Overview
This privacy policy explains how Freewave.dev, a service operated by Carrot & Flower LLC, doing business as Freewave.Online ("Freewave," "we," "us"), collects, uses, and protects your personal information when you use our website and services. We keep things straightforward — no legalese walls.
Information We Collect
We collect the following information when you sign up or contact us:
- Name and email address — to create your account and communicate with you
- Phone number — if you provide one, for optional contact
- Website and project details — to understand your needs and deliver the service
- IP address and browser information — for security and fraud prevention
- Payment information — processed securely by Stripe (we never see or store your card details)
How We Use Your Information
We use your information to:
- Provide the service — build, manage, and maintain your website
- Communicate with you — account updates, login codes, service notifications, and occasional follow-up emails if you've expressed interest in our services. You can unsubscribe from promotional emails at any time using the link in those emails.
- Process payments — manage your subscription through Stripe
- Improve our service — understand how customers use Freewave so we can make it better
- Prevent fraud and abuse — protect our platform and your account
Third-Party Services
We use a small number of trusted third-party services to operate Freewave:
- Stripe — payment processing. Stripe handles all payment data under their own privacy policy.
- Cloudflare Turnstile — spam prevention on forms. Cloudflare may collect limited data as described in their privacy policy.
- Resend — email delivery. Login codes, account notifications, and form submissions are sent through Resend under their privacy policy.
- Postmark — newsletter delivery. If you use the Newsletter app, your subscribers' email addresses and delivery events are processed by Postmark under their privacy policy.
- Telnyx — text message delivery. If you use the SMS app, recipient phone numbers and delivery events are processed by Telnyx under their privacy policy.
- Cloudflare — DNS management, CDN, and hosting for customer websites (Cloudflare Pages). Cloudflare may process traffic data as described in their privacy policy.
- Backblaze B2 — encrypted offsite backups of website files and account data, stored under their privacy policy.
Your website's source files are stored in private git repositories on our own servers — not with a third-party code host — with encrypted offsite backups on Backblaze B2. The Freewave platform itself also runs on our own server infrastructure. We also use Telegram to deliver operational alerts to our own team (for example, that a change request needs attention).
We do not sell, rent, or share your personal information with anyone else.
Cookies
We use minimal cookies, strictly for functionality:
- Session cookies — to keep you logged in to your portal account. These expire after 24 hours of inactivity.
- Device trust cookies — if you choose to trust a device during login, a secure token is stored to streamline future logins.
We do not use tracking cookies, analytics cookies, or any third-party advertising cookies.
Website Visitor Statistics
Websites we host include a lightweight first-party counter so the site's owner can see how it is performing in their portal (the Site Stats app). When someone visits a page, we record the page address, the referring site, and an approximate location (country, region, and city) derived from the network connection — and we add 1 to a daily total.
This is deliberately not per-visitor tracking. It sets no cookie, stores nothing on the visitor's device, does not use fingerprinting, does not record IP addresses, and cannot follow a visitor between sites or between visits. Only day-level totals are kept, so no individual visitor can be identified from them. Site owners see these totals for their own site only.
Data Retention
We retain your account information for as long as your subscription is active. After your subscription is cancelled, we retain your website files and account data for 90 days in case you decide to return. We'll send you reminder emails at 30 days, 7 days, and 1 day before deletion. At 90 days your account is closed, your site is taken offline, and your account records are deleted from our systems.
Backups. For a further 180 days after that, an encrypted offsite copy of your website's source files and media is kept in our private backup storage, so an account closed in error can still be recovered. That copy is not used for any other purpose, and it is permanently and automatically deleted at the end of the 180 days. If you would rather it be destroyed immediately, contact us and we'll remove it.
If your account is suspended due to non-payment, your data is retained until the suspension is resolved — either by paying the outstanding invoice (which restores your account) or by cancellation (which starts the 90-day retention period).
Contact form submissions are retained for business record-keeping purposes.
If you'd like your data deleted sooner, contact us and we'll remove it within 30 days, subject to any legal obligations we may have to retain certain records.
Data Security
We take reasonable measures to protect your information, including:
- Encrypted connections (HTTPS) for all data in transit
- Secure, httponly cookies with SameSite protections
- Rate limiting on login attempts
- Secrets and credentials stored outside the public web directory
No system is 100% secure, but we take the security of your data seriously and follow industry best practices.
Data Breach Notification
If we discover unauthorized access to your personal data, we will notify you within 30 days of becoming aware of the breach and take immediate steps to remediate the issue. We will also notify relevant authorities as required by applicable law.
Your Rights
You have the right to:
- Access your data — request a copy of the personal information we hold about you
- Correct your data — update inaccurate or incomplete information
- Delete your data — request removal of your personal information
- Export your data — receive your data in a portable format
To exercise any of these rights, email us at [email protected].
Children's Privacy
Freewave is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children.
Changes to This Policy
If You Sell Through Your Site
Customers who install the Payments app connect their own Stripe or Square account and take orders on their own website. When an order is placed, we store a record of it — the item, the amount, and the buyer's name and email address — so the shop owner can see it in their portal.
That information belongs to the shop owner and their buyer. We hold it on the shop owner's behalf, we never use it to market anything, and it is deleted along with the rest of their data when their account is deleted. Card details are never involved: those go straight to Stripe or Square and we never see them.
We may update this privacy policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. Continued use of the service after changes are posted constitutes acceptance of the revised policy.
Questions?
If you have any questions about this privacy policy or how we handle your data, reach out at [email protected] or call (321) 222-0889.