Privacy Policy

In short

• There is no account. Your sessions, notes, settings and credits are saved in your browser, not on our servers.
• You can erase everything in Settings, then Data, then Erase everything.
• Third parties, listed below, receive some data when you use a feature that needs them, and Google may set cookies for analytics and advertising.

Who is responsible

Friction is run by an independent developer. For privacy questions or requests write to hello@frictionx.app.

What stays in your browser

Your profile name, settings, sessions, drifts, credits, lessons, notes, to-do lists, layout and shop items are stored in your browser (localStorage and IndexedDB). We cannot see them, and clearing site data or using Erase everything removes them. Your private identity key is a random value that also stays in your browser; only a hash of it is ever sent anywhere.

What is sent to our servers

• The leaderboard (optional). If you set a public alias and take part, we store a public code (a hash), the alias you chose, and your score. Erase everything deletes your row.
• Together rooms (optional). A room stores the names members chose, chat messages, what is being shared and an optional Discord or Slack webhook address the host sets. A room with nobody left is deleted. Erase everything removes your seat.
• Moving your data. If you use Move my data, your data is encrypted in your browser with a code only you see, kept for ten minutes, and deleted when read. We never see the code or the contents.
• The Browser window and cloud browser allowance. Pages are fetched by our server on your behalf and are not stored. The daily time allowance for the cloud browser is counted against a hash of your network address, which is kept for the day.
• Technical logs. Our host, Vercel, processes requests and keeps standard server logs such as address, time and page requested.

Third-party services

• Google (Tag Manager, analytics, AdSense). The site loads Google Tag Manager, which measures how screens are used, and may show Google AdSense advertising on public pages. Google and its partners may use cookies and similar technologies, including to show personalised or non-personalised ads. Google's use of advertising cookies lets it and its partners serve ads based on visits to this and other sites. You can manage personalised advertising at adssettings.google.com and learn how Google uses data at policies.google.com/technologies/partner-sites. Where the law requires it, a consent choice is shown before such cookies are set.
• Hyperbeam and relay servers (cloud browser). If you open the cloud browser, a real browser runs on a third party's servers and that party can see what you do in it. A card says so before it starts. No cookies or profile are saved.
• AI services. Lesson demos send only the topic title to Google Gemini through our server. Ask AI sends what you type to free language-model services (Pollinations and LLM7). The Browser's site check sends an address, title and a short excerpt to the same kind of service. Do not type anything private into Ask AI.
• Content sources. Radio, TV, podcasts, news, songs, Wikipedia, maps and translation come from public services your browser or our server contacts when you use them; they see your address as any website would.
• Video and audio embeds. YouTube videos open in the privacy-friendly embed.

Cookies and local storage

See the Cookie Policy.

Children

Friction is a general study tool and is not aimed at children under 13. We do not knowingly collect personal data from them. If you think a child has given us data, write to hello@frictionx.app.

Your rights

Because almost everything is in your browser, you can see and delete it yourself. For data on our servers (a leaderboard row, a room seat), Erase everything deletes it. You may also ask us to access, correct or delete data, or object to its use, by writing to hello@frictionx.app. If you are in the EEA, UK or California you have additional rights under local law, and you may complain to your data-protection authority.

Security

Pages are served over HTTPS. Keys and secrets live only on the server and never in the client. No system is perfectly secure, so do not put anything highly sensitive into any web page, including this one.

Changes

When this policy changes we update the date at the top. Material changes are also noted on the front page.