Legal

Privacy policy

Last updated 9 September 2026

We don't store your decks. They're files on your computer, and the editor works on them there. If you sign in, we keep your email address, a display name you choose, your default design, and any theme or template you save. The rest of this page is the detail.

Who we are

Decaframe is an independent project, not a registered company. It makes the decaframe package, the editor at app.decaframe.com and this website. "We" means the person who runs it. You can reach us through the contact form.

If you never sign in

We store nothing about you. This site sets no cookies and has no analytics. The editor runs in your browser, and the document it opens comes from your machine or a file you picked. It is never sent to us. You don't need an account for anything.

The one outside request every page makes is for fonts, which come from Google Fonts. Google sees that request the way it does for any site using the service. Nothing else is sent anywhere.

If you sign in with Google

We create an account and store exactly this:

Your email address: To recognise you next time, and to reach you about the service.
A Google account ID: An anonymous ID Google gives us for your account, so you can still sign in if you change your email address.
A display name: Chosen by you the first time you publish something. It's the name shown on anything you share, so pick one you're happy for others to see. You can change it under Settings.
Your defaults: The theme and template a new deck starts with.
Themes and templates you save: The design itself, and whether you published it. There's a section on this below.
The devices you've signed in on: A random ID, whether it was a browser or a command line, and when it was last used. This is what lets you sign out everywhere, or remove a lost laptop.
Short-lived sign-in codes: Used to finish, in your browser, a sign-in your agent started. They expire after five minutes and are deleted once used.

There's no password. Google does the checking, and we keep nothing Google issues: we read your email address and account ID from its reply and discard the rest.

What we ask Google for

Only two things: confirmation that it's you, and your email address. We don't ask for your name or profile, which is why the display name on anything you publish is one you choose rather than the name on your Google account. We don't ask for access to Drive, Gmail, Calendar, Contacts or any other Google service. Decaframe's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Themes and templates you save

A theme is a set of colours, fonts and design settings. A template is a set of page designs. Both are design, not content: they carry no words from your decks. When you save one, we store it on our servers.

Published means public. A theme or template you publish can be seen and used by anyone using Decaframe, shown under your display name. Nothing else about you is shown with it.
On the free plan, publishing is how you keep one. Private themes and templates will be part of the paid plans.
Unpublishing deletes it. It goes from the library and from our servers.
We can remove anything from the community library, and we will if it breaks the terms.

If you answer the question about paid plans

Under Settings we ask an optional question: which paid features you'd use, roughly what you'd pay, and anything you'd like to add. If you answer, we keep your answer with your account, and answering again replaces it. We use it only to decide what to build and how to price it. Nobody else sees it, and it doesn't put you on a mailing list.

Your documents

We don't have them. There is no copy of your deck on our servers.

A deck your agent writes is a file in a folder on your computer.
When you edit a deck your agent is working on, the editor talks directly to your own computer. Nothing passes through our servers.
When you open an exported file in the editor, your browser reads it. Nothing is uploaded.
When you save, the file is written back to your computer or downloaded by your browser.

Cloud storage for decks will be part of the paid plans. When it exists, a deck you choose to store will be kept for your workspace, and this page will say so before it does.

If you write to us

The contact form sends us your name, email address, topic and message. We keep it long enough to reply and a short while after, in case you write back. It never goes on a mailing list. Cloudflare Turnstile checks that a person filled in the form. It sets no cookie and doesn't profile you.

Cookies

One, and only once you sign in: it tells the site that this browser is yours, and it lasts thirty days or until you sign out. A second cookie lives for the few minutes of a sign-in to keep it secure. No advertising cookies, no trackers, no analytics.

Logs

Our sites run on Cloudflare, which sees the IP address of each request, as any host does. We log one request in ten to our own code so we can find errors. A log entry holds the path, the response and the timing. We don't build profiles from it or link it to accounts.

Who else sees any of this

Two companies, for two jobs.

Cloudflare: Hosting, the storage for your account details, themes and templates, the anti-spam check on the contact form, and the network in front of all of it.
Google: Sign-in, and only if you use it, plus the typefaces this site loads. Google learns that you signed in to Decaframe; we learn your email address.

We don't sell personal information or share it for advertising. Under the CCPA we act as a service provider for the data you give us.

Exported files and the open internet

An exported deck is one HTML file that loads its fonts from Google Fonts and its pictures and videos from wherever you linked them. Opening it tells those hosts someone opened it, the same as any web page. It tells Decaframe nothing.

Keeping and deleting

Sign-in codes are deleted when used, and swept nightly once expired.
Revoked devices are swept thirty days after revocation.
Sign out ends the session on that device. Sign out everywhere revokes every device on the account at once.
Unpublish deletes a theme or template, from the library and from our servers. There is no copy kept.
To delete your account and everything listed above, write to us through the contact form, from the address you signed up with. We will do it within thirty days and tell you when it is done.

Your rights

Wherever you live, you can ask what we hold about you, ask us to correct or delete it, and ask for a copy. In the UK and EU, the GDPR also gives you the right to object and to complain to your data protection authority. In California, the CCPA gives you the rights to know, delete, correct and opt out, and we won't treat you differently for using them. In India, the Digital Personal Data Protection Act gives you access, correction and erasure. Our legal basis for holding the account data above is that we need it to provide the service. Use the contact form for any of it.

Where it is held

Your account details, themes and templates are stored with Cloudflare, and our sites run on Cloudflare's network. That means your data may be processed outside your country. Cloudflare's data processing terms and transfer safeguards cover it.

Children

Decaframe isn't meant for children under 13, and we don't knowingly collect anything from them.

Changes

When this page changes, the date at the top changes with it. If we start collecting something new, we'll say so here and email account holders first.

Questions about any of this: contact us.