Privacy notice

This notice explains what personal data Framecheck collects, why, who we share it with, how long we keep it and what your rights are. It applies to the Framecheck website, dashboard, API, uploader, GitHub App and the emails we send.

Framecheck is a service for software teams. Our customers are businesses. If you use Framecheck as a member of a customer's team, the customer decides who is added to its company account, and some of what you see in Framecheck is the customer's own content.

Who we are

Framecheck is a business based in the United Kingdom, run by a sole trader. For the personal data described in this notice, Framecheck is the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, except where we say we act for a customer (see "Content in your Storybook builds").

You can contact us about privacy at support@framecheck.dev. We have not appointed a data protection officer, because the law does not require us to.

The personal data we process

Trial eligibility records

We retain a minimal record of permanent GitHub owner IDs, repository IDs and the GitHub identity that activates a trial, together with the associated Framecheck account reference and eligibility status, to prevent repeat trials. These records remain after disconnection, app removal or account deletion; changing a GitHub name does not reset eligibility. Contact support@framecheck.dev if you believe an eligibility decision is incorrect.

Your GitHub account

If you sign in with GitHub, GitHub gives us your GitHub user id, your username (login), your display name if you have set one, and the address of your avatar image. We do not ask GitHub for your email address, your repositories' code or access to your personal repositories through sign-in.

If you join a company through the GitHub App, we also check with GitHub whether you are a member of that GitHub organisation and what your role is.

Signing in with email and password

You can create a Framecheck account with your email address and a password instead of GitHub. Sign-up, sign-in, email verification and password resets are run for us by Amazon Cognito, part of Amazon Web Services (AWS), in London (eu-west-2), on our sign-in page at auth.framecheck.dev. Cognito keeps your email address, whether it is verified, and your password in a form that cannot be read back. Framecheck never sees or stores your password.

We keep your personal sign-in email address, whether it is verified, your display name and the sign-in methods linked to your account (for example "Email and password" or "GitHub", with when each was added and last used). If a sign-in provider gives us an address without proving that it is yours, we keep it as unconfirmed, and use it only to send the confirmation link you ask for, until you confirm it. We send to this address only what concerns your account: verification and password-reset codes, confirming a new address, security notices (for example when a sign-in method is added or removed, or two-factor authentication changes), and messages about companies you belong to or are invited to (invitations, requests to join, ownership and admin changes). Codes expire after 24 hours, or 1 hour for a password reset.

Two-factor authentication. If you turn on two-factor authentication, or a company you belong to requires it, we keep your authenticator app's secret encrypted with a dedicated key in AWS's key management service, and your recovery codes only as keyed hashes. We also keep when each was set up or used, and a count of wrong codes so that code entry can be locked for a while after too many.

Your security log. We record security events on your account, such as sign-ins, two-factor authentication changes, recovery codes used, password resets and sign-in methods added or removed, with a shortened IP address (the last part removed) and your browser details. We keep each event for 24 months and the shortened IP address and browser details for 90 days, then delete them automatically.

Your company and its members

We keep the companies you create or join, their names and web addresses on Framecheck, who belongs to each company, each member's role and invitations. Each company also has one contact email address for billing and account notices (see Email below).

Repositories and builds

When a company connects repositories through the Framecheck GitHub App, we keep each repository's GitHub id, full name, whether it is private and its default branch. For each uploaded build we keep the commit id (SHA), branch name, pull request number, the commit history needed to find the right baseline, and the link to the CI run.

To apply a project's skip rules, we read a pull request's author, labels, draft state, branches and commits from GitHub.

For Smart Snapshots, we read from GitHub the names of the files a pull request changed and the file names in the repository at its merge base, and we read the module list your Storybook build writes (preview-stats.json). We keep file and module names, never file contents, with the build's results for up to 30 days. The module list is not published with a hosted Storybook.

Content in your Storybook builds

When a screenshot changes, Framecheck can also record a limited, redacted description of the page structure (DOM) to help reviewers understand the HTML change. Form values and passwords are omitted, ignored regions are masked and recognised tokens are redacted. A project admin can turn recording off, and individual stories can opt out. This page structure has the same company access rules and retention as its screenshot.

Your team uploads Storybook builds. We store each build, capture screenshots of its stories and run automated accessibility checks on them. The screenshots and accessibility findings (which can include pieces of the page's HTML and text) show whatever your Storybook contains. That can include personal data if your stories use real names, photos or other real data.

For this content we act as a processor on behalf of the customer that uploaded it: we use it only to provide the service to that customer. The customer is responsible for what it uploads. We recommend using made-up data in stories.

Review activity

When you review a run we keep your decisions (accept or reject), who made them and when.

We also keep review comments and replies, requests for changes and reviewer assignments, with who made them and when.

Audit log

We keep a log of important actions in each company, such as members added or removed, role changes, project changes, upload tokens created or revoked, runs cancelled or re-run and promotion codes checked. Each entry records who did it and when. Company admins can see their company's log.

Technical data, security and rate limiting

• Access logs. Our API's access logs record the IP address, time, method and path of each request. We keep them for 14 days.
• Rate limiting. To protect sign-up, company creation, checkout, billing email requests and uploads from abuse, we count requests per IP address, per user and per project in one-hour windows. The counters do not store IP addresses: they store a keyed hash (a one-way code made with a secret key). They are deleted automatically soon after the window ends, normally within two days.
• Sessions. When you sign in we keep a record of your session, stored under a hash of the session token rather than the token itself. It expires after 30 days or when you sign out.
• Application logs. Our servers keep operational logs for 14 days. We write them so that they do not contain email addresses, names or the content of emails.

Billing

Payments are handled by Stripe. When a company subscribes or buys credit, Stripe collects the card details and billing contact details. If the company has a confirmed billing email, we give it to Stripe when it is confirmed (if the company already pays through Stripe) and whenever a payment page opens, so that the page is filled in with it and Stripe's receipts and invoices go to it. We never copy an email address from Stripe into Framecheck. We never receive or store full card numbers. We keep the company's Stripe customer and subscription ids, subscription status, invoices and payments as Stripe reports them, the credit balance, top-ups, the spend limit, automatic top-up settings (including the record that an admin agreed to them), snapshot counts and charges, refunds and disputes.

Email

Each company has one email address for billing and account notices, which a company admin gives us. We keep that address, whether it has been confirmed, and the company's email preferences. We use the address only after someone opens the confirmation link we send to it. When an admin changes it, we keep the previous address only until we have sent it a notice about the change, and for no more than four days. Other members of the company see the address only partly. Your own sign-in email address is separate (see "Signing in with email and password"). We never take an address from GitHub or Stripe. If you gave us a personal email address for notifications before we moved to company addresses in September 2026, we no longer use it and will delete it.

Framecheck sends service emails only. Company emails go to the company's confirmed address: confirmation of the address, a notice to the previous address when it is changed, a welcome email, billing messages, reminders (for example when included snapshots are running low), and messages that need action. Sign-in, security and membership emails go to your own sign-in email address. If a company admin turns it on, we also send a daily run digest to the company's address.

We do not send marketing email.

For each email we keep a record of what was sent, when, and whether it was sent successfully, plus any bounce or complaint our email provider reports. When our email provider tells us that an address bounced permanently, was the subject of a spam complaint or is on its suppression list, we mark the address so that we stop sending to it.

Open tracking. Open tracking is switched on at our email provider, Resend, for every email sent from framecheck.dev, so it applies to all Framecheck emails. Resend records when an email is opened, using a small invisible image in the email. This tells Resend your IP address and the kind of device and email program you use at that moment. We use this only to check that our emails are delivered and read. The information is held in Resend's systems; Framecheck's own database does not store it. We do not track which links in our emails are clicked: links go straight to the page.

Because the setting covers the whole domain, it cannot be switched off for one address. If you have a question about it or object to it, email support@framecheck.dev.

Notification settings

A project can send notifications to webhook addresses the customer chooses, including a Slack incoming-webhook address. We store those addresses, and any webhook signing secret, encrypted (AES-256-GCM, with keys protected by AWS Key Management Service) in addition to our database's own encryption. Records of notifications sent are kept for 90 days. For each delivery attempt we keep the time, the response status and how long it took, never the response itself, for 30 days.

When you contact us

If you email us or use the contact form at framecheck.dev/help, we keep your message, your email address and our reply for as long as needed to deal with it. The form sends your message to our support inbox by email through Amazon Web Services; we do not store it in Framecheck.

Why we use your data and our lawful bases

Where we rely on legitimate interests, we have considered your interests and rights and believe the processing is expected and proportionate. You can ask us for more detail, and you can object (see "Your rights").

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell personal data or use it for advertising.

Who we share data with

We use the following service providers. They process data for us under contracts that require them to protect it, except where we say they act as an independent controller.

We may also share data if the law requires it, to protect our rights or the safety of others, or with a buyer if the business is sold (in which case we will tell you).

International transfers

Some of our providers process data outside the UK, mainly in the USA. Where that happens we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified under it) or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses issued under the Data Protection Act 2018. You can ask us for more information about these safeguards.

How long we keep data

Data that is not deleted automatically is deleted by us on request. If you or your company ask us to delete an account, company or project, email support@framecheck.dev and we will delete the data within one month, except what we must keep for legal reasons and the minimal trial eligibility records described above.

Cookies and similar technologies

Framecheck uses only what is strictly necessary to provide the service you ask for:

Requests that change data are also protected by a security token held in the page's memory. It is not stored as a cookie.

During the sign-in cookie transition, an existing fc_session cookie is replaced with __Host-fc_session on your next authenticated request. Its original expiry stays the same.

We do not use analytics, advertising or social media cookies, and the website loads no third-party scripts or fonts. When you pay, you are taken to Stripe's own payment page, which sets its own cookies under Stripe's privacy notice.

Because we use only strictly necessary storage, the Privacy and Electronic Communications Regulations (PECR) do not require us to ask for your consent, so we do not show a cookie banner. If we ever add anything that is not strictly necessary, we will ask first.

How we protect data

• All traffic to Framecheck is encrypted in transit (HTTPS).
• Our database and file storage are encrypted at rest, and notification destinations are encrypted again with a separate key.
• Screenshots are served through short-lived signed links, and every request is checked against the company's membership and the member's role.
• Session tokens and rate-limit subjects are stored as hashes, and secrets are kept in AWS's managed secret storage, never in code.
• Access to production systems is limited to the person who runs Framecheck.

No system is completely secure. If a personal data breach is likely to put you at risk, we will tell you and the ICO as the law requires.

Your rights

You have the right to:

• ask for a copy of your personal data (access);
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use it;
• object to our use of it where we rely on legitimate interests;
• receive data you gave us in a portable format, where the law provides for it.

To exercise any of these rights, email support@framecheck.dev. We may need to confirm who you are, and we will reply within one month (longer for complex requests, in which case we will tell you why). There is normally no charge.

If your request is about Customer Content that a customer uploaded, we will pass it to that customer and help them respond, because they decide how that content is used.

Complaints

If you are unhappy with how we use your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Children

Framecheck is a business service and is not intended for children. You must be at least 18 to use it. We do not knowingly collect data about children.

Changes to this notice

We will update this notice when our use of personal data changes, and change the date below. If a change is significant we will tell account holders by email or in the dashboard before it takes effect.

Last updated: 4 October 2026.