Privacy Policy
Last updated: November 1, 2026
SourceFrame (“SourceFrame”, “we”, “our”, or “us”) values your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have when using our website, web app, Chrome extension, and related services.
1. Scope
This Privacy Policy applies to SourceFrame’s website, web app, browser extension, and related services that link to or reference this policy.
2. Information We Collect
We may collect the following types of information:
A. Account Information
If you create an account, we may collect information such as your name, email address, profile image, and authentication-related identifiers. If you buy a paid plan, we also keep the status of your subscription (for example, your plan and billing period). Our payment provider handles your payment details; we do not receive your card number.
B. Usage Information
We may collect information about how you use SourceFrame, including feature usage, interactions with briefs, Research, and drafts, pages viewed, device/browser information, approximate timestamps, and diagnostic or performance data. This can include the website a source came from (for example, “example.com”), but not the text of your sources, their titles or full web addresses, your prompts, or what SourceFrame generates for you.
C. Content You Provide
We process the content you choose to use with SourceFrame, such as selected browser tabs, page content, web addresses you add, source materials, prompts and research requests, questions, optional brief focus text, generated briefs, drafts, and related workspace data.
Research and saved sources. If you use Research, you can save web pages into a Research to use later: from the SourceFrame extension, or in the web app by choosing pages from your browser or by entering a page’s web address. When you save a page, we store its text in your account, together with details about it: its title, web address and website, when it was saved, how it was added, any publication date the page states, and whether it was saved in full or only in part. We store this even if you never create a brief from it. When you add a page by its web address, our web-retrieval provider fetches the page for us (see Section 11). AI-chat conversations cannot currently be saved into a Research: if you include an AI-chat tab when saving, it is refused and not saved.
AI-chat conversations. SourceFrame can also process supported AI-chat conversations, including conversations on ChatGPT and Claude, as sources for a brief. On supported AI-chat pages, SourceFrame may show a small “Create brief” action beside AI responses. AI-chat content is sent to SourceFrame only when you choose to use a conversation as a source:
when you click “Create brief” on the page and confirm a capture scope: the current exchange (the default) or the entire visible conversation; or
when you select an AI-chat tab as a source in the SourceFrame extension’s side panel, for example to create a brief or add sources to a brief. There is no separate scope step there: SourceFrame uses the visible conversation, meaning the messages currently loaded on the page, up to a size limit. The side panel shows “Visible chat” next to the tab.
When you create a brief from an AI-chat conversation, SourceFrame processes the selected chat content, source metadata, optional brief focus text, and generated output to provide the brief you requested. AI-chat conversations are labeled as AI-generated context in the product so they are not treated as independent verification of any claim.
D. Communications
If you contact us directly or through our contact form, we receive and keep your message, your name and email address, and any information you include.
3. How We Use Information
We may use information we collect to:
provide, operate, maintain, and improve SourceFrame
authenticate users and secure accounts
store the sources you save and read them with AI when you ask, or when “Read after saving” is on
generate briefs, drafts, and related outputs
process payments and manage subscriptions
personalize product experience and improve usability
monitor performance, diagnose issues, and prevent abuse
communicate with you about product updates, support, billing, or important service notices
comply with legal obligations and enforce our terms
4. How SourceFrame Processes Content
SourceFrame is designed to help users collect sources and turn them into structured, source-backed briefs and drafts.
To provide this functionality, we process content from the tabs, pages, sources, prompts, AI-chat conversations, and workspace inputs you explicitly choose to use with the product. For supported AI-chat pages, SourceFrame runs a content script to detect when a supported conversation is available and display a “Create brief” action. SourceFrame does not send AI-chat content to our servers merely because this action is displayed.
When content is sent to SourceFrame. Content from a browser tab or web page is sent to our servers when you choose to use it: when you create a brief from it, add it to a brief, or save it into a Research. AI-chat content is sent as described in Section 2C. When you ask SourceFrame to research a question for you, it searches the web and fetches pages on your behalf through our service providers (Section 11).
AI processing. Content you use or save may be sent to our AI model provider not only when a brief is generated, but also to read sources saved in a Research, to refine a brief or answer questions about it, to run AI actions in a draft, and to check requests for misuse.
Reading saved sources. A source saved into a Research can be “read”: SourceFrame sends up to about 16,000 characters of its saved text to our AI model provider to produce a structured reading of the source, and stores that reading with the source in your account so it can be used when you create a brief. When you save sources, “Read after saving” is on by default, in the web app and in the extension. SourceFrame then reads some of the newly saved sources (up to 3 per save on the Free plan and up to 8 on Pro) while the page or side panel stays open. You can turn “Read after saving” off before each save; your sources are still saved, and you can choose to read them later.
We do not claim ownership over your content. We process it only as needed to provide, secure, maintain, and improve the service, comply with law, and protect the platform.
Limited Use Disclosure
SourceFrame uses user data only to provide, secure, maintain, and improve SourceFrame’s source-backed research, brief, and draft functionality. We do not sell personal information, source content, AI-chat content, prompts, or generated outputs. We do not use user content for unrelated advertising purposes.
5. Legal Bases (if applicable)
Depending on your location, we may rely on one or more of the following legal bases to process personal information:
performance of a contract
legitimate interests
consent
compliance with legal obligations
6. Sharing of Information
We may share information in the following circumstances:
with the service providers listed in Section 11, and other infrastructure partners that help us operate the service
when you choose to share a brief through a public link (see below)
when required by law, legal process, or government request
to protect rights, safety, security, and integrity of SourceFrame, our users, or others
in connection with a merger, acquisition, financing, or sale of assets
Public links. If you choose to share a brief, we create a public link that anyone who has it can open without signing in. The public page shows the brief’s content and, for each source it shows, the source’s title, web address, website, and the date it was saved. It does not show your name or email address, your research request or brief focus text, or your other briefs. Public pages ask search engines not to index them. You can stop sharing at any time. Moving the brief or its Research to Trash, or deleting your account, also stops the link, and restoring from Trash does not turn it back on. Briefs that use an AI-chat conversation as a source cannot be shared publicly, and a Research itself cannot be shared. We keep technical logs of requests to public links for 7 days.
We do not sell your personal information.
7. Data Retention
We retain information for as long as reasonably necessary to provide the service, comply with legal obligations, resolve disputes, enforce agreements, and support legitimate business operations. In particular, today:
Your content is kept in your account until you delete your account (Section 10). This includes Research, saved sources and their text, source readings, briefs and their history, drafts, and workspaces. Archiving a Research does not delete anything.
When you delete a Research, a brief, a draft, or a workspace, it moves to Trash. Items in Trash are not deleted automatically: you can restore them, and they are kept until you delete your account. There is currently no way in the product to permanently delete a single item.
Moving a Research to Trash does not delete the saved text of its sources or their readings. They stay stored in your account, where they can be used again if you restore the Research, until you delete your account.
A brief keeps the source text it used and the passages it quotes, so that its citations keep working. For research briefs this is the full text extracted from each web source the brief used; for other briefs it is up to about 16,000 characters per source. This text is kept as long as the brief, including while the brief is in Trash.
While a save into a Research is in progress, we hold a temporary copy of the page text. It is deleted when the save finishes or is cancelled. If the save is interrupted by an error, the temporary copy is deleted the next time you start a save into a Research at least 30 minutes later, or when you delete your account.
When you add sources to a brief, or when SourceFrame finds web pages for a brief, the text of those pages is held temporarily for that session. It is deleted when the session ends. If a session is left unfinished, it is deleted the next time you start that kind of session, or when you delete your account.
If you create a brief on our website without an account (a guest brief), the brief and its sources are deleted 7 days after it is created unless you sign in to keep it. Guest attempts that do not finish are deleted after 24 hours.
Our server logs are generally kept for 30 days. They contain identifiers and technical details, not the text of your sources. Logs of requests to public links are kept for 7 days.
Analytics and error reports are kept by our providers (Section 11) under their retention settings.
8. Security
We use reasonable technical and organizational measures to protect information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Your Choices and Rights
Depending on your location, you may have rights to access, correct, delete, or export certain personal information, or to object to or restrict certain processing.
You may also have choices regarding marketing communications, cookies or similar technologies, and certain account settings.
In the product, you can:
turn “Read after saving” off before you save sources into a Research, so that no source is read automatically;
stop sharing a brief’s public link at any time;
delete your account and its content yourself (Section 10).
You can disable the injected AI-chat “Create brief” action from SourceFrame Preferences. When disabled, SourceFrame will not show the injected “Create brief” button on supported AI-chat pages. You can still use SourceFrame’s other capture and brief-generation features from the extension side panel.
To make a privacy-related request, contact us at hello@sourceframe.app.
10. Account and Data Deletion
You can delete your account yourself in the SourceFrame web app, under Settings. You may be asked to sign in again first. If you have a paid subscription that can still renew, you need to cancel it first; you can delete your account right after cancelling.
When you confirm, we stop your public links and delete your account and sign-in, together with the content stored in your account: Research, saved sources and their text, source readings, briefs and their history (including the source text they keep), drafts, workspaces, settings, usage and credit records, and any temporary copies described in Section 7. A final clean-up runs about 15 minutes later to remove anything that was still being written when you confirmed.
Deleting your account does not remove:
analytics and error-monitoring records held by PostHog and Sentry, which are kept under their retention settings;
our server logs, until they expire (Section 7);
records of your subscription and payments: Paddle keeps these as our Merchant of Record, and we keep records that link your Paddle subscription and checkouts to your former account identifier;
information our other service providers keep under their own terms;
a minimal record that the account was deleted (its identifier and the dates of the deletion, with no name, email address, or content), which is kept for about 30 days.
You may also request deletion of your SourceFrame account and associated data by emailing support@sourceframe.app from the email address associated with your account. We will process deletion requests within 14 days, unless we are required to retain certain information for legal, security, fraud-prevention, or accounting purposes.
11. Third-Party Services
SourceFrame uses a limited number of third-party service providers to operate the product, secure accounts, take payments, analyze performance, and provide AI-powered features. These providers may process information only as needed to provide their services to us and in accordance with their own privacy policies and applicable contractual obligations.
Our current service providers include:
Google Cloud and Firebase — used to host SourceFrame’s servers and database, for sign-in and account management (including Google sign-in), and for server logs. They store and process all of the account and product data described in this policy.
OpenAI — our AI model provider. It receives the content needed for each AI feature: the text of sources you use or save (including AI-chat conversations you select), your prompts, research requests and brief focus text, questions you ask, draft text when you use AI actions, and briefs being refined. It is used to read saved sources, to generate, refine and answer questions about briefs, and to check requests for misuse. For some research requests, SourceFrame also uses OpenAI’s web search, which receives the request. We do not send OpenAI your name, email address, or account identifier.
Firecrawl — our web search and page-retrieval provider. When SourceFrame finds web pages for a research request, Firecrawl receives search terms based on your request and the web addresses of the pages to fetch. When you add a page to a Research by its web address, Firecrawl receives that address and fetches the page for us. We do not send Firecrawl your name, email address, or account identifier.
Paddle — our reseller and Merchant of Record for paid plans. If you buy a paid plan, Paddle processes your payment, taxes, invoices, and refunds. Paddle receives the details you enter at checkout (we pre-fill your email address) and a SourceFrame account identifier so that we can link the subscription to your account. Paddle’s checkout is loaded on our web app only when you open it.
Resend — used to deliver messages you send through our contact form (your name, email address, topic, and message) to our support inbox.
PostHog — used for product analytics, feature usage measurement, and service improvement, on our website (including for visitors who are not signed in), web app, and extension. It receives the usage information described in Section 2B, linked to your account identifier when you are signed in, and keeps an identifier in your browser’s local storage. We do not use PostHog’s automatic click capture or session recording.
Sentry — used for error monitoring, diagnostics, and reliability improvement. Error reports contain technical details such as the error, the affected page or request path, and your browser and device type. We do not attach your name or email address to them.
Cloudflare (Turnstile) — used to protect guest briefs (creating a brief on our website without an account) and our contact form from automated abuse. When you create a guest brief or send a message through the contact form, Cloudflare receives technical request and browser information, such as your IP address, browser and device signals, and the website the request comes from, to check that the request is made by a person. SourceFrame sends Cloudflare only a fixed label for the action (“guest_brief” or “contact”); it never sends your research prompt, your sources, your brief, or your message. Cloudflare’s handling of this information is described in its Turnstile Privacy Addendum (cloudflare.com/turnstile-privacy-policy).
SourceFrame’s fonts are served from our own website and extension; we do not load fonts from a third-party font service.
SourceFrame may also use service providers for hosting, security, customer support, and other operational needs as the product evolves. We do not sell personal information, and we do not authorize our service providers to use customer data for their own independent marketing purposes.
12. International Data Transfers
SourceFrame’s application servers run on Google Cloud in the United States, and several of the providers listed in Section 11 process information in the United States or other countries. Your information may therefore be processed in countries other than your own. Where required, we take appropriate steps intended to safeguard personal information involved in such transfers.
13. Children’s Privacy
SourceFrame is not intended for children under 13, and we do not knowingly collect personal information from children under 13.
14. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we may update the date above and take additional steps as appropriate under the circumstances.