Last updated October 7, 2026

Privacy Policy

Frankie adds AI assistants to your app, website and docs. This page explains what we collect to run it, who we share it with, how long we keep it and how to delete it. We don’t sell personal data, show ads or use your conversations to train AI models.

Operator details not set. This deployment hasn’t configured who runs it. Set FRANKIE_LEGAL_NAME, FRANKIE_LEGAL_JURISDICTION, FRANKIE_LEGAL_EMAIL in its environment to complete this page.

Who we are

Frankie is operated by the operator of this Frankie service (“we”, “us”). This policy covers the Frankie website, the dashboard and the hosted service behind Frankie’s chat widgets. You can reach us about privacy through the contact details the operator publishes.

Customers and visitors

Frankie handles data about two kinds of people:

Customers sign in to the dashboard with GitHub to set up workspaces. For their account data, we decide how it’s used.
Visitors chat with an assistant on a customer’s app or website. We process their conversations on behalf of that customer, who decides whether Frankie runs on their site, what the assistant knows and what it may do.

If you chatted with an assistant on someone else’s site, that business is responsible for your data and its own privacy notice applies. Contact them first. If they can’t help, contact us and we’ll work with them on your request.

What we collect

Data	What it includes	Where it comes from
GitHub account	Your GitHub user id, username, name, email address, avatar and the access token GitHub issues to Frankie.	GitHub, when you sign in. Name, email and the token live only in your encrypted sign-in cookie. We store your id and username to link you to your workspaces and teams.
Workspaces	Settings, agent instructions, theme, the actions and APIs you connect, signing secrets, connected Vercel project details, install status and the pull requests Frankie opens.	You, in the dashboard, and the repository you install into.
Knowledge base	Text from pages Frankie reads on the sites you list (up to 20 sources), and files you upload (PDF, Markdown, text, CSV or JSON).	You choose the sources and uploads.
Conversations	Messages, attached images and text files, the page the chat happened on, the assistant’s replies and tool results, and cost.	Visitors and customers, while chatting.
Visitor identity	For signed-in visitors: the id, name and email in the token the customer’s app provides, and that token itself, so the assistant can act as them. Anonymous visitors (only where a customer allows it) get a random id such as `anon_…`.	The customer’s app.
Hand-offs	The reason, a summary and any name or email a visitor gives when asking for a person.	Visitors, through the assistant.
Teams	Members’ GitHub usernames, roles and who invited them.	Workspace owners and admins.
Billing	Plan, subscription status, renewal date and Stripe customer and subscription ids. Card details go to Stripe and never reach us.	Stripe.
Technical data	IP addresses, used only in memory to limit request rates. Service logs with request ids, workspace ids, usernames and token counts, but not message text.	Your browser and our servers.

How we use it

To run the service: sign you in, save your workspaces, answer chats, take the actions you’ve allowed, and open pull requests you ask for.
To show customers their conversations, hand-offs and usage in the dashboard.
To bill paid plans.
To keep Frankie secure and working: rate limits, abuse prevention and fixing errors.
To contact you about your account or changes to the service.

Where the law asks for a legal basis, we rely on performing our contract with customers, our legitimate interest in running and securing the service, and legal obligations such as keeping billing records. For visitors, customers determine the basis for using Frankie on their site.

AI models

To answer a chat, Frankie sends the conversation to the AI model provider the workspace uses. That includes messages, attachments, page context, relevant knowledge-base passages, tool results, and the visitor’s id, name and email so the assistant knows who it’s helping. By default this is Fireworks AI. Customers can choose other providers, such as Anthropic, OpenAI, Google, Groq, Together or OpenRouter.

Knowledge-base text is also sent to the provider to build search embeddings. API descriptions you import are sent to generate skills. We don’t use conversations or workspace content to train models. Providers process this data under their own API terms.

AI answers can be wrong. Don’t rely on them for medical, legal, financial or other decisions where a mistake could cause harm.

Who we share it with

We share data only with the services that run Frankie, and with the places a customer tells Frankie to send it:

Who	Why	What they receive
Google Cloud	Hosts the chat service and its database (United States).	Everything Frankie stores.
Vercel	Hosts the dashboard and runs install and SDK-update jobs.	Dashboard requests. Your repository’s files during an install. Only package manifests and lockfiles during SDK updates.
GitHub	Sign-in, and reading and changing repositories you choose to install into.	Requests made with your GitHub token: reading files, creating a branch, a commit and a pull request.
AI model provider	Answers chats, builds search embeddings and generates skills.	What’s described under AI models.
Stripe	Payments and invoices.	Your workspace owner id and the details you give Stripe at checkout.
The customer’s systems	Actions and hand-offs the customer configures.	API calls made as the visitor (with their token, where the customer sets that up), and hand-off events sent to the customer’s webhook.

We may also disclose data when the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the service, in which case this policy continues to apply.

Cookies and browser storage

Frankie uses no advertising or analytics cookies and runs no third-party trackers.

Name	Where	Purpose
`authjs.session-token`	Dashboard	Keeps you signed in. Encrypted, and lasts up to 30 days.
`frankie.vercel.state`	Dashboard	Protects the Connect Vercel step. Lasts 10 minutes.
`frankie.theme`	Dashboard (`localStorage`)	Remembers light or dark mode, plus similar layout preferences.
`frankie.web.…`	Dashboard (`localStorage`)	Keeps your recent chats with Frankie on this device.
`frankie.<key>.session`	Customer sites (`localStorage`)	Lets an anonymous visitor continue a chat after reloading. It isn’t used for signed-in visitors, and customers can turn it off.
`frankie.<key>.messages`	Customer sites (`localStorage`)	Shows that anonymous visitor’s recent messages.

You can clear these at any time in your browser settings. If you do, you’ll be signed out or your local chat history will be cleared.

How long we keep it

Data	Kept for
Conversations and hand-offs	90 days after the last message, then deleted automatically. Deleted sooner if the workspace is deleted.
Chat sign-in tokens	1 hour by default.
Dashboard sign-in	Up to 30 days, or until you sign out.
IP addresses	Only in memory, for rate limiting. Never written to storage.
Workspaces, knowledge bases and teams	Until you delete them.
Billing records	As long as tax and accounting law requires.
Service logs	For a limited period set by our hosting provider’s logging service.

Deleting and accessing your data

You can do most of this yourself:

Delete a workspace from its Settings. This deletes its settings, secrets, knowledge base and every conversation in it. Unlock it first if it’s locked.
Delete a knowledge-base file or source from the workspace. It stops being used after the next refresh of the knowledge base.
Delete one of your own conversations from your chat history.
Remove a teammate, or leave a team, from Team.
Cancel a subscription in the Stripe billing portal, from Billing.
Revoke Frankie’s access to GitHub under Applications in your GitHub settings.

For anything else, contact us through the contact details the operator publishes. That includes a copy of your data, a correction, deleting your account or a visitor’s conversations, or an objection to how we use your data. Depending on where you live (for example under the GDPR, UK GDPR or California law), you may have the right to access, correct, delete or export your data, to object to or restrict its use, and to complain to your local data protection authority. We answer within 30 days and won’t treat you differently for asking.

Security

Traffic to Frankie is encrypted with HTTPS. Sign-in cookies are encrypted. Repository credentials for an install are encrypted and expire after 30 minutes, and SDK-update jobs run in an isolated sandbox with no GitHub access. Signing secrets are only shown to workspace admins. No system is perfectly secure. If we learn of a breach affecting your data, we’ll tell you without undue delay.

Where data is processed

Frankie’s servers and database are in the United States. Our providers may process data in other countries. Where data leaves the EU, UK or another region with transfer rules, we rely on safeguards such as the European Commission’s Standard Contractual Clauses.