What we store
We store your name, email address and a password hash, along with your projects, client email addresses, updates, attachments and replies. Project records can include encrypted project PINs, the latest dates a PIN was turned on or off, and records used to limit PIN guesses. We also store email delivery records and subscription details. Payment providers handle card details; the app does not store them.
If you tell us how you heard about Friday, or your signup link includes a source label, we store that with your account to understand how people find Friday. We carry source labels in links between public pages, without adding cookies or browser storage for attribution.
Why we use it
We use this information to provide your workspace, share project pages, send notifications and password resets, prevent abuse and handle billing. Signed session cookies keep owners logged in and protect forms. After a correct project PIN, a separate signed cookie records access for that browser and project for seven days. Browser local storage remembers a reply name preference for each project and browser. It is not an identity check or a tracking identifier.
For PIN guesses, we store times and keyed digests of IP addresses rather than the IP address itself. Entries older than 24 hours can remain in this operational record until a later attempt prunes them, or until the PIN is reset or the project is deleted.
We use Cloudflare Web Analytics, which does not use cookies, to count page visits on public pages.
Newsletter sign-ups are handled by Kit (kit.com) and used only to send the weekly tip, and every email has an unsubscribe link.
Who can see it
Each account can access its own workspace. Each project has a random private link. You can turn on a Friday-generated 4-digit PIN for any project. Without a PIN, a person with the link can read, download files and reply. With a PIN, they also need that PIN. Links and PINs are not identity checks. Each update email goes to the project's one client email address, and reply emails go to the freelancer.
Update emails contain the update text and the private link. A project PIN protects the client page, but it does not encrypt email or stop a recipient from forwarding the email.
Cloudflare hosts the app, database and attachments. Resend processes outgoing email. Dodo Payments processes billing. Those providers may process data in other countries under their own terms and privacy policies.
Retention and your choices
Project content and email records remain stored for the service until removed. The latest password-reset email replaces the previous reset email. Reset links expire after one hour, and a password reset ends existing account sessions.
Contact us to request access to, correction of or deletion of your information. Payment providers may need to retain records required by law. You can replace a project link, select New PIN, or select Turn off PIN and turn it on again to end access granted through the old details. Clearing browser storage removes that browser's saved project access and reply name preference.
Changes
We will notify account holders of material changes to this policy.
Contact
For questions or requests, email support@fridayclient.com.