FrameFerret privacy policy

Last updated .

This policy covers the FrameFerret app for macOS and the FrameFerret online service. The app imports camera photos and videos into Apple Photos or a folder you choose.

You can install and set up FrameFerret without an account. In released versions, importing needs Sign in with Apple, which starts a free 30-day trial, or a purchase. The app contains no advertising. It sends automatic device check-ins and crash reports, and offers optional support uploads.

Information on your Mac

FrameFerret transfers photos and videos through your local network to your Mac. It does not upload camera media or camera credentials to the FrameFerret service.

The app uses and stores information needed to connect cameras, import files, avoid repeated imports, and show activity. This includes:

  • Camera names, models, IP and MAC addresses, and connection settings.
  • Destination settings and folder locations.
  • File metadata, file identifiers, import history, and transfer results.

FrameFerret stores camera passwords in the macOS Keychain. Imported files can retain metadata such as capture dates and location information.

Logs and reports can contain some of this information, including recent import history. The app uploads them only when you send them to support.

Automatic device check-ins

FrameFerret contacts our service at each launch and daily while it runs. These check-ins occur without an account and while camera syncing is off. The app retries failed check-ins. Opening Settings > Account or signing in can also cause a check-in. So can an import that cannot start until the app confirms a trial or purchase: the window that explains why checks in when it appears and when you press Try Again.

The service records:

  • A device identifier specific to FrameFerret, made from a hash of the Mac’s hardware UUID and the app identifier.
  • The Mac model, macOS version, app identifier, app version, and build number.
  • The locale setting.
  • The approximate location that Cloudflare derives from the connection’s IP address: country, region, city, postal code, latitude and longitude, and time zone. This describes the area the network address belongs to, not the Mac’s precise position. The service keeps the latest location it receives.
  • The first and latest check-in dates and times, and a check-in count.
  • A link to the account last signed in on that Mac, when available.

The raw hardware UUID stays on your Mac. The device identifier normally stays the same after an update or reinstall. If the hardware UUID is unavailable, the app stores a random identifier in the Keychain instead.

Check-ins register the device and return service availability and account status. In released versions, a check-in made while you are signed in also returns your trial, and starts it if your account has none yet. Our service also uses network IP addresses to limit repeated requests. The device record does not include the IP address.

Crash reports

If FrameFerret quits unexpectedly, it sends a crash report to Sentry the next time it opens, including while camera syncing is off. The report describes the crash: the error, the code each thread was running, and the code libraries that were loaded, with their locations on the Mac. A location can include your macOS account name when the app is in your home folder. The report also includes the app version and build, whether the app came from the Mac App Store or our website, when the app started, the Mac model, processor and memory, the macOS version, the locale, and an identifier derived from the Mac and the app.

Reports do not include your account, camera settings, camera credentials, or photos and videos. An error message in a report can mention what the app was working on, such as a file name. Sentry does not record the IP address a report comes from. FrameFerret sends Sentry nothing else: no usage, performance, or session data. Crash reporting has no in-app off switch.

Accounts, trials, and purchases

Sign in with Apple sends our service an Apple identity token and your name, when available. The service verifies the token and stores an account identifier derived from Apple’s identifier. It also stores the verified email address, available name, and purchase status. The account record includes creation and latest sign-in dates.

The app keeps the account details, Apple user identifier, session token, and last verified purchase status in the Mac’s Keychain. The service keeps a hash of the session token, account and device identifiers, and session creation and expiry dates. Using the service can renew a session before it expires.

In released versions, your first Sign in with Apple starts a free 30-day trial. If your account has no trial yet, for example because you first signed in with a prerelease version, the first check-in from a released version while you are signed in starts it. Prerelease versions start no trial. The trial belongs to your account: every Mac you sign in on shares the same dates, whether you got FrameFerret from the Mac App Store or our website.

The service stores a trial identifier and the trial’s start and end dates with your account identifier and the app identifier. It records these dates for accounts with a purchase too, so a refund does not start a new trial. The app does not receive the trial while the purchase is active. The service keeps the dates after you sign out or delete your account, so a trial cannot restart. Trial dates that an earlier version of the service recorded for a Mac also remain. An account whose trial is first recorded on that Mac starts from that earlier date.

The app keeps a signed copy of the trial in the Mac’s Keychain, so the trial works offline. The copy holds the trial identifier and dates, your account and device identifiers, the app identifier, and when the app last checked the trial, so turning the Mac’s clock back does not extend it. Each import checks this copy and does not contact our service.

Signing out removes the account and the trial copy from this Mac and requests deletion of its current session. The service’s device record can remain linked to the last account after sign-out. Signing in again with the same Apple ID brings back the same trial dates.

Prerelease versions also offer Settings > Account > Delete Account. It removes your account and its sessions from the FrameFerret service and this Mac. It also clears the account link from device and support records and clears the email address from purchase records. Purchase records and trial dates remain, and signing in again with the same Apple ID restores them. Account deletion does not delete Stripe’s payment records. In other versions, contact us to delete your account.

When purchase options are available, they require a signed-in account. You enter payment details on Stripe’s website. We send Stripe the account reference and selected purchase information.

We store Stripe customer, checkout, payment, and price references with the account identifier. We also store purchase dates, amounts, currency, status, and the account email address. These records let us verify and restore purchases and track refunds or disputes.

When we review a purchase, we can retrieve further details from Stripe. These include the billing name and email, receipt, discounts, payment status, card brand, and last four card digits.

Logs and support

FrameFerret writes diagnostic messages to the macOS system log. Optional detailed log files are off by default.

Logs can include filenames, folder paths, camera identifiers, network addresses, transfer results, shortened account and trial identifiers, trial end dates, and error messages.

Export Logs saves a ZIP file on your Mac. Settings > Logging > Send to Support uploads a ZIP file after you press Send. It includes the selected period of available log files and a report with:

  • The Mac model, macOS and app versions, build, locale, time zone, and device identifier.
  • Sign-in status and a shortened account identifier, when an account is stored.
  • Whether the version is released, whether imports are allowed, and the trial’s shortened identifier and end date, when the Mac holds one.
  • Logging status, camera syncing status, destination details, and destination access status.
  • Camera names, identifiers, network addresses, sync settings, and available camera status.
  • Up to 30 recent runs, including dates, camera and destination names, results, counts, transferred bytes, duration, and failure messages.

The report can include runs outside the selected log period. It excludes camera usernames, passwords, and host fingerprint values. It states whether you have set these credentials.

The upload also sends your problem description, optional reply email, device details, and archive size. We record submission and receipt times. A submission can link to your account if you are signed in. An account is not required.

If you contact us, we receive your email address, message, and any attachments. We use this information to provide support and investigate problems.

Service providers

  • Cloudflare hosts the FrameFerret service. Its D1 database stores device, account, trial, purchase, and support records. Its private R2 storage holds uploaded diagnostic archives.
  • Apple provides Sign in with Apple and distributes the current app through TestFlight.
  • Stripe processes purchases and provides payment records, receipts, and the billing portal.
  • Sentry receives and stores crash reports.
  • Pushover delivers notifications to the FrameFerret operator about new devices, accounts, purchases, and support uploads. Messages can include device details, the device’s approximate city, region, and country, a name or email address, purchase information, a support description excerpt, and the reply address.

Retention and deletion

The FrameFerret service uses these retention rules:

  • Accounts, devices, and trial dates: These records have no automatic expiry.
  • Diagnostic submissions and archives: Scheduled cleanup normally removes them after 90 days from submission. Incomplete upload records normally expire after two days.
  • Operator notification records: Scheduled cleanup normally removes records older than 30 days, except messages still waiting for delivery.
  • Crash reports: Sentry keeps them for the retention period of our Sentry plan, then deletes them.

Failed cleanup or a backlog can delay removal. Cleanup of leftover upload files uses calendar dates, so removal can occur later. These schedules do not delete support email, exported copies, or messages already delivered through Pushover. Contact us to request deletion of support information.

On your Mac

  • Settings and import history: These remain on your Mac until you remove the stored app data.
  • Camera passwords: Removing a camera in FrameFerret Settings also removes its saved password from the Keychain.
  • Account and trial copy: Signing out or deleting your account removes them from the Keychain.
  • Temporary transfer files: FrameFerret cleans these up after processing and removes older leftover copies at startup.
  • Detailed log files: FrameFerret removes files dated more than 30 days ago at startup and when it starts a new daily log.
  • System logs: macOS controls their retention.
  • Exported logs: You control these copies and must delete them separately.

You can delete local detailed logs in Settings > Logging > Delete Logs. This does not delete uploaded copies. Manage imported photos and videos in Apple Photos or your chosen folder.

Deleting the app alone may leave stored data or Keychain entries. Contact us for help removing remaining app data.

Permissions

FrameFerret requests permissions where you use the related feature:

  • Local network: Find and connect to cameras. The Add Camera sheet requests access before its first scan.
  • Apple Photos: Import files, check for existing items, and remove imported items when you request it. The app requests access when you press Allow Access to Apple Photos in the destination chooser.
  • Selected folders: Read, save, and manage files in the folder you choose.
  • Notifications: Report import results. The app requests access once camera syncing is on and you have added a camera. Enabling notifications in Settings can also request access.

Welcome lets you choose a destination or continue without one. Choosing a folder does not require Photos access. You can revoke Photos, local network, and notification permissions in macOS System Settings.

Apple reports and cloud storage

Apple may share crash and usage reports with us when you enable sharing with app developers. You can change this in macOS analytics settings.

If you use TestFlight, Apple automatically collects and shares crash and usage information with us. Apple also shares feedback you submit. These records may include contact details, depending on how you join or submit feedback. See TestFlight and Privacy.

We use these reports for support and troubleshooting. Apple controls retention within its own services.

If you enable iCloud Photos, Apple can upload imported media to iCloud. A folder managed by another cloud service can also sync imported files. These services follow their own settings and privacy policies.

Changes to this policy

We may update this policy as FrameFerret changes. We will update the date on this page when we make changes.

Contact

For privacy questions, access requests, or deletion requests, email admin@acgao.com.