Privacy and data handling
Updated 18 October 2026.
This service is a release preview. Public infrastructure, operator contact and live provider rendering have not been verified. This page explains the implemented data flow; the operator must publish their contact and applicable terms before admitting business users.
Your projects
Productions, references, shots, takes and recovery information are saved in this browser. They do not sync across devices or become shared after sign-in. Private backups may contain source images and job access secrets. Keep backups and agent review links private. Music and voice files remain in the current session.
Sign-in
Public hosted jobs use Cloudflare Access. Cloudflare manages the sign-in session. Frameverb verifies its signed application assertion and stores a hashed owner identifier with each hosted job. Frameverb does not save a login token in browser storage. Signing out clears the in-memory provider key and billing acceptance.
Hosted generation
Creating a hosted job from the browser sends only its route ID and an input fingerprint to a minimal recovery ledger. The ledger stores IDs, state, timestamps and hashed input, approval, access and owner bindings. It does not store provider tokens, prompts, source images, filenames or media URLs. Generating requires your explicit billing approval; the reviewed input and use-once fal key then pass transiently through the relay to fal, which runs inference and bills your account. Frameverb does not persist those inputs or the key. fal and Cloudflare process data under their own policies.
Retention and deletion
Only metadata records are retained on the server. They expire seven days after creation. The metadata-only migration removes former content columns, but any historical operator backups need their own retention handling; this source update has not changed a live database. Expired records cannot be accessed and are removed by a configured scheduled purge. The deployed purge has not yet been verified. The studio offers an owner-only Delete hosted job action. Deleting or expiring a Frameverb record does not cancel a provider request or delete provider-hosted media. Keep copies you need and manage provider retention directly.
Agents and local tools
Remote agents can list routes, prepare shots, reserve a job fingerprint and inspect owned job metadata. Inputs are processed transiently and returned to the caller as a private draft backup, which their MCP client may retain in its own history. The server does not keep that backup. A recovery link restores status only; a matching local draft or imported backup is needed to review and submit. Agents cannot approve or submit a generation or read your local files. The separate local stdio tool accepts images inside its inbox or directories you explicitly opt into. Authorized quota-backed routes may also send those image bytes to their provider.
Support and operational records
An operator support and abuse contact is required before public release and has not yet been configured. Cloudflare and providers may retain network or account records under their own policies; deleting a Frameverb job does not delete those records. Do not upload sensitive business material until the operator's identity, contact and terms are published.