Legal
Cookie Policy
How FramePrompts remembers privacy choices, protects prompt copies and measures optional analytics.
The older daily-count rollups do not use an identifier cookie. In the EEA, the United Kingdom and specified EU territories, they require your prior “Allow” choice; elsewhere they run unless you decline. When location is unknown, we require a choice. The separate browser-session funnel and 30-day browser count each require a fresh “Allow” in every country. Declining does not prevent you from using the prompt library.
1. What are cookies?
Cookies are small text files that a website asks your browser to store and send back with later requests. They can keep a service secure, remember a session or preference, or measure behaviour. Similar technologies include local storage, IndexedDB, pixels and device identifiers. Rules for storing or accessing information on a device generally apply to these technologies as well as traditional cookies.
2. Essential and optional technologies
Essential technologies are necessary to transmit communications, provide a feature you explicitly request, authenticate authorised administrators, or protect and operate the site. Where the law permits, these may be used without consent, but we still explain them here.
Optional technologies include non-essential analytics, behavioural advertising, cross-site tracking and similar tools. Where consent is required, these technologies must remain off until you make a freely given choice.
3. Technologies we use for privacy choices and optional measurement
| Technology | Who and purpose | Current use and duration |
|---|---|---|
fp_analytics_consent | FramePrompts; remembers whether you allowed or declined daily-count analytics, so that choice can be respected on later visits. It is not a visitor identifier and an earlier Allow does not authorise the session funnel or browser count. | Set when you choose “Allow” or “Decline” for analytics. Expires after 180 days. You can withdraw with “Withdraw analytics” or reopen “Privacy choices” after declining in the site footer. |
fp_analytics_notice_seen | FramePrompts; remembers which version of the analytics notice was shown, to avoid showing the same notice automatically on every visit. It is not consent or a visitor identifier. | Set when the current notice is first shown. A new version marker causes the updated notice to appear once again in every location, even if you made an earlier choice. Expires after 180 days. Closing without choosing does not allow the new measurement; an earlier daily-count preference stays in effect until you choose again. |
fp_funnel_consent | FramePrompts; remembers a fresh “yes” or “no” choice for the optional session funnel and separate browser count. A “yes” contains a random server-recorded consent-receipt ID, checked before either new measurement starts. This ID can be recognised across browser sessions for consent verification; the event and browser-count tables use separate IDs. An earlier daily-count analytics choice is not reused as permission for these methods. | A “yes” is set only after the server records the choice, UTC time and exact notice version and text. A “no” may also be saved when analytics is declined. Expires after 180 days. “No” prevents the session funnel and browser count; withdrawing consent changes the choice to “no” and revokes the previous receipt when available. Receipt rows are scheduled for deletion after 210 days from the working database; infrastructure-backup retention remains under review. |
fp_funnel_session — only after V3 consent | FramePrompts; a random pseudonymous browser-session ID used to connect V3 prompt opens, Copy-section and affiliate-button visibility, successful copies and affiliate clicks within that session. | Session cookie with no fixed expiry date. It is removed when you decline or withdraw. A browser may restore a session after restart. No V3 event is sent without fresh consent. |
fp_analytics_browser — only after fresh consent | FramePrompts; a separate random first-party browser ID used to count distinct consenting browsers over a selected period. It is not joined to the session funnel, specific prompts, copies, affiliate clicks, social posts or UTM values. The cookie is server-set but not marked HttpOnly, so scripts on this site can technically read it. | Fixed 30-day lifetime from first issue; later visits do not renew it. Decline or withdrawal clears the cookie and stops new records, but does not immediately delete earlier browser-day rows. Those rows contain the random ID, UTC day and observation time and are scheduled for deletion from the working database 30 days after that ID was first observed. This metric counts browsers, not people or all visitors; earlier traffic is not backfilled. Infrastructure-backup and log retention remain unverified. |
| Platform link path or short-link code and aggregate events | FramePrompts; permanent links such as /inst identify an assigned platform and open the homepage without a code. Separate /r/ links identify a prompt post or website placement. Where the geographic policy allows measurement without a prior choice and you have not declined, or elsewhere after “Allow”, a permitted link click is counted. A coded prompt link also carries its code to the prompt URL so prompt opens, successful copies and affiliate clicks can be counted for that post. A coded website link opens the homepage without passing its code onward; in an already consented V3 session, its first measured source and link ID can be retained in the server-side session report. | Otherwise the link only redirects, without counting or passing a prompt-post code onward. A later “Allow” choice does not backfill that visit. The aggregate counts add no visitor identifier; they may be kept while the publication and library are active. |
| Aggregate site-entry and device counts | FramePrompts; under the same country-and-choice rule, counts a public landing request or short-link entry by day, broad source, mobile/desktop/tablet/unknown device category and entry type. This rollup itself does not use the separate browser-count cookie or store the full User-Agent. A counted redirect adds a one-hop _fp_entry=1 URL marker to prevent double counting; the browser removes it after loading. | Entries are not unique visitors and are not backfilled from earlier traffic. The source assigned to a short link identifies the link used, not a verified referrer. |
| Privacy-choice action totals | FramePrompts; counts saved Allow, initial Decline and later Withdraw actions separately by day to evaluate the privacy interface. No visitor, prompt or social-post identifier is stored in these totals. | Recorded after a choice changes, including a refusal or withdrawal, independently of optional prompt analytics. These are action counts, not unique people. Closing a notice without choosing is not counted. |
fp_copy_session | FramePrompts; associates repeated prompt-copy requests for a separate security audit. It is not used for optional analytics, advertising or the IP-based copy rate limiter. | Set only after the visitor explicitly presses “Copy prompt”. Expires after 30 days. Authorised admin requests are excluded. Its necessity and duration are under separate review. |
fp_internal | FramePrompts; marks an authenticated administrator’s browser so its later activity is excluded from production analytics. It does not grant admin access. | Set on an authenticated admin analytics visit. Expires after 30 days. |
| Conditional security or challenge cookies | Cloudflare; used only when a configured security feature needs to identify trusted traffic, manage a challenge, balance traffic or prevent abuse. Depending on the triggered feature, names may include cookies documented by Cloudflare, such as cf_clearance or __cf_bm. | They may not appear during an ordinary visit and are not used by FramePrompts for advertising. Whether one is set and its lifetime depend on the Cloudflare security feature and configuration active at that time. We will update this table if a persistent feature is enabled. |
| Admin authentication | FramePrompts and your browser; restricts the private administration area. | The admin area currently uses HTTP Basic Authentication, not an application session cookie. A browser may temporarily remember or cache credentials according to its own settings. This is available only to authorised administrators. |
IndexedDB: promptme-local-backup | FramePrompts admin tool; remembers the administrator’s selected local backup-folder handle so the browser can request permission again. | Admin area only. Stored on the administrator’s device until cleared through browser/site-data settings or replaced. It is not used to track public visitors. |
| Network Error Logging and reporting configuration | Cloudflare and compatible browsers; helps report delivery failures and maintain reliability and security. | The server may send reporting headers that the browser retains for the period specified in those headers. Reports may contain technical request and network data. This is not used by FramePrompts for advertising. |
| Outbound affiliate links | FramePrompts may include a referral code in a clearly marked link to a third-party AI tool. The Higgsfield button uses our /go/higgsfield route before redirecting to the affiliate URL. With fresh V3 consent and available measurement, the route records a click ID, session ID, prompt/post attribution where available, filtered UTM values and the destination URL before redirecting. Without that consent, it still redirects without a V3 session event. | Merely displaying the link does not set a third-party affiliate cookie on frameprompts.com. After you follow it, the destination provider may set its own referral cookie or similar technology on its domain under its own notice. V3 working-table event rows are scheduled for deletion after 30 days; provider logs and backups require separate verification. |
Cookie names and lifetimes used by infrastructure security features can change as threats, browser behaviour and Cloudflare configuration change. You can inspect current cookies at any time using your browser’s developer tools or site-data settings.
4. Optional analytics and your choice
Cloudflare supplies an approximate country for each request. In the European Economic Area (including Åland Islands, code AX), the United Kingdom (GB), and French EU territories coded GF, GP, MF, MQ, RE and YT, daily-count analytics remains off until you select “Allow”. The same cautious rule applies when the country cannot be determined. In the United States and other locations, limited daily-count analytics runs without a prior “Allow” choice unless you have selected “Decline”. A prior “Decline” applies regardless of a later change of country. Where a choice is required, the original notice appears automatically only on its first eligible visit in a browser for 180 days, unless site data is cleared. It offers “Allow” and “Decline” as same-sized, clearly labelled buttons; neither option blocks the site. Closing or ignoring it does not grant consent, and daily-count analytics stays off in those locations unless an earlier Allow is still in effect. “Privacy choices” remains available in the footer even where no banner is shown. The choice cookie honours your decision, not identifies you in daily-count analytics. Aggregate post-link measurement itself does not use an analytics identifier cookie, but tracking URLs and client-side event requests follow the same country-and-choice rule.
A click on Buy prompt opens our /go/checkout redirect and then the saved Lemon Squeezy checkout. Where measurement is permitted, that redirect increments a separate daily Buy-click count for the prompt and, if validated, its post link. It is not a purchase count. No additional analytics cookie is set for this action, and refusing optional measurement does not prevent checkout. The updated notice names Buy-button clicks and is shown once again; in prior-consent regions, an earlier Allow alone does not start this new count.
The updated banner appears once again to every browser, regardless of country or an earlier daily-count choice. One fresh “Allow” permits the daily totals, V3 session funnel and separate browser count; “Decline” turns all three off. The session and browser-count cookies start only after that affirmative choice and a current server-recorded consent receipt. Closing the updated notice grants no new permission and leaves the earlier daily-count choice unchanged. We do not backfill visits or actions before consent. The session ID links actions within one browser session; the separate 30-day browser ID lets us count a browser only once over a selected period without linking it to those actions. Neither identifies a physical person. Session-funnel working-table rows are scheduled for deletion after 30 days; browser-day rows are scheduled for deletion 30 days after an ID was first observed. A coded /r/ visit made before permission in a consent-required region remains unattributed even if you later allow measurement. The separate copy-security identifier is not used to join either new method. Public user accounts do not currently exist.
If you allowed analytics, use “Withdraw analytics” in the footer to withdraw in one step; this clears the session and browser-count cookies and stops new optional events. Otherwise use “Privacy choices” there to decline or change your choice. A refusal stops future optional analytics in any country; it does not automatically erase rows already recorded before your refusal, which remain subject to the retention periods and your applicable rights. If we introduce other optional advertising or non-essential technologies, we will first update this Policy and, where required by EU or Polish law:
- show a consent interface before those technologies activate;
- offer a genuine reject option as well as an accept option;
- explain the providers, purposes and durations; and
- make withdrawing consent as easy as giving it.
No optional advertising cookies are currently active.
5. How to control cookies and site data
Most browsers let you view, delete and block cookies or other site data through privacy or security settings. You can usually delete data for frameprompts.com alone or configure the browser to reject future storage.
Blocking essential security mechanisms may cause a security check or private admin feature to stop working. Deleting the admin IndexedDB record removes the remembered backup-folder handle; it does not delete files already saved in the administrator’s local folder.
Browser instructions are available from the support pages for Chrome, Firefox, Safari, Edge and other browsers. Because browser menus change, consult the documentation for your installed version.
6. Personal data and providers
Some technical identifiers, IP addresses and request or security information may be personal data. Our Privacy Policy explains why we process that data, Cloudflare’s role, international transfers, retention and your GDPR rights.
7. Changes to this Policy
We may update this Policy when our technology, providers or legal obligations change. We will post the revised version here and change the “Last updated” date. If a new technology requires consent, it will not be treated as accepted merely because you continue browsing.
8. Contact
Questions about cookies or site data may be sent to privacy@frameprompts.com.
Operator: Denys Holovatiuk, operating FramePrompts
Postal address: Smoluchowskiego 5, 02-679 Warsaw, Poland