Privacy Policy

Who we are

Framezone is operated by Reaktör Teknoloji Tic. Ltd. Şti., a limited liability company established in the Republic of Türkiye ("Reaktör", "we", "us"). Reaktör is the data controller for the personal data described here.

Framezone is built and run by one person, Sedat. When you write to us, he is the one who reads it.

• Contact: [email protected] or the contact page.
• We have not appointed a data protection officer.
• We have not yet appointed a representative in the EU or UK. We will appoint one as required.

The short version

• Your data is yours. We use it to run Framezone for you and nothing else.
• We do not sell data, show ads or use ad tracking.
• Our own site statistics use no cookies and store no IP addresses.
• Google Analytics runs only if you click "Allow analytics".
• You can export everything or delete your account from Settings at any time.

Data we process

Account data. Your name, email address, a hashed version of your password and your preferences.

What you create. Everything you put into Framezone, including:

• Tasks, projects, habits and goals
• Journal entries, including mood and energy
• Notes, books, quotes, contacts, bookmarks and your wishlist
• Finance: accounts, transactions, budgets, subscriptions and portfolio
• Fitness: workouts, body measurements and nutrition

Health and fitness data is only there if you choose to record it. You can delete it at any time.

Connections and AI

All of these are optional. Nothing is connected unless you set it up.

• Bank connection. Through TrueLayer, read-only. It can never move money.
• Apple Health. Where it is switched on (it is still in testing), data arrives through a personal ingest link that only works for your account.
• Google account. Used to show Search Console and Analytics stats for your projects.
• Your own AI keys. If you add your own OpenAI or Anthropic API key, AI features use it.
• MCP connector. Lets the AI assistant you choose (for example Claude, ChatGPT or Cursor) read and write your Framezone data, within the OAuth scopes you approve.

When you use AI features or an AI assistant, whatever you ask about is sent to that AI provider and handled under that provider's terms.

Emails and messages

• Account emails such as password resets.
• Product emails such as a welcome email, tips and a weekly summary. Every one has a one-click unsubscribe link, and you can turn them off in Settings.
• Contact form. Messages are delivered through Humainbox, a spam-filtering service also run by Reaktör.
• Waitlist and newsletter. Your email address and the plan you chose.

Site statistics

We keep our own simple statistics so we know which pages are useful. They use no cookies.

What we don't store. Your IP address, your city or your full browser string.

How visits are counted. Each visit gets an identifier made from a random salt that changes daily, a shortened IP address and your browser. The salt is deleted after 48 hours. After that, identifiers cannot be linked back to a person or connected across days.

What we store.

• The page you visited
• The referring page, without its query string
• UTM tags
• Your country, as reported by Cloudflare
• Device, browser and operating system type

If you are signed in, the pages you visit inside the app are recorded with your account so we can improve the product.

Statistics are kept for 12 months and then deleted automatically.

Google Analytics 4 runs only if you click "Allow analytics" in the cookie card. Google Analytics 4 anonymises IP addresses by default. You can change your choice at any time through "Cookie settings" in the footer. See the cookie policy for details.

Server logs

Web server and application logs may include IP addresses. We use them for security and troubleshooting only. Application logs are kept for 14 days. Web server logs are kept for a short period.

Why we use it

• To run your account and the features you use. This is needed to provide the service you signed up for.
• Health and fitness data, connections and analytics cookies. Based on your choice to record, connect or allow them. You can withdraw that at any time.
• Site statistics, security and server logs. Based on our legitimate interest in keeping Framezone safe and working, done in a way that cannot identify you where possible.
• Account emails. Needed to run your account. Product emails can be switched off whenever you like.

Who helps us run it

These providers process data on our behalf. Some are only involved if you use the related feature.

International transfers

Your data is hosted in Germany. Some data can be transferred outside the EU and Türkiye when it passes through Cloudflare or Google. These transfers rely on the providers' standard contractual clauses or equivalent safeguards.

Security

• HTTPS everywhere, with HSTS.
• Bank tokens, Google tokens and AI keys are encrypted at rest.
• Passwords are hashed, never stored in plain text.
• Admin access is limited to the maker.
• Nightly database backups, kept for 14 days.

Your other data is not end-to-end encrypted yet. That is planned. The security page has the details.

How long we keep it

• Account data and content. Until you delete your account.
• When you delete your account. All your data, files and connected tokens are removed from the live system immediately, and the Google connection is revoked. Backups roll off within 14 days.
• Site statistics. 12 months.
• Application logs. 14 days.
• Contact messages and waitlist entries. Until they are no longer needed, or earlier if you ask.
• Unsubscribe preferences. Kept so we can keep honouring them.

Your rights

You can:

• Access the data we hold about you
• Correct it
• Export it, from Settings
• Delete it, by deleting your account in Settings
• Restrict or object to how we process it
• Withdraw consent you have given
• Take it with you (data portability)

If you are in Türkiye, you also have the rights in Article 11 of the Personal Data Protection Law (KVKK, Law No. 6698).

Most of this you can do yourself in the app. For anything else, email [email protected] or use the contact page. I usually reply within a day or two, and always within the legal deadline of 30 days.

What we don't do

• We don't sell your data.
• We don't show ads.
• We don't use ad tracking.

Framezone is not meant for children under 16.

Law and complaints

This policy is governed by Turkish law. The Turkish Personal Data Protection Law (KVKK, Law No. 6698) applies alongside the GDPR.

If you are unhappy with how we handle your data, please tell us first so we can fix it. You can also complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu). If you are in the EU or UK, you can complain to your local data protection authority.

Changes to this policy

When we change this policy, we update the date at the top. For material changes, we tell you by email first.

Contact

Reaktör Teknoloji Tic. Ltd. Şti.
Email: [email protected]
Or use the contact page.