Privacy Policy

1. Who we are

FRPB (“we”, “us” or “our”) is a remote-first, globally distributed service that operates the FRPB desktop application and the frpb.in website (Worldwide). We provide a device recovery and utility tool for Android and iOS devices. Our tools are intended for authorised device owners and technical professionals only.

For the purposes of the EU/UK General Data Protection Regulation (GDPR) we are the data controller; under the California Consumer Privacy Act (CCPA/CPRA) we are a business; and for users elsewhere — including the Middle East, Australia and Canada — we act as the responsible controller for the data described in this policy. Our website is https://frpb.in.

2. What data we collect

We collect only the data necessary to operate our service:

• Account data — your email address and a hashed account identifier created when you sign up. Authentication is handled by our auth provider (Supabase); we do not store raw passwords. We also record your account creation time and last login.
• Network / security metrics — a hashed (irreversibly one-way) form of your IP address and user-agent string, retained purely for fraud prevention, rate-limiting and abuse detection. Raw IP addresses are not stored, and the hash cannot be used to re-identify you on its own.
• Hardware identifiers — a device fingerprint / hardware identifier derived from the device you activate, used to bind your licence to a specific device and enforce the per-plan device limits. These identifiers are stored only as long as needed to operate the licence binding.
• Payment data — when you purchase a plan we record the payment transaction ID, order ID, the plan purchased, the currency and the amount paid, plus a hashed payment signature used to verify the transaction. We do not store full card numbers, CVV or bank credentials. Payments are processed by Razorpay, which alone receives your card or other payment details.
• License data — the license key issued to you, the plan it belongs to, its status (active/expired/revoked), device binding information, and activation logs.
• Technical logs & analytics — error logs, debug information and privacy-preserving product analytics (PostHog) that help us improve the app and diagnose problems. We configure analytics to avoid capturing device content. We do not collect the content of your device — your photos, messages, contacts or files.
• Support data — if you contact us, we keep your email, the issue you reported and our replies so we can follow up.

3. Legal bases for processing (GDPR)

Where the GDPR applies, we process your personal data on the following legal bases:

• Contract — to create your account, deliver your licence, process payment and provide support (Article 6(1)(b)).
• Legitimate interests — to secure the service, prevent fraud and abuse, and keep basic product analytics (Article 6(1)(f)).
• Legal obligation — to keep tax, accounting and transaction records (Article 6(1)(c)).
• Consent — for any optional communication you opt into, which you may withdraw at any time (Article 6(1)(a)).

4. How we use your data

We use your data only for the following purposes:

• Operating and improving the FRPB application — licence verification, device binding, feature access, usage analytics.
• Processing your payments and managing subscriptions.
• Communicating with you about your account, licence or support request.
• Complying with legal obligations and preventing fraud or abuse.

We do not sell your personal data, and we do not “share” it for cross-context behavioural advertising as those terms are defined under the CCPA. We do not use your data for unrelated marketing purposes without your explicit consent.

5. Third-party processors and how we share data

We disclose your data only to the following categories of recipients, each acting under a data-processing agreement that restricts them to processing your data solely on our instructions:

• Payments — Razorpay: processes card and other online payments, receives your payment instrument details, and handles refunds. We receive only the transaction result, order ID and payment signature.
• Email delivery — Resend: dispatches transactional emails such as your license key and purchase receipt to your account email address.
• Analytics — PostHog: collects privacy-preserving product usage analytics to help us understand how the app is used. It is not used to build advertising profiles.
• Authentication — Supabase: manages sign-in, sessions and account records under our control.
• Legal authorities: where required by law, a court order, or to protect the safety of our users or the public.

We do not permit our processors to use your personal data for their own independent purposes.

6. Data retention

We keep personal data only as long as necessary for the purposes above:

• Account data — retained while your account is active and deleted (or anonymised) within a reasonable period after you request closure.
• Transaction & payment records — retained for the period required by applicable tax, accounting and consumer-protection law (typically up to eight (8) years), even after account deletion.
• Licence & activation logs — retained for the life of the licence plus a short dispute-resolution window, then deleted or anonymised.
• Security metrics (hashed IP / user-agent) — retained for a short rolling window sufficient for fraud and abuse detection, then purged.
• Support correspondence — retained for a reasonable period so we can resolve and reference past issues.

7. International and cross-border data transfers

We are a remote-first, globally distributed service, and some of our processors (including Razorpay, Resend, PostHog and Supabase) may store or process data on servers located outside your country, including in the United States and the European Union.

Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), together with supplementary technical and organisational measures. We apply equivalent, jurisdiction-neutral safeguards to transfers from other regions. You may contact us for more information about the safeguards we use.

8. Your privacy rights

Depending on where you live, you have the following rights. We do not discriminate against you for exercising them.

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data, subject to legal retention obligations.
• Portability — receive your data in a structured, machine-readable (portable) format.
• Restriction / objection — restrict or object to certain processing based on legitimate interests.
• Opt out — opt out of non-essential communications at any time.
• Complaint — lodge a complaint with your local data protection authority.

You may also nominate another individual to exercise these rights on your behalf where local law permits. We process your data only for the lawful purposes stated above.

To exercise any of these rights, email legal@frpb.in with “Privacy Request” in the subject line. We will respond within the timeframe required by applicable law (generally within thirty (30) days for GDPR and forty-five (45) days for CCPA requests). We may need to verify your identity before acting on a request.

9. How we protect your data

We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS), hashing of network identifiers, access controls, and the principle of least privilege for internal access. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

10. Children’s privacy

The FRPB service is not directed to children under the age of 18 (or the minimum age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

11. Cookies

Our website and application use cookies and similar technologies for authentication, session management and privacy-preserving analytics. You can set your browser to refuse cookies, but some parts of the service may not work properly without them. We do not use third-party advertising cookies.

12. Contact us & data protection requests

Any questions about this Privacy Policy or our data practices, or to submit a data access, correction or deletion request, contact us at:

Use the subject line “Data Access Request” for a copy of your data, or “Data Deletion Request” to request erasure of your account data. We acknowledge requests within a reasonable time and complete them subject to any legal retention obligations described in section 6.

13. Changes to this policy

We may update this policy from time to time. If we make a material change, we will notify you by email or a prominent notice on the website. The “Last updated” date at the top will reflect the latest revision.