Privacy Policy

Last updated: November 9, 2026

This Privacy Policy explains what information RHXO, Inc. ("Frame," "we," "us") collects when you use frameterminal.com, the Frame web application (Frame Deck and Frame Terminal), the Frame Android app, Frame devices and Frame AI (together, the "Services"), how we use and share it, and the choices you have. It is part of our Terms of Service. We do not sell your personal information.

1. Information You Give Us

Account: your name, email address, password (stored only as a one-way hash, never in readable form) and, if you add one, a profile picture.
Billing: when you start a trial, subscribe or buy a device, payment is handled by Stripe. Your card details go directly to Stripe and are never stored on our servers. We keep your Stripe customer ID, plan, subscription and trial status, renewal dates and a record that you have used a free trial. For device orders we also receive the shipping details you provide.
Portfolio, settings and functions: your holdings, watchlists, layouts and workspaces, saved custom functions and scripts, and preferences. When you are signed in, these sync to your account so they appear on all your devices. They are encrypted in your browser with a key derived from your password before they are sent to us, so we store them in encrypted form.
Alerts: if you create price or script alerts that run on our servers, we store the alert definitions and the email address we notify.
Shared links: when you share one of your workspaces or functions, we store a copy of what you chose to share, unencrypted, so anyone with the link can view it.
Your own AI keys: if you add an API key from an AI provider, it is kept in your browser and in your encrypted account settings, and is sent to our server only to make the request you asked for. We do not log it.
Broker connections: credentials or tokens you provide to connect a brokerage or financial account pass through our server only for the request that reads your holdings; they are kept inside your encrypted portfolio, not in readable form on our servers. Connections are read-only.
Messages: feedback you send through the Services and emails you send us, including your name, email and message.

2. Frame AI and Voice

Chat and AI features: your questions, and the on-screen context needed to answer them (for example the ticker, workspace or data you are viewing), are sent to third-party AI model providers to generate a response. Files or images you attach are sent for that one answer and are not stored by us. For AI requests we keep technical records (time, feature used, duration, size and errors), not the content of your messages.
Voice assistant: when you turn on the voice assistant, your microphone audio is streamed in real time to our AI provider to understand and answer you. Frame does not record or store your audio. The microphone is used only while the assistant is on. For each voice call we keep a call log (the text transcription of your questions, the actions the assistant took, timings and cost) for up to 90 days, to improve quality, to meter free-trial usage and to investigate problems.
Our AI providers process this information under their terms for business customers and are not permitted by those terms to use it to train their models. If you use your own API key, that provider's own terms apply.

3. Information Collected Automatically

Server logs: like most websites, our servers log requests, including IP address, browser user agent, the page or data requested, time and response time. We keep these logs for up to 14 days for security, abuse prevention and troubleshooting.
Guest preview: to limit the free Terminal preview for visitors without an account, we count clicks per IP address using a one-way hash of the address (never the address itself), kept for 30 days.
Approximate location: to show local weather when you have not chosen a city, we look up an approximate city from your IP address using a database hosted on our own servers; the address is not sent to a third party for this.
Device diagnostics: Frame devices and the Frame app may send technical diagnostics (for example page load errors, app version and device model) so we can detect and fix problems. These do not include your portfolio or personal content and are kept for up to 90 days.
Analytics: we use Google Analytics and Google Tag Manager to understand how the Services are used (pages viewed, approximate location, device and browser type). Google sets cookies for this purpose; see Section 7.
Browser storage: the Services store your preferences, sign-in token and cached data in your browser's local storage so they work quickly and remember your choices.

4. How We Use Information

to provide, maintain and sync the Services and your account across devices;
to process trials, subscriptions, renewals, refunds and device orders, and to prevent repeat or fraudulent trials;
to send service emails such as account, security, trial reminder, billing and alert emails (you cannot opt out of essential service emails while you have an account);
to send product news and offers, if you have agreed to receive them; you can unsubscribe at any time;
to answer your requests and provide support;
to keep the Services secure, enforce limits and our Terms, and prevent abuse;
to understand usage and improve the Services;
to comply with law.

Where the GDPR or similar laws apply, we rely on performance of our contract with you (providing the Services), our legitimate interests (security, improvement, analytics, fraud prevention), your consent (marketing emails, analytics cookies where required) and legal obligations.

5. How We Share Information

We share information only with service providers that help us run the Services, under contracts that limit their use of it to providing services to us, and as described here:

Payments: Stripe (payments, subscriptions, invoices).
Hosting and network: our server hosting provider and Cloudflare (content delivery, security and DNS).
Email delivery: providers that send our service and alert emails.
AI: AI model providers that process Frame AI and voice requests as described in Section 2.
Analytics: Google (Google Analytics, Google Tag Manager).
Market data: when you look up a symbol, our servers request data from market data providers; these requests do not include your name or email.
Brokers and aggregators: only when you connect an account, to read your holdings.
Legal and safety: if required by law, subpoena or court order, or to protect the rights, property or safety of Frame, our users or others.
Business transfers: as part of a merger, acquisition, financing or sale of assets, subject to this policy.

We do not sell personal information and do not share it for cross-context behavioral advertising.

6. Retention

Account, portfolio, settings and functions: while your account exists. When you ask us to delete your account, we delete them within 30 days, except as below.
Billing records: as long as required for tax, accounting and legal purposes (generally up to 7 years).
Shared links: until you or we remove them, or your account is deleted.
Server logs: up to 14 days. Voice call logs and device diagnostics: up to 90 days. Guest preview counts: 30 days.
A record that an email address has used a free trial may be kept to prevent repeat trials.

7. Cookies and Similar Technologies

We use browser storage that is necessary for the Services to work (for example to keep you signed in and remember your settings), and Google Analytics cookies to measure usage. You can block or delete cookies in your browser settings and opt out of Google Analytics with Google's browser add-on at tools.google.com/dlpage/gaoptout. Blocking necessary storage may stop parts of the Services from working.

8. Security

We protect information with encryption in transit (HTTPS), password hashing, encryption of your portfolio and settings with a key derived from your password, access controls and monitoring. No system is completely secure, so we cannot guarantee absolute security. Keep your password private; if you forget it, data encrypted with your old password may not be recoverable from our servers.

9. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, download, or delete your personal information, to object to or restrict certain processing, to withdraw consent, and to not be discriminated against for exercising these rights. California residents have these rights under the CCPA/CPRA, and residents of the EEA, UK and other regions under the GDPR and similar laws. You can update your profile and settings in your account, cancel your subscription in Billing, and stop marketing emails with the unsubscribe link they contain or by emailing us. To exercise any other right, email [email protected] from the address on your account; we may need to verify your identity, and we will respond within the time the law requires. You may also complain to your local data protection authority.

10. International Transfers

Frame is based in the United States, and our servers and providers may be located in the United States, the European Union and other countries. Where we transfer personal information across borders, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

11. Children

The Services are intended for adults 18 and over and are not directed to children. We do not knowingly collect information from children under 18. If you believe a child has given us personal information, contact us and we will delete it.

12. Third-Party Sites and Services

The Services link to and integrate third-party sites and services (for example news sources, brokers, social networks and AI providers). Their privacy practices are governed by their own policies, which we encourage you to read.

13. Changes to This Policy

We may update this Privacy Policy. We will post the new version with a new date and, for material changes, notify you by email or in the Services before they take effect.

14. Contact

RHXO, Inc.
Email: [email protected]
Website: frameterminal.com