Accounts and saved progress
Supabase handles sign-in by Google, GitHub or email. We store your account identifier, email, display name, timestamps and provider-checklist progress to identify ownership and sync the features you request. Sign-in sessions use browser storage. You can browse public content without signing in.
API keys and prompts
When you run direct tools, your browser sends the key and prompt to the provider you select, under that provider’s policies. FreeToken does not proxy these tool requests. Do not place secrets in URLs, record labels or support messages.
New Vault saves (v1) are encrypted in your browser with your passphrase. We store ciphertext, salt, IV, encryption version, provider, label and ownership data, not the passphrase. Existing account-encrypted v2 records are different: the server can decrypt them after an explicit, authenticated owner action. They are not zero-knowledge records. See the security page for details.
Availability emails
Watchlist stores your email, selected providers/models, notification preferences, time zone, subscription status, confirmation-token hash and delivery history. Resend processes addresses and notification content for delivery. Anonymous subscriptions require email confirmation. Unsubscribing stops alerts and removes follows; it does not erase your subscriber record or delivery history.
Analytics and browser storage
Google Analytics loads only after you allow analytics. It measures public pages, excluding account screens, key-entry tools and subscriber-management routes. It receives page titles, URLs with only standard UTM campaign tags and referrer origins. We do not intentionally send keys, prompts or account email. GA may set analytics cookies; your choice is saved in browser local storage. You can decline or change your choice using Analytics settings below or in the footer.
Cloudflare delivers and protects the site and also runs Cloudflare Web Analytics through a separate beacon injected by the hosting platform. This measurement is independent of Google Analytics and is not controlled by the GA choice shown here. Cloudflare may process technical request, security and site-usage/performance information under its own terms. See Cloudflare’s privacy notice and Web Analytics documentation for details.
Service providers and processing locations
Cloudflare hosts the site and D1 records; Supabase handles authentication; Resend delivers notifications; Google handles optional analytics. Google or GitHub also handles its own OAuth sign-in, if selected. Your chosen API provider receives direct tool requests. These services may process data outside your country. We do not promise a particular storage region or vendor retention period that has not been verified.
Retention and deletion limitations
There is currently no fixed automatic expiry configured for account, checklist, Vault, subscriber or delivery records. Vault lets you delete individual saved records. Signing out, deleting local browser storage or unsubscribing does not delete all server-side account data. Full account erasure is not available as a self-service button. Provider logs and backups have separate lifecycles; removing an active record does not guarantee immediate removal from backups.
Privacy requests and contact
Contact the individual operator at the email shown on this page for access, correction, deletion or other privacy questions. For account-related requests, write from your registered email where possible; ownership may need verification. Do not email API keys, Vault passphrases or sign-in tokens. Requests require manual review; this page does not promise an automated deletion workflow or a response deadline that has not been established.
Advertising and changes
Current promotional cards link to our own 2nothing project and use campaign tags. No third-party advertising network is enabled in this release, and GA consent is not advertising consent. Before enabling advertising cookies or tracking, we must update vendor disclosures and implement the applicable consent controls. Material changes will be reflected in this policy and its update date.