Privacy Policy

1. Who we are

FreakUI is provided by The Freak Company LLC, identification number 404803637, registered at Georgia, Tbilisi, Krtsanisi District, Nino and Ilia Nakashidze Street, No. 1, Flat No. 3, Building No. 3. In this policy, “FreakUI,” “we,” and “us” refer to The Freak Company LLC.

Questions and privacy requests can be sent to hello@thefreakcompany.com.

2. What this policy covers

This policy covers the FreakUI website, account and billing pages, support, the authenticated FreakUI MCP service, and the app-generation workflow used through supported coding agents. The open-source FreakUI Swift package is distributed separately under its MIT license.

3. Information we process

Account and authentication

WorkOS handles sign-in and provides the account identity needed to operate the service, including a stable WorkOS user identifier and account details such as your email address. FreakUI keys generation access to the WorkOS identifier. We do not receive your WorkOS password.

Subscription and entitlement

Paddle is the merchant of record and processes checkout, payment, tax, invoices, cancellation, refunds, and payment disputes. FreakUI stores only the Paddle customer and subscription identifiers, subscription status, access state, access source, and current paid period end needed to provide and enforce generation access. We do not store complete card or bank-account details.

Generation requests

The generation service temporarily processes the confirmed structured app brief needed to create a project blueprint. This can include the app name, bundle identifier, selected Apple platforms, product description, screens, visual direction, theme choices, font names, and third-party notices. The request body and generated project are not retained after processing.

For retry safety and support, FreakUI stores limited generation metadata such as the WorkOS user identifier, request identifier, contract and request hashes, result hash, processing state, retry count, timestamps, safe error code, recipe version, FreakUI version, and generated file count. Hashes are used for integrity and correlation and do not contain the original project source.

Operational and support information

Service logs may contain provider event identifiers, request identifiers, hashes, release versions, safe outcomes, subscription status, and error codes. They are deliberately restricted from containing account identifiers, email addresses, access tokens, credentials, full prompts, webhook bodies, repositories, generated source, fonts, or raw error messages.

If you contact support, we process the message and diagnostic details you choose to provide. Do not send credentials, tokens, certificates, repositories, source code, complete prompts, or font files.

Website and device information

Our hosting and security providers may process ordinary request data such as IP address, browser and device information, requested URL, timestamps, and security signals. FreakUI stores your light, dark, or system theme choice in local browser storage. Essential WorkOS session cookies keep you signed in. We do not currently use advertising cookies or third-party product analytics on freakui.com.

4. What stays on your device

The FreakUI service does not receive your destination path, repository, wider workspace, original conversation history, local font paths or font bytes, generated source, local build output, signing credentials, access tokens, or certificates. Materialization, optional example-content edits, package resolution, and Xcode builds happen locally through your coding agent.

Codex and Claude Code may separately process your conversation and workspace according to the platform and account settings you use. Their processing is governed by their own terms and privacy notices, not this policy.

5. Why we process information

• Authenticate your account and protect access.
• Confirm subscription status and provide paid generation.
• Create the project blueprint you request.
• Prevent duplicate operations, abuse, fraud, and data corruption.
• Diagnose failures and provide customer support.
• Meet accounting, tax, security, and other legal obligations.

Depending on your location, we rely on performance of our contract, legitimate interests in operating and securing FreakUI, compliance with legal obligations, and consent where the law requires it.

6. Service providers and disclosures

We use a limited set of providers to operate FreakUI:

• WorkOS for account authentication and OAuth.
• Paddle as merchant of record for checkout, billing, tax, and refunds.
• Neon for the restricted entitlement and retry database.
• Vercel for website and service hosting.

We may also disclose information when required by law, to protect users or the service, or as part of a corporate transaction subject to appropriate safeguards. We do not sell personal information.

7. International processing and retention

Our providers may process information in countries other than your own. Where required, transfers are protected through contractual or other lawful safeguards provided by those services.

We retain account, entitlement, transaction-reference, retry, and support information only for as long as needed to provide the service, protect its integrity, resolve disputes, and meet legal, accounting, and security obligations. The generation request body and generated project are not stored by FreakUI.

8. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, or receive a copy of personal information, or object to certain processing. You may also withdraw consent where processing relies on consent. Contact us to make a request. We may need to verify your identity and may retain information where the law requires it.

Billing and payment requests may need to be handled directly by Paddle through paddle.net. You can manage or cancel an active subscription through the FreakUI account page and Paddle customer portal.

9. Security and changes

We use data minimization, provider authentication, signed webhooks, restricted database permissions, integrity hashes, and server-only secrets to protect the service. No system is completely secure, and we cannot guarantee absolute security.

We may update this policy when the service, providers, or legal requirements change. The current version and effective date will remain available on this page.