FAB Framework Privacy Policy

FAB Framework ("we," "us," or "our") is a component library and website builder for designing pages, forms, cards and layouts, and publishing forms that other people can fill in. This Privacy Policy covers fabframework.com and explains what we collect, why, who we share it with, and the choices and rights you have. FAB Framework is operated from the United States and is the controller of your personal information. For privacy questions or requests, email support@fabframework.com.

Information you give us

• Account information: your email address, a password (stored only as a secure hash), and any name or profile details you add.
• What you build: your pages, forms, cards, layouts, styles and settings, and any images you upload for them.
• Answers to your forms: when someone fills in a form you’ve published, we store their answers for you (see "Answers to Forms You Publish").
• Messages to us: what you send when you contact support.

Information collected automatically

• Device and log information: IP address, browser and device type, and the date and time of requests, so we can run the service, keep it secure and fix problems.
• Analytics: see "Cookies & Analytics" below.

We use your information to provide FAB Framework to you; send the emails the service needs (sign-up codes, password resets, security notices); answer support requests; keep the service secure, including blocking spam, abuse and attacks; understand how the site is used and improve it; and comply with the law.

We do not sell your personal information, we do not share it for targeted or cross-context behavioral advertising, and we do not use it to make automated decisions with legal or similarly significant effects on you.

Legal bases (EEA, UK and Switzerland). We process your information to provide the service you asked for (contract, or steps you request before one); for our legitimate interests in keeping it secure and improving it; with your consent, which you can withdraw at any time (for example, Analytics cookies); and to meet legal obligations.

Pages and forms you publish can be seen by anyone who has the link, unless you mark them private. Answers to your forms are visible only to you. The shared demo account is visible to everyone who uses it and is cleared every day, so don’t put anything personal in it.

We use a small number of service providers, who process information only on our instructions and only to provide their service:

• DigitalOcean: servers, database and file storage (United States);
• Resend: sending account and notification emails;
• Google: Google Analytics (see below);
• Cloudflare: an automatic security check on sign-up and forms, to tell people from bots.

Our servers also run security software that blocks malicious traffic; it may share the IP addresses of attacking computers (never your account information or content) with a community blocklist.

Essential storage (always on). We keep you signed in with a secure, http-only cookie and remember settings like your theme in your browser's storage. The site can't work without it.

Analytics cookies. Google Analytics counts visits and shows which pages are used. If you're in the EU, EEA, UK or Switzerland (judged from your device's time zone), it stays off until you choose "Accept all" in the cookie banner; elsewhere it's on by default and you can turn it off at any time from Cookie settings. It sets _ga and _ga_<id> (each expires after 2 years), never receives your content, and its advertising features are turned off. You can also use the Google Analytics opt-out add-on.

We don't currently respond to "Do Not Track" browser signals, since there's no common standard for them, and we don't track you across other companies' websites or apps.

Apart from the people you choose to share with and the providers above, we disclose information only if the law requires it, to protect the rights, safety or security of our users, the public or FAB Framework, or as part of a sale, merger or transfer of the service, in which case this Policy continues to apply and we'll tell you before it changes. We never sell your personal information.

We keep your information while your account is active. To delete your account, email support@fabframework.com from your account's email address and we'll delete it within 30 days; deletion removes your account and your content. Copies may remain in database backups for a short time until they're automatically replaced, and server and security logs are kept only as long as needed to run and protect the service.

We protect your information with encrypted connections (HTTPS), hashed passwords (new passwords are checked against Have I Been Pwned's list of leaked passwords using only a short, anonymous piece of a hash), a pause on sign-in after repeated wrong passwords, private file storage, and attack-blocking rules. No system is completely secure; if a breach affects your personal information, we'll notify you and the authorities as the law requires.

FAB Framework is for adults 18 and older. We don't knowingly collect personal information from anyone under 18. If you believe a child has given us information, email support@fabframework.com and we'll delete it.

If you fill in a form built with FAB Framework, your answers go to the person or business that published it, and their own privacy notice applies; we store them on their behalf and don’t use them for anything else. To see, change or delete your answers, contact the form’s owner. If you can’t reach them, email us and we’ll help.

Wherever you live, you can access and correct your information, delete your account, get a copy of your data (by request), withdraw consent, and object to or restrict some uses. Residents of the EEA, UK, Switzerland and U.S. states with privacy laws may have these rights under their local law. Email support@fabframework.com; we'll confirm your identity (usually by checking you control the email address you gave us) and respond within 30 days, or the time your law allows. You may use an authorized agent where your law permits, and we won't treat you differently for exercising your rights. If we deny a request, reply with "Appeal" in the subject and we'll answer within 45 days; you can also contact your state attorney general or, in the EEA/UK, your data protection authority.

FAB Framework is run from the United States, and your information is stored and processed there. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses with our service providers, for information transferred from the EEA, UK or Switzerland.

We may update this Privacy Policy. The date at the top shows when it last changed. For material changes we'll tell you by email or in the service before they take effect, and where the law requires it we'll ask for your consent.

Questions, requests or complaints about this Policy or your information: email support@fabframework.com.