Privacy Policy

1. Customers: what we collect and why

• Account details. Your email address, name, password (stored only as a hash), and an avatar if you upload one. Used to sign you in, to send you the email the Service needs to send (verification codes, invitations, password resets, delivery and billing notices), and to show you to your teammates.
• Sign-in records. Which browsers are signed in, when they were last used, and the IP address of requests, kept for security and rate limiting.
• Billing. If you subscribe, Stripe collects your payment details; we never see your card number. We keep the subscription status, invoices and usage counts that the plan is billed on.
• Google sign-in. If you sign in with Google we receive your email address, name and whether Google has verified the address. We store no Google identifier; the address is what links the two.

We use this data to provide the Service, to bill for it, to keep it secure, and to contact you about it. We do not use it for advertising and do not sell it. Emails from us are transactional; there is no marketing list.

2. End users: what passes through Feddy

When someone writes to a customer through the Feddy SDK, the customer receives — and we store on the customer’s behalf — the message and any attachments, an anonymous device identifier, the app and device details the SDK reports (platform, app version, device model, language, time zone, and similar), and whatever the customer chooses to attach: an email address the end user provides, and custom attributes the customer’s code sets, such as a plan name or a user id.

• The customer is the controller of this data and is responsible for telling their users about it. If you are an end user with a question about your data, contact the app or website you wrote to.
• We use end-user data only to deliver the Service to that customer: to show the conversation in their inbox, to deliver replies in the app and by email, and — when the customer has turned it on — to produce an automatic or suggested answer with an AI model.
• We never contact end users on our own behalf, and we do not use their messages to train models.

3. Who else handles the data

We run Feddy on our own servers and use a small number of providers for specific jobs. Each receives only what its job needs:

• Stripe — payments and subscriptions (customers only).
• Resend — sending and receiving email: replies to end users from the customer’s verified domain, and account email to customers.
• Cloudflare — storage for attachments and avatars, and the network in front of the Service.
• PostHog — analytics for this website and the dashboard: pages visited, the link a visit came from, and the account it later belongs to.
• AI model providers — the companies behind models such as GPT and Claude. When a customer enables AI features, the content of the conversation being answered and the answers the customer has written are sent to produce a reply or a suggestion. Nothing is sent for projects that keep these features off.

Our servers are in the European Union; some of the providers above process data in the United States under their own safeguards. We do not share personal data with anyone else, except where the law requires it.

4. How long we keep it

• Conversations and messages stay in the customer’s inbox for as long as the customer keeps the project. Attachments and archived inbound email are deleted after the retention window the customer sets (30, 90 or 365 days after a conversation closes).
• Codes, reset links and other short-lived credentials expire within minutes to hours and are deleted when used.
• When a customer deletes a project or their account, its data is removed from our systems promptly and from backups within 30 days. Sign-ups that are never verified are deleted after 7 days.
• Billing records are kept for as long as tax law requires.

5. Cookies

The dashboard sets one cookie to keep you signed in. The SDK sets no cookies in your app; on the web it keeps an anonymous identifier in the browser’s local storage so that a returning visitor sees their own conversation.

This website and the dashboard use PostHog analytics cookies, to learn which pages and links bring people to Feddy and to connect a visit to the account it later becomes. On this website they are set only after you choose Accept in the cookie notice, and you can change your choice at any time from Cookie settings at the bottom of every page. If you decline, visits are counted without cookies and nothing is stored in your browser. Creating an account includes agreeing to analytics cookies on the dashboard; if you declined them on this website, the dashboard keeps to that choice.

6. Security

Passwords are hashed with argon2id. Data is encrypted in transit. Each customer’s data is isolated in the database by row-level security, and access inside the team is limited by role. Backups are encrypted and kept for 30 days. Tell us at hi@feddy.app if you believe there has been a security problem.

7. Your rights

Customers can see and change their account details in the dashboard, export their data by asking us, and delete their account from the account settings. Depending on where you live you may also have rights to access, correct, restrict or object to the processing of your data, and to complain to a supervisory authority. Write to us and we will help. End users should direct requests to the customer whose app they used; we will assist the customer in answering them.

8. Changes

We may update this policy. If a change matters, we will email account owners before it takes effect. The date at the top says when it last changed. The Terms of Service say how the Service itself works.

Contact

Obtu Studio LLC · hi@feddy.app