Privacy Policy

The short version

• We collect what we need to run Fryll: your account details, and the workspaces, conversations and messages you and your team create.
• We don't sell your information, and we don't use your messages for advertising.
• Passwords, sessions and conversation tokens are stored only as one-way hashes.
• This website doesn't use cookies or analytics.
• You can ask us for a copy of your information, or to delete it, at any time.

Information we collect

Account information

When you create an account we collect your email address and the first and last name you choose to add. You can sign in with an email code or a password. If you set a password, we store only a secure one-way hash. Your profile may also include an avatar and other details you choose to provide.

Workspace content

Everything you and your team put into Fryll: workspaces and their members, channels, direct messages, messages, thread replies, uploaded files and photos, reactions, edits and deletions. We store file metadata such as its name, size and type. When you invite someone, we store the email address, name and role you give them. When a message is deleted, we remove its text and keep a placeholder so threads stay intact.

Activity in the app

To show unread counts and threads you follow, we record how far you have read in each conversation and thread, and which threads you follow. We also store saved messages, mentions and replies addressed to you in Activity, and online status so your teammates can see whether you are connected.

Push notifications

On iOS and Android, we use an app installation identifier, a push registration token and your signed-in account to deliver notifications to your device. Notification delivery providers receive routing information and the notification content, which can include the sender's name and a message preview. You can control notification permissions and lock-screen previews in your device settings. Signing out removes that account's notification registration for the session.

Sessions and tokens

When you sign in we create a session so you stay signed in; it lasts until you sign out. If you create a conversation token to post from a script or a tool, we store the token as a hash, together with the last four characters, when it was created and when it was last used. Messages posted with a token are posted as you.

Technical information

Like most online services, our servers receive technical information with each request, such as your IP address, the time of the request and the type of device or app making it. We use it to keep Fryll secure, to limit abuse (for example, how often a token can post) and to fix problems.

How we use information

• To provide Fryll: to sign you in, deliver messages to the right people in real time, and show your workspaces and conversations.
• To keep Fryll secure and reliable: to prevent abuse, investigate problems and protect our users.
• To communicate with you about your account, security and important changes to Fryll or these policies.
• To meet legal obligations and enforce our Terms of Service.

Where the law requires a legal basis for using personal information, we rely on performing our contract with you (providing Fryll), our legitimate interests (keeping Fryll secure and working well), your consent where we ask for it, and compliance with the law.

Who can see your content

Messages in public channels can be seen by members of the workspace. Messages in private channels and direct messages can be seen only by the people in them. Workspace owners and admins manage who belongs to a workspace. Anyone holding one of your conversation tokens can post to that conversation as you, so keep tokens secret and revoke any you no longer use.

Service providers

We share information only with providers that help us run Fryll, under agreements that limit how they may use it:

• Hosting and database providers, which store and process Fryll's data on our behalf.
• Pusher, which delivers real-time updates, such as new messages, to the Fryll app.
• Bunny.net, which stores and delivers uploaded files, photos and avatars.
• Resend, which delivers account emails such as sign-in codes and password resets.
• Google Firebase Cloud Messaging and Apple Push Notification service, which deliver mobile push notifications. We do not enable Google Analytics through Firebase.
• Application monitoring, which receives technical data about requests and errors so we can keep Fryll running.

We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

We don't sell personal information, and we don't share it for cross-context behavioural advertising.

Cookies and local storage

This website doesn't set cookies or use analytics. It uses local storage for preferences such as appearance and your preferred documentation language. Fryll's desktop and mobile apps keep sign-in credentials in operating-system-protected storage and remember app preferences locally.

How long we keep information

We keep your account and workspace content for as long as your account or workspace exists. When you ask us to delete your account, we delete or anonymise your personal information within 30 days, except where we need to keep some of it to meet legal obligations, resolve disputes or enforce our agreements. Messages you posted in a shared workspace may remain part of that workspace's history, without your name, where removing them would affect other members.

Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct information that is wrong;
• delete your information or your account;
• object to, or ask us to restrict, how we use your information;
• receive your information in a portable format; and
• withdraw consent where we rely on it.

To use any of these rights, contact us using the details below. We will respond within the time the law requires and won't treat you differently for using your rights. You may also complain to your local data protection authority.

Security

We protect information with encryption in transit, one-way hashes for passwords, sessions and tokens, access controls and monitoring. No system is perfectly secure; if you think your account has been compromised, revoke your conversation tokens and contact us.

International transfers

Fryll is operated from the United States, and your information may be processed in the United States and other countries where our providers operate. Where the law requires it, we protect transfers with appropriate safeguards such as standard contractual clauses.

Children

Fryll is not intended for anyone under 16, and we don't knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We may update this policy as Fryll changes. We will post the new version here with a new date, and tell you in advance of any significant change.

Contact us

Questions about this policy or your information: