Log inStart free
← All legal

Privacy Policy

Last updated: [Effective date — to be set upon legal review]Draft — pending legal review

This Privacy Policy describes what personal data Freely (provided by [Legal Entity Name — TBD]) collects, why, and who it's shared with. It covers two different groups: account holders (people who sign up to build and run surveys) and survey respondents (people who answer a survey a workspace created). Where a workspace owner controls what their own survey collects from respondents, this policy explains our role as the platform, not the workspace owner's own use of that data.

1. Data we collect from account holders

  • Account credentials: email and password, handled by our authentication provider (Supabase Auth).
  • Profile: display name and avatar image, if you choose to add them.
  • Workspace info: workspace name, logo, brand color, and the roles/emails of anyone you invite to your workspace.
  • Billing: your email and plan/subscription status, shared with Stripe to process payment. We never receive or store your card details — Stripe's hosted checkout handles that directly.

2. Data we collect from survey respondents

Most respondents interact with surveys anonymously — there's no respondent account or login. What we collect depends on what the workspace's survey asks and how it's configured:

  • Survey answers: whatever the respondent enters, in whatever format the question asks for (this can include free-text fields the workspace owner chose to include).
  • Email, only if the survey uses email verification or limits respondents to one response per person.
  • Approximate location: for abuse-prevention and analytics purposes, we derive a country code from the respondent's IP address at submission time via a third-party geolocation lookup (ip-api.com). We do not store the raw IP address — only the resulting country code is saved.
  • Browser/device type (e.g. browser name, OS, device category), read from the browser itself — not a fingerprinting technique, and not tied to an identity.
  • An anonymous device identifier, only for surveys embedded via our SDK on a workspace's own site or app — a random ID stored in that site's local storage, used only to recognize repeat views of the same survey on the same device. It isn't linked to any personal identity.

3. Cookies and tracking

The marketing site (freely.biz) uses PostHog for basic product analytics — see the cookie notice on this site for details. The Freely application itself doesn't use advertising or marketing cookies, and doesn't run third-party ad-tracking scripts. The only browser storage the application uses is:

  • a session token our authentication provider stores locally so account holders stay logged in;
  • the anonymous per-device survey identifier described above, only on pages/sites that embed our survey widget.

4. Who we share data with

We use a small number of service providers to run Freely, each only for what's needed to operate the Service:

  • Supabase — our database, authentication, file storage, and backend hosting provider. All account, workspace, survey, and response data is stored here.
  • Stripe — payment processing for paid plans. Receives your billing email and plan selection; never receives our servers' copy of your card data because there isn't one.
  • Vercel — hosts the web application.
  • ip-api.com — receives a respondent's IP address at the moment of survey submission, solely to return a country code; we don't retain the IP itself.
  • Sentry — error monitoring for our production environment, so we can detect and fix bugs. Receives technical error/crash details; we don't send it your survey answers or a signed-in user's identity as part of error reports.
  • Resend — our transactional email provider, used (when active) to deliver survey email-verification codes and response notification emails. Account invite/login emails go through Supabase's own auth email system instead.
  • PostHog — product analytics for this marketing site.

We don't sell personal data, and we don't share it with third parties for their own marketing purposes.

Destinations you (as a workspace owner) configure yourself

If you set up a webhook or use an API key to embed a survey on your own site, you're directing us to send response data (including respondents' free-text answers) to a destination you control. That's your data flow, not ours — see the Terms of Service for details.

5. Where data is stored

Data is stored on Supabase Cloud infrastructure in the United States (currently the us-east-2 region). [International-transfer language — TBD, depends on target markets and legal review.]

6. Data retention and deletion

We keep workspace and survey data for as long as the workspace exists. Deleting a workspace from account settings deletes its surveys, responses, and related data — this cascades automatically and can't be undone. To request deletion of your account or data you can't remove yourself, contact us at support@freely.biz.

Because most respondents are anonymous, we generally can't identify or act on an individual respondent's data-deletion request ourselves — that request should go to the workspace that ran the survey. Where a respondent did provide identifying information (e.g. email for verification), contact us and we'll help where we're able to.

7. Security

Data is protected with role-based access control at the database level (row-level security), so users can only reach data their role permits. API keys and webhook secrets are stored hashed, never in plaintext. No raw payment card data ever reaches our servers. No security measure is perfect, and we can't guarantee absolute security.

8. Children's privacy

Freely is a business tool and isn't directed at children. We don't knowingly collect personal data from children under 13 (or the relevant minimum age in your jurisdiction) through the account-holder side of the Service. [Age threshold / COPPA-style language — TBD, pending legal review, and depends on whether any survey use case is expected to reach a general/consumer audience.]

9. Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal data, or to object to certain processing. Account holders can access and update most of their own data directly in account settings; for anything else, or if you're a respondent, contact us at support@freely.biz. [Jurisdiction-specific rights language (GDPR/CCPA/etc.) — TBD, pending legal review.]

10. Changes to this policy

We may update this policy as the Service evolves. We'll update the "Last updated" date above; material changes will be communicated to account holders.

11. Contact

Questions about this policy: support@freely.biz.