This policy explains what Frend (“we”, “us”) collects when you use frend.one, why, who we share it with, and how you can delete it.
In short: we collect what we need to work on your code, we don’t sell your data or show ads, and we don’t use your code or conversations to train AI models.
What we collect
- Your GitHub profile. When you sign in with GitHub we receive your name, email address, avatar, GitHub user ID, and username.
- Your repository list. The names and basic details of repositories you can access, so you can pick one to work on. We use a GitHub access token to refresh this list; we don’t store that token.
- Your repository code. When you start a conversation, the repository is cloned into an isolated sandbox so Frend can edit, run, and preview it.
- Conversations. Your messages, Frend’s replies and tool activity, images you attach, elements you select in the preview, and notes Frend keeps for a repository.
- Environment variables. Values you choose to save for a repository. They are encrypted at rest (AES-256-GCM) and only decrypted to fill your sandbox.
- Technical data. Server logs such as request times, errors, and IP addresses, which we use to keep the Service running and secure.
In your browser, Frend stores your sign-in session and preferences such as theme, model, and sidebar state. We don’t use advertising or third-party analytics cookies.
How we use it
- to run the Service: sign you in, work on your repositories, show previews, and open pull requests;
- to keep the Service secure and prevent abuse;
- to fix problems and improve Frend; and
- to contact you about your account or important changes.
We don’t sell your personal data, and we don’t use your code or conversations to train AI models.
Who we share it with
We share data only with the providers that run parts of the Service for us:
- Google Firebase: sign-in, database, hosting, and server functions.
- Fly.io: the sandboxes where your repository is cloned, built, and previewed.
- GitHub: reading your repositories, pushing branches, and opening pull requests.
- AI model providers (Anthropic, OpenAI, or Google, depending on the model you pick): your messages and the relevant code are sent to that provider to generate a response. We use their commercial APIs, whose terms don’t allow them to train models on this data by default.
We may also disclose data if the law requires it, to protect people’s safety or our rights, or as part of a merger or acquisition, in which case this policy would continue to apply.
How long we keep it
Conversations are kept until you delete them. Deleting a conversation removes its messages and destroys its sandbox. Your profile and repository list are kept while your account is active. To delete your account and all associated data, email us and we’ll do it within 30 days. You can also revoke Frend’s access at any time by uninstalling its GitHub App in your GitHub settings.
Security
Each conversation runs in its own isolated sandbox. Pushes go through the GitHub API, so your GitHub credentials never enter the sandbox. Data is encrypted in transit, and saved environment variables are also encrypted at rest. No system is perfectly secure, but we work to protect your data and will notify you of a breach that affects it as required by law.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or limit how we use it. Email us to make a request. If you’re in the EU or UK, you can also complain to your local data protection authority.
Children
Frend isn’t intended for children under 13, and we don’t knowingly collect their data.
Changes
If we change this policy in a meaningful way, we’ll update the date above and let you know in the Service or by email.
Contact
Questions or requests: hello@frend.one.