Frame privacy policy

Who handles your data

Crow Tech Pte. Ltd. (“Crow Tech”, “we”) publishes the Frame app. The app works with a Frame server. You choose that server when you set up the app, by typing its address or opening an invite link.

Each Frame server is run by its operator: you, or a friend who invited you. The operator decides how the server is set up and is responsible for the data on it. Crow Tech doesn't offer a hosted Frame service, doesn't create or run your account, and has no access to the servers you use.

Crow Tech runs one small service for Frame, at frame.crow.sg: the push relay that delivers notifications, the invite link page, and a return page for Sign in with Apple on Android. Each is described below.

What your Frame server stores

Your server stores what it needs to run Frame for you:

• Your account: name, username, profile photo, the e-mail address or phone number you sign up with, and your password as an Argon2id hash. If you use Sign in with Apple or Google, the account ID that provider gives the server.
• What you share: photos and videos, their thumbnails and captions, who you sent them to, reactions, replies and messages.
• Activity: friends, friend requests, blocks, invites, reports you make, who viewed your moments, and read receipts if you leave them on.
• Your signed-in devices: device name, platform, and when each session started and was last used. For notifications, a key your phone made and a sealed relay token (see below).

The server also sees your IP address when the app connects to it. Photos and messages are not end-to-end encrypted against the server operator: whoever runs a server can see what is stored on it. Only use servers run by people you trust, or run your own.

Other people on the same server can see your name, username and profile photo, and can find you by username unless you turn off Findable by username in Settings. Your moments are visible only to you and the friends you send them to.

Before uploading, the app re-encodes photos and videos from their pixels. This removes embedded metadata such as the camera's GPS location. The app doesn't ask for your location.

Notifications and Crow Tech's push relay

Apple and Google only deliver notifications sent with the app publisher's keys, and self-hosted servers can't have those. So Frame servers send notifications through Crow Tech's push relay at frame.crow.sg. Your server's operator can turn notifications off; the app then refreshes while it's open and the widget updates about every 15 minutes.

When you allow notifications:

• Your phone gets a push token from Apple (or Google on Android). The app sends it to the push relay your server names, which is frame.crow.sg unless the operator changed it.
• The relay seals the token, encrypting it with a key only the relay has, and returns it. Your server only ever gets this sealed token, never your phone's real one. Sealed tokens expire after 60 days; the app gets a fresh one each time it opens.
• Your phone makes its own random encryption key and shares it only with your server.
• When a friend sends you something, your server encrypts the notification (the sender's name, the text, and a link to the thumbnail on your server) with that key using AES-256-GCM. The relay passes the encrypted message to Apple or Google, and your phone decrypts it.

The relay, Apple and Google see only encrypted data and the generic text “Frame: New activity”. On iOS 26 and later, widget refresh signals carry no content at all.

The relay has no database and stores nothing. Its logs contain only counts and status codes. It never logs push tokens, sealed tokens, notification contents or IP addresses. It uses the connecting IP address briefly in memory to limit the rate of requests. What the relay can tell is that a server, identified by its IP address, asked it to deliver a notification of a certain size at a certain time. It can't read the notification or tell who you are.

frame.crow.sg is reached through Cloudflare, which carries the connection and may process connection data such as IP addresses under its own privacy policy. Apple and Google learn that a notification was delivered to your device and when.

Logging out removes your device from your server's notification list at once. Turning off notifications for Frame in your phone's settings stops them on your side straight away.

Invite links

Invite links look like https://frame.crow.sg/i#s=…&c=…. The server address and the invite code come after the “#”. Browsers never send that part to frame.crow.sg. The page reads it in your browser to open the app, or to show the server address for you to copy. The page has no analytics and loads nothing from other websites.

Anyone who has your invite link can join your server, if the server allows it, and become your friend. Share it privately. If it reaches the wrong person, use Settings → Reset invite link to cancel your open invites.

Signing in

With an e-mail address or phone number and a password, the app sends these only to your server. Phone numbers are just identifiers: Frame doesn't send verification texts. Your e-mail is used for password resets only if your server is set up to send e-mail.

With Sign in with Apple or Google, Apple or Google gives the app a signed token. The app sends it only to your server, which checks it itself. The token is tied to your server's address and works once, so another server can't reuse it. Accounts made this way start without an e-mail address: the server doesn't store the e-mail in the token. Apple and Google handle their sign-in screens under their own privacy policies.

On Android, Apple's sign-in page returns its token to frame.crow.sg/apple/callback. That page hands the token straight back to the app. It stores and logs nothing, and the token is useless without a one-time value that only your phone and your server know.

Finding friends from your contacts

This is optional. It only runs when you choose to find friends and allow Contacts access. On your phone, the app:

1. reads the phone numbers and e-mail addresses in your contacts;
2. normalises them: phone numbers to international format (for example +6591234567), using your phone's region for local numbers, and e-mail addresses trimmed and in lower case;
3. turns each one into a SHA-256 hash of the fixed text frame-contact-v1: followed by the number or address;
4. sends only those hashes to your server, at most 2,000 per request.

Names and everything else in your contacts stay on your phone. The server compares the hashes with people who allow Findable by contacts, returns the matches, and doesn't store the hashes you sent. Each person can check at most 10 times an hour.

A hash hides a number from casual view, but phone numbers can be guessed by trying them all. This protects against accidental exposure, not against a server operator set on finding out. You can turn off Findable by contacts in Settings at any time.

For contacts who aren't on your server yet, the app can open a text message with your invite link. Nothing is sent unless you send it.

Permissions on your phone

• Camera: to take the photos and videos you send.
• Microphone: to record sound with your videos.
• Photos: you pick photos and videos with the system picker, which shares only what you pick. When you tap Save, the app asks for permission to add to your library.
• Contacts: optional, for finding friends as described above.
• Notifications: optional, to tell you about new moments, messages, reactions and friend requests. You can switch each type on or off in the app.
• Local network: only used if your Frame server runs on your local network.

Frame doesn't ask for your location and doesn't track you across apps. The Android app asks for the same kinds of access.

What stays on your phone

The app keeps your sign-in session in the iOS Keychain (on Android, storage protected by the Android Keystore), your notification key, your settings, and cached thumbnails so photos load quickly. The widget keeps your friends' latest photos to show them. Widgets and notifications show photos to anyone who can see your screen, so use a passcode on your phone.

No ads, analytics or tracking

The iOS app contains no third-party code at all: no advertising, analytics, crash-reporting or tracking SDKs. Frame doesn't scan, sort or moderate your photos with AI.

The Android app includes two Google components: Firebase Cloud Messaging to receive notifications (with Firebase analytics switched off; notifications aren't switched on for Android yet), and Google's sign-in library if your server offers Google sign-in. Google handles that data under its Privacy Policy.

If you choose to share crash data with app developers in your phone's settings, Apple or Google may send us crash reports. During beta testing, Apple TestFlight may provide diagnostics and the feedback you send, under Apple's own terms.

Reporting and blocking

When you report a moment, a message or a person, the app sends the reported item, the reason you pick and your optional note to your Frame server. The server keeps the report so its admin can review the item, remove it or suspend the account. The admin can see that the report came from you. Reports go to that admin, not to Crow Tech.

You can block anyone, also while reporting them. Blocking ends the friendship and hides you from each other in search.

Deleting your account and how long data is kept

Delete your account in the app with Settings → Delete account. Your server then deletes your account and all your moments, photos, videos, messages, friendships and sessions. This can't be undone. Reports you made stay with the server's admin, no longer linked to your account. You can also delete a single moment or unsend a message at any time.

Otherwise, your server keeps your data until you or its operator delete it. The operator decides how long backups are kept, and older backups may still contain deleted content until they are replaced. Friends may have saved or screenshotted what you sent them, and their phones may keep cached copies for a while.

For access to, correction of or deletion of data on a server, ask that server's operator: they hold it, and Crow Tech can't see or change it. The push relay keeps nothing to delete.

Children

Frame isn't meant for children under 13, and Crow Tech doesn't knowingly collect personal data from children. The app doesn't send personal data to Crow Tech. If you think a child is using a Frame server, contact that server's operator.

This website is separate from the app

Visiting crow.sg can expose ordinary connection information to its hosting provider. This website uses website analytics, including Google Analytics, as described in our website privacy policy. Those website services are not part of the app, and visiting this page sends nothing from your Frame account to Crow Tech.

Changes to this policy

We will update this policy and its effective date when the way Frame handles data changes, and update the app's privacy information on the App Store to match.

Contact

Contact [email protected] for privacy questions about the Frame app, the push relay or support correspondence. For data stored on a Frame server, contact the person who runs that server.

Crow Tech Pte. Ltd.
152 Beach Road, #23-02 Gateway East
Singapore 189721

See also the Frame terms of use.