1. Technologies we use
Frame may use HTTP cookies and browser storage (localStorage and sessionStorage). HTTP cookies may be strictly necessary for authentication, security or requested features such as enrolling an Enterprise trusted browser; browser storage is limited to consent, interface preferences and, after consent, optional analytics/product state; optional categories must not be activated before consent where consent is required.
2. How consent works
On the first visit without a saved preference, a panel offers controls to reject optional categories, configure them or accept them. Accepting and rejecting optional categories are offered with equivalent prominence in the first layer. Rejection does not disable strictly necessary storage or prevent use of essential service functionality.
You can review or change your choice at any time through .
3. Categories
- Essential: needed for security, authentication, remembering privacy choices or providing a requested feature.
- Functional: remember interface preferences on this browser. They do not store the project as its source of truth.
- Analytics: optional aggregate/statistical measurement where an integration is enabled and consent exists.
- Product: optional product-interaction telemetry used to understand usage and improve features.
4. Current inventory
| Key | Technology | Purpose | Retention | Category |
|---|---|---|---|---|
| frame.cookie-consent.v2 | localStorage | Stores consent choices for optional categories. | Until changed or cleared | essential |
| ph_frame_posthog* | localStorage | Stores consent-gated PostHog analytics/product identifiers, session metadata and feature-flag state after an optional category is accepted. | Until consent is withdrawn, browser storage is cleared or the configured PostHog retention no longer requires the local identifier | analytics |
| ph_frame_posthog_session_registered_properties | sessionStorage | Keeps consent-gated PostHog session-scoped registered property keys for the current browser tab. | Current browser tab/session or until consent is withdrawn | analytics |
| frame_posthog_consent* | localStorage | Stores PostHog's local opt-in/opt-out marker after Frame's optional telemetry consent has been changed. | Until the consent choice changes or browser storage is cleared | analytics |
| frame.block-library.favorites.v1 | localStorage | Stores block-library favorites on this browser. | Until changed or cleared | functional |
| frame.block-library.recent.v1 | localStorage | Stores recently inserted block-library entries on this browser. | Up to 16 entries until cleared | functional |
| frame.editor.effect-favorites.v1 | localStorage | Stores favorite effect presets on this browser. | Until changed or cleared | functional |
| frame.editor.effect-recents.v1 | localStorage | Stores recently used effect presets on this browser. | Up to 64 entries until cleared | functional |
| frame.editor.fonts.recent | localStorage | Stores recently selected editor fonts on this browser. | Up to 5 entries until cleared | functional |
| frame.editor.onboarding.dismissed | localStorage | Remembers whether editor onboarding has been dismissed on this browser. | Until cleared | functional |
| frame.dashboard.onboarding.dismissed | localStorage | Remembers whether the workspace onboarding has been completed on this browser. | Until cleared | functional |
| frame.workspace.missions.v1 | localStorage | Stores completed onboarding missions on this browser. | Until cleared | functional |
| frame-layer-collapsed:* | localStorage | Remembers collapsed layer rows in the editor on this browser. | Until cleared | functional |
| frame:configure:v4-ui:* | localStorage | Remembers the active project configuration tab on this browser. | Until cleared | functional |
| frame:settings:v5-tab | localStorage | Remembers the active settings tab on this browser. | Until cleared | functional |
| frame:workspace-sidebar:v1:* | localStorage | Remembers whether the authenticated workspace sidebar is collapsed on this browser. | Until changed or cleared | functional |
| frame_device_trust_v1 | cookie | Stores the opaque trusted-browser token used by an Enterprise workspace session policy after explicit device enrollment. | Cookie up to 365 days; effective trust expires after the workspace policy lifetime (1–365 days), revocation or browser removal | essential |
| Frame GitHub OAuth flow cookies | cookie | Short-lived state, PKCE verifier, initiating-account binding and return-locale cookies used only while connecting GitHub. | 10 minutes or until the OAuth callback completes | essential |
| Frame Vercel OAuth flow cookies | cookie | Short-lived state, initiating-account binding and return-locale cookies used only while connecting Vercel. | 10 minutes or until the OAuth callback completes | essential |
| Clerk session cookies | cookie | Hosted authentication and session security. | According to the hosted authentication session configuration | essential |
5. Third-party cookies
Where a configured feature depends on a third party, that third party may set its own technical storage—for example for authentication or security—or, if an optional feature is enabled, storage subject to the relevant consent. The optional PostHog integration is loaded only after analytics or product-telemetry consent; Frame configures it with localStorage persistence, a first-party proxy and consent-withdrawal controls. The inventory must be updated before production activation of any technology that changes the categories, purposes or third parties described here.
5a. Necessary OAuth connection cookies
When a user voluntarily starts a GitHub or Vercel connection, Frame creates temporary HttpOnly cookies to validate OAuth state, bind the flow to the Frame account that initiated it and return to the correct locale after the callback. The GitHub connection additionally retains the PKCE verifier temporarily. They are strictly necessary to secure the requested flow, use SameSite=Lax, are marked Secure in production and expire after approximately 10 minutes or when the callback completes. They are not used for advertising or analytics.
5b. Real-time collaboration sessions
Real-time collaboration does not add its own Frame localStorage key or persistent cookie. After authentication the browser receives a short-lived WebSocket ticket; the ticket remains in memory and is renewed through the authenticated Frame session. Presence and CRDT state are transmitted to the Cloudflare realtime service while this paid feature is active.
6. Withdrawing consent and clearing local data
You can withdraw or change consent through . Withdrawal affects future use of optional categories and does not invalidate processing lawfully carried out before withdrawal.
You can also clear cookies and browser storage through browser settings. If you delete the key that stores your choice, the consent panel will be shown again so you can choose again.
7. Legal basis
Strictly necessary storage is used to provide a requested feature, maintain security or remember the privacy choice itself where applicable law permits that use without consent. Optional analytics/product categories rely on consent where required and remain disabled until consent is obtained.
8. Updates and contact
If the storage inventory, purposes or optional categories change, this policy and, where applicable, the consent mechanism will be updated before the new use applies. Questions: privacy@balla.es.