.

We do not send screenplay metadata, your identity, or other scenes. The model's reply (a list of suggested shots) is returned to your device, stored locally in your project, and synced to your iCloud — it is not retained on our servers. See Section 5 for what Anthropic does with this content.

3.4 Project content (stored in your iCloud, not by us)

Your screenplays, scenes, shots, storyboard drawings, photographs, character lists, and production metadata (e.g., director and camera-operator names) are stored in your private CloudKit database (container iCloud.framepath.framepath). This content lives in your Apple iCloud account; we do not have access to it and cannot read, copy, or recover it.

3.5 Data we do not collect

For transparency, the App does not collect any of the following:

  • No analytics SDKs and no client-side event tracking: Firebase Analytics, Google Analytics, and equivalent SDKs are not enabled (IS_ANALYTICS_ENABLED is false in our Firebase configuration), and the App sends no usage events, screen views, or other behavioural telemetry from your device.
  • Server-side usage fields — the only usage data we record: when an AI generation that you requested succeeds, our server records, with your signed-in account record, the time of your first AI generation, the time of your most recent AI generation, and a running count of your AI generations. Nothing is recorded when a generation fails or when you do not use the AI features. See Section 3.6.
  • No crash reporting to us: Crashlytics is not enabled. Apple may collect anonymised crash reports under your device settings; that flow is governed by Apple, not by us.
  • No advertising identifiers: we do not request the IDFA and we do not show ads.
  • No App Tracking Transparency prompt: we do not track you across apps or websites.
  • No precise location, contacts, calendars, microphone, or health data.
  • No device fingerprinting or profiling. Apart from the platform interface idiom (phone vs. tablet) used locally for layout, the App does not collect device details. The one exception is when you send us a support message: the feedback form then attaches basic technical context to help us reproduce the problem (app version and build, operating-system version, device model, language/region and, if you are signed in, your Firebase user ID) — see Section 5.8.

3.6 Usage fields (recorded on our server, only when an AI generation succeeds)

Each time an AI generation that you requested succeeds, our Firebase Cloud Function ask_claude updates three fields on your account record in Firebase Firestore (users/\{uid\}, the same record that holds your wallet balance):

  • the time of your first successful AI generation (written once, never overwritten);
  • the time of your most recent successful AI generation; and
  • a running count of your successful AI generations.

These fields are written by our server, not collected by the App on your device: the App sends no event for them. They are used only for aggregate product measurement by the developer — for example, how many people have used the AI features, how long after signing up they first did, and what share of subscribers still used them a week or two after subscribing — reported as counts and medians, never as per-user reports. To calculate those aggregates we combine the fields with information we already hold: the account creation time kept by Firebase Authentication, and the purchase events reported to us by RevenueCat. The usage fields are never shared with third parties and are never used for advertising or profiling. Generations made before these fields were introduced are not counted: the fields are not backfilled.

3.7 Survey responses (only if you choose to answer one)

From time to time the App may invite you to answer a short survey. Answering is entirely voluntary and you can dismiss the invitation without consequence. If you submit a survey, we process your answers, the technical context described in Section 5.8, and — only if you choose to enter one — a follow-up email address, which is kept private. We also record that you have responded, so that we do not ask you again. See Section 5.8 for where responses are published and how long each part is kept.

#4. Why we use your data and on what lawful basis

For users in the EU, EEA, or UK, we rely on the following lawful bases under Article 6 GDPR / UK-GDPR:

| Purpose | Data used | Lawful basis | | --- | --- | --- | | Authenticate you and provide an account | Apple user ID, email, display name, Firebase UID | Article 6(1)(b) — performance of a contract (our Terms of Use) | | Sync your project content across your devices | Project content in CloudKit | Article 6(1)(b) — performance of a contract | | Validate your subscription and grant entitlements | Subscription state, wallet balance | Article 6(1)(b) — performance of a contract | | Generate AI shot suggestions on request | Scene description, optional scene elements, optional character names | Article 6(1)(b) — performance of a contract; you initiate each request | | Prevent abuse, fraud, and service misuse | Firebase UID, request metadata, RevenueCat purchase data | Article 6(1)(f) — our legitimate interest in operating a secure, sustainable service | | Respond to your privacy or support enquiries | Contact details and the content of your message | Article 6(1)(c) — legal obligation; and Article 6(1)(f) — legitimate interest | | Send you the FramePath newsletter (waitlist + launch + occasional updates) when you sign up on framepath.fi | Email address you enter on the signup form | Article 6(1)(a) — your consent, given via the explicit consent checkbox on the signup; you can withdraw at any time via the unsubscribe link in every newsletter email | | File and answer support tickets you submit through the in-app feedback form or the support form on framepath.fi/support (the former framepath.fi/contact address now redirects here) | Category, summary, and message text, plus basic technical context (app version and build, operating-system version, device model, language/region and, if signed in, your Firebase user ID) — all published in a public GitHub issue, see Section 5.8; your reply email address (kept private); a short-lived abuse-prevention record | Article 6(1)(f) — our legitimate interest in receiving and answering support requests | | Collect, publish, and summarise your answers when you choose to respond to an in-app survey (Section 3.7) | Your answers, the technical context described in Section 5.8, the optional follow-up email you enter (kept private), and a record that you have responded. Answering is voluntary and the invitation can be dismissed without consequence | Article 6(1)(f) — our legitimate interest in learning from our users how to improve FramePath | | Measure aggregate product usage of the AI features (Section 3.6) | The time of your first and latest successful AI generation and a running count of generations, stored with your account record and reported only as aggregate counts and medians | Article 6(1)(f) — our legitimate interest in understanding aggregate use of the App to decide what to build next, without client-side tracking or per-user reports | | Measure aggregate site traffic on framepath.fi (pageviews, referrers, country, Core Web Vitals) so we can tell which content lands and where to invest editorial effort | A coarse, non-identifying request fingerprint (timestamp, country, referrer, anonymised IP) processed by Cloudflare Web Analytics — no cookies, no per-user identifiers, no cross-site tracking | Article 6(1)(f) — our legitimate interest in understanding aggregate site usage without identifying individuals |

Except for the newsletter row (which relies on consent), we do not rely on consent for any of the above because none of these uses is optional once you choose to use the relevant feature. If you do not wish to use the AI features, simply don't trigger them; no data is sent to Anthropic in that case. If you do not wish to receive the newsletter, simply do not submit the signup form.

We do not engage in profiling or automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR.

#5. Who we share your data with

We use a small number of carefully chosen processors and sub-processors. Each has its own privacy obligations and is bound by a data-processing agreement where required.

5.1 Apple Inc. (United States, Ireland)

  • Sign in with Apple (authentication)
  • CloudKit (storage of your project content in your private iCloud database)
  • App Store and StoreKit (payment processing for subscriptions and in-app purchases)

Apple acts as an independent controller for sign-in and payment data and as a processor for CloudKit content. See Apple's Privacy Policy.

5.2 Google LLC / Google Ireland Limited (Firebase)

  • Firebase Authentication (exchanging your Apple credential for a Firebase UID)
  • Cloud Firestore (storing your wallet/entitlement document)
  • Cloud Functions (running the ask_claude server function)

Google acts as our processor. See Google's Privacy Policy and the Firebase data-processing terms.

5.3 RevenueCat, Inc. (United States)

  • Subscription-state management and entitlement reconciliation, bound to your Firebase UID.

RevenueCat acts as our processor. See RevenueCat's Privacy Policy.

5.4 Anthropic, PBC (United States)

  • Generates AI shot suggestions from the scene text you submit.
  • Helps us summarise survey answers: when we write up the results of a survey (Section 5.8), the text of the answers only — without the technical context, your Firebase user ID, or your Submission ID — may be sent to Anthropic's API.

Anthropic acts as our processor for the API call. Under Anthropic's commercial API terms, your inputs and outputs are not used to train Anthropic's models and are retained only for a limited period for abuse-monitoring purposes. See Anthropic's Privacy Policy.

5.5 Buttondown (United States)

  • Newsletter signup processing and delivery for the FramePath waitlist + launch + occasional-update emails, signed up via the form on framepath.fi.

Buttondown acts as our processor. We share the email address you enter on the signup form together with the timestamp of your double-opt-in confirmation, a Buttondown tag identifying the source (framepath.fi), and any unsubscribe events. Confirmation emails and newsletter messages are sent from info@framepath.fi. Buttondown does not use the data for any other purpose, does not sell the data, and supports the European Commission's Standard Contractual Clauses for transfers from the EU / EEA / UK. Lawful basis: Article 6(1)(a) — your consent, captured via the explicit consent checkbox on the signup form and confirmed via Buttondown's double-opt-in email; consent can be withdrawn at any time via the unsubscribe link in every newsletter email. See Buttondown's Privacy Policy.

5.6 Formspree (United States)

  • Contact-form submission processing for messages sent via the form on framepath.fi/contact.

Formspree acts as our processor. We receive the email address, optional name, and message body you submit; Formspree forwards the submission to the configured destination mailbox (support@framepath.fi, currently forwarded to mputaala@me.com). Formspree applies honeypot and Akismet-style spam filtering before delivery, does not use the data for any other purpose, does not sell the data, and supports the European Commission's Standard Contractual Clauses for transfers from the EU / EEA / UK. Lawful basis: Article 6(1)(f) — our legitimate interest in answering questions about FramePath sent through the public contact surface. See Formspree's Privacy Policy.

5.7 Cloudflare, Inc. (United States)

  • Cloudflare Web Analytics — aggregate, cookieless measurement of framepath.fi traffic (pageviews, referrers, country, Core Web Vitals).

Cloudflare acts as our processor for the analytics beacon. The beacon does not set cookies, does not write to localStorage or sessionStorage, does not fingerprint your browser, and does not retain your IP address beyond the brief in-memory aggregation step. Cloudflare publishes a Web Analytics privacy notice committing to this posture, and supports the European Commission's Standard Contractual Clauses for transfers from the EU / EEA / UK. We see only anonymous traffic aggregates in the Cloudflare dashboard — we do not see individual visitors, sessions, or paths through the site. Lawful basis: Article 6(1)(f) — our legitimate interest in understanding aggregate site usage without identifying individuals. We have not implemented a cookie banner because no cookies are set. See Cloudflare's general Privacy Policy.

5.8 GitHub, Inc. (United States) — support tickets and survey responses

When you send us a message through the in-app feedback form or the support form on framepath.fi/support, we process it through our own Firebase Cloud Function (see Section 5.2), which files it as an issue in our public support repository (mputaala/framepath-support) on GitHub so we can track and answer it. We process the category you choose and your summary and message text, which are published in a publicly visible GitHub issue — so please do not include sensitive personal information in your message. The in-app form also attaches, and the ticket publishes, a short block of technical context so we can reproduce problems: the app version and build, the operating-system version, the device model identifier (for example "iPhone16,2"), your language/region setting and, if you are signed in, your Firebase user ID (an internal identifier — not your name, email address, or Apple ID). The web form on framepath.fi/support instead attaches your browser's user-agent string and the referring page. We never publish your name, Apple ID, or email address. Your reply email address is not published: it is stored privately in our Firebase database, linked to the ticket, so that we can reply to you, and is retained for up to 360 days. We also write a short-lived abuse-prevention record (a submission identifier, a timestamp, and a derived value of your IP address) to the same database, automatically deleted after 90 days. GitHub acts as our processor for the public ticket; Google (Firebase) acts as our processor for the Cloud Function, the private reply address, and the abuse-prevention record. GitHub does not use the data for any other purpose, does not sell it, and supports the European Commission's Standard Contractual Clauses for transfers from the EU / EEA / UK. Lawful basis: Article 6(1)(f) — our legitimate interest in receiving and answering support requests. You can ask us to redact or delete a ticket, or your stored reply address, at any time (see Section 8). See GitHub's Privacy Statement.

To keep automated spam out of the public ticket queue, the support form on framepath.fi/support includes a proof-of-work check (ALTCHA) that runs entirely in your browser. It is self-hosted on our own Cloud Function: it does not use cookies, does not fingerprint your device, does not track you, and sends no data to any third party. Solving it transmits only the solved cryptographic puzzle itself; we briefly record the puzzle's random one-time identifier (which contains no personal data) to prevent reuse, and it is automatically deleted within a day. The in-app feedback form does not use this check.

Survey responses. When you submit an in-app survey (Section 3.7), the same Firebase Cloud Function path files your answers as an issue in the same public support repository, so we can read and summarise them. Your answers are therefore published in a publicly visible GitHub issue — the survey form warns you of this and asks you not to include personal information such as names or contact details, and you should not. The issue also carries a technical context block: the app version and build, the operating-system version, the device model identifier, your language/region setting, the number of days since you started using this version, a Submission ID, and only the first four characters of your Firebase user ID (not the full identifier, and never your name, email address, or Apple ID). If you choose to enter a follow-up email address, it is not published: it is stored privately in our Firebase database, linked to your Submission ID, and retained for up to 360 days. We also record, in Firebase, that you responded to the survey (linked to your Firebase user ID, so that we do not ask you again), and the same short-lived submission and abuse-prevention records as for support tickets. To write up the results we may send the text of the answers only — with no technical context, identifiers, or follow-up email — to Anthropic's API (Section 5.4) and publish the resulting summary as a public issue; summaries paraphrase rather than quote anything that looks like personal data. GitHub acts as our processor for the public issues; Google (Firebase) acts as our processor for the Cloud Function and the private records; both are already described above and no new processor is added. Dismissing a survey invitation is remembered only on your device. Lawful basis: Article 6(1)(f) — our legitimate interest in learning from our users; participation is voluntary. You can ask us to redact or delete a response at any time (Section 8).

5.9 We do not sell your data

We do not sell, rent, or trade your personal data, and we do not share it for cross-context behavioural advertising.

5.10 Disclosure required by law

We may disclose personal data if required by a valid legal process (court order, subpoena, regulatory request). Where lawful, we will notify you before doing so.

#6. International transfers

Most of our processors are based in the United States. When personal data is transferred from the EU, EEA, or UK to a country that has not received an adequacy decision from the European Commission or the UK Government, we rely on the European Commission's Standard Contractual Clauses (2021/914) and, where applicable, the UK International Data Transfer Addendum, supplemented by additional safeguards (encryption in transit and at rest, access controls).

You can request a copy of the relevant transfer safeguards by contacting privacy@framepath.fi.

#7. How long we keep your data

| Data | Retention | | --- | --- | | Apple user ID, Firebase UID, email | Until you delete your account, then deleted within 30 days | | Wallet/entitlement document in Firestore | Until you delete your account, then deleted within 30 days | | Subscription records held by RevenueCat | Per RevenueCat's retention policy; tax-record obligations may require retention up to 7 years for invoice metadata | | AI prompt content sent to Anthropic | Not retained by us; retained by Anthropic per its commercial-API terms (currently up to 30 days for abuse monitoring) | | Project content (screenplays, shots, storyboards) | Held in your own iCloud — we never store it. Deletion is controlled by you in the iCloud settings on your device | | Privacy / support correspondence | Up to 3 years after the matter is closed | | Newsletter subscriber record (email + opt-in timestamp + unsubscribe events) held by Buttondown | Until you unsubscribe, then deleted from Buttondown within 30 days; we keep an unsubscribe flag for the lifetime of the newsletter to honour your opt-out across re-imports | | Contact-form submission held by Formspree (email + optional name + message body) | Until the matter is resolved, then deleted within 30 days; the forwarded copy in support@framepath.fi falls under the privacy / support correspondence row above (up to 3 years) | | Support ticket held by GitHub (category + summary + message body + technical context described in Section 5.8 — no email) | For the lifetime of the public support repository as an open or closed issue; you may ask us to redact or delete it at any time (Section 8) | | Reply email address held by us in Firestore (linked to the ticket, so we can answer you) | Up to 360 days, then automatically deleted; deleted sooner on request (Section 8) | | Support submission record held by us in Firestore (submission identifier + timestamp + derived IP value, used for idempotency and rate-limiting) | Automatically deleted after 90 days | | Survey response issue held by GitHub (your answers + the technical context described in Section 5.8 — no email) | For the lifetime of the public support repository as an open or closed issue; you may ask us to redact or delete it at any time (Section 8) | | Survey state record held by us in Firestore (survey identifier + whether you responded + timestamp, linked to your Firebase user ID) | Automatically deleted after 730 days | | Optional survey follow-up email held by us in Firestore (linked to your Submission ID) | Up to 360 days, then automatically deleted; deleted sooner on request (Section 8) | | Survey submission record held by us in Firestore (submission identifier + timestamp + issue number, used for idempotency and rate-limiting) | Automatically deleted after 90 days | | Usage fields held by us in Firestore (time of first and latest successful AI generation + generation count, Section 3.6) | Kept with your account record until you delete your account, then deleted within 30 days | | Cloudflare Web Analytics traffic measurements (aggregate pageview counts, country, referrer, Core Web Vitals) | Retained by Cloudflare in aggregate form per its Web Analytics retention policy — we never hold per-visitor data because none is collected |

To delete your account, email privacy@framepath.fi. To unsubscribe from the newsletter, click the unsubscribe link in any newsletter email or email privacy@framepath.fi with "unsubscribe" in the subject line.

#8. Your rights (EU, EEA, UK)

Under GDPR and UK-GDPR you have the right to:

  • Access the personal data we hold about you (Article 15);
  • Rectify inaccurate data (Article 16);
  • Erase your data, also known as the "right to be forgotten" (Article 17);
  • Restrict processing in certain circumstances (Article 18);
  • Port your data to another service in a structured, machine-readable format (Article 20);
  • Object to processing carried out on the basis of legitimate interest (Article 21);
  • Withdraw consent at any time where we rely on consent (we currently do not — see Section 4); and
  • Lodge a complaint with a supervisory authority.

To exercise any of these rights, email privacy@framepath.fi. We will respond within one month, as required by Article 12(3) GDPR. There is no fee unless the request is manifestly unfounded or excessive.

Erasing a survey response. Each survey issue shows a Submission ID at the bottom. To have a response erased, email privacy@framepath.fi quoting that Submission ID. We will delete the public GitHub issue and the matching Firestore records (the survey state record, the follow-up email if you gave one, and the submission record) and, if a summary of the survey has already been published, annotate the summary to note that one response was removed.

If you believe we have processed your data unlawfully, you may complain to your local data-protection authority. For example:

A full list of EEA authorities is maintained by the European Data Protection Board.

#9. Security

We rely on the security controls of our platform providers and apply the following measures:

  • All network traffic between the App and our backend uses TLS 1.2 or higher.
  • Authentication uses Apple-issued OAuth tokens exchanged via Firebase Authentication; we never see your Apple ID password.
  • The wallet document in Firestore is read-only to clients; only server-side Cloud Functions can mutate balances.
  • CloudKit data is encrypted in transit and at rest by Apple and resides in your private database.
  • We do not store payment-card data.

No system is perfectly secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours, as required by Article 33 GDPR, and notify you without undue delay where Article 34 applies.

#10. Children

The App is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13.

For users in the EU and EEA, GDPR Article 8 sets the age of digital consent at 16 by default, with member states permitted to lower it to as low as 13. If you are under the applicable age of digital consent in your country, you must have the consent of a parent or legal guardian before using the App. Parents who believe their child has provided us with personal data without consent should contact privacy@framepath.fi and we will delete the data promptly.

We do not knowingly use children's data for profiling, behavioural advertising, or any non-essential purpose.

#11. Apple App Store privacy disclosures

For alignment with Apple's App Privacy "nutrition label" on the App Store, our declared data practices are:

  • Data linked to you: User ID (Apple user ID, Firebase UID), Email Address (shared via Sign in with Apple inside the App, or entered on the newsletter signup form / contact form on framepath.fi, or entered as an optional follow-up address on a survey), Purchase History, Product Interaction and Other Usage Data (the time of your first and most recent successful AI generation and a count of your AI generations, recorded on your account record by our server — linked to you through your User ID and declared to Apple for Analytics and Product Personalization — the aggregate results shape which features we build and improve, and nothing in the App is personalised to you from these fields; never used for advertising or tracking), Other User Content (the AI scene text you submit on demand inside the App; the message you send through the in-app feedback form or the support form on framepath.fi/support; the answers you choose to submit to an in-app survey), and Other Diagnostic Data (the app version, operating-system version, device model and language/region attached to a support message or survey response you choose to send — used only for customer support and understanding survey responses, never for analytics).
  • Data not linked to you: None. We do not run analytics SDKs, crash reporting, or client-side telemetry; the only usage data we record is the server-side data described above, and it is linked to your account.
  • Data used to track you: None.

If our practices change, we will update both this policy and the App Store privacy declaration.

#12. Changes to this policy

We may update this policy from time to time to reflect changes to the App, the law, or our processors. When we make a material change, we will:

  1. update the Effective date at the top of this policy;
  2. notify you in-app on next launch where the change is material; and
  3. for changes that require a new lawful basis, ask for your consent before the change takes effect; and for other expansions of data collection that rely on our legitimate interest (such as the usage fields in Section 3.6 and the surveys in Section 3.7), state the change plainly in this policy, tell you in-app on next launch as described above, and continue to honour your right to object (Section 8).

The most recent version of this policy is always available inside the App under Settings → Privacy Policy and at the canonical URL https://framepath.fi/privacy, which is the URL we publish on the App Store listing.

#13. Contact

For any privacy question, request, or complaint:

Email: privacy@framepath.fi Postal address: [Postal address — to be completed before publication]

We will acknowledge your message within five working days and substantively respond within one month.

#References