Privacy policy

Last updated October 12, 2026

What we collect, why, who we share it with, and the choices you have.

What we collect

Your name, email address, language, time zone, and password (stored only as a hash) or passkeys, and your Google or GitHub account ID if you sign in with one. Your teams, their members, roles, invitations, and audit log. The files you upload. Your plans, seats, usage, and credits. For each signed-in device, its IP address and browser, so you can see and log out your devices. For AI chats, the model used, the tokens, and the cost. Your chats with the assistant (what you write, the files you attach, and its replies), kept until you delete them, and the instructions your team gives the assistant. Your notifications and notification preferences, the getting-started steps you finished, and whether and when you agreed to receive marketing email.

How we use it

To run the service for you and your team, keep it secure (for example by limiting sign-in attempts), bill your plan, and send the emails it needs: verification, password reset, invitations, and the notification emails you choose in your settings. We send product news and offers only if you agreed, at signup or in your settings, and every one of them has a one-click unsubscribe link. We don't sell your data or use it for advertising.

Who processes it

These companies process your data for us:

Cloudflare

Hosts the service and stores and processes its data: the database, files, email, reading the files and converting the photos you send the assistant, analytics, and the Turnstile check that sign-up and sign-in come from a person.

Anthropic

Runs the assistant's AI model (Claude) on your messages, the files you attach, and the bakery data it looks up to answer you.

Paddle

Our merchant of record, processes payments, taxes, and invoices. Card details go to Paddle and never reach us.

Google and GitHub

Confirm who someone is when they sign in with Google or GitHub.

Each of them is bound to protect your data, and may process it outside your country under the safeguards the law requires.

Cookies and analytics

We use only the cookies the service needs to work, so we don't ask for consent to them:

__Secure-better-auth.*

Keeps you signed in, remembers the language you chose, protects signing in with Google, GitHub, a passkey, or a two-factor code, and, only if you ask, remembers a trusted device for 30 days so it isn't asked for a code.

__Host-d1-bookmark

Makes sure you see your own changes right away.

To count visits, we use Cloudflare Web Analytics, which sets no cookies and doesn't follow you across sites. We use no advertising or tracking cookies.

How long we keep it

We keep your data while your account or team exists. A deleted account or team can be restored for 30 days. After that, a deleted account is deleted for good, and a deleted team, with its files, 30 days after its deletion, except the payment events Paddle sent us about it, which we keep as billing records. A team's audit log entries are kept for 365 days. Our database's point-in-time backups keep deleted data for up to 30 more days, and its daily backups for 35 days. A data export's download link works for 24 hours, and the export is deleted within 24 hours. Records of what you did in the app, such as signing up, creating a team, or starting a checkout, tied to your account and team IDs and kept to improve the service, are kept for 395 days. Records of background tasks that failed, which can name the account or team they were for, are kept for 30 days, and records of service incidents for 90 days. Request logs, which include IP addresses, are kept for up to 7 days. Paddle keeps payment records for as long as tax law requires.

Your rights

You can see, correct, export, and delete your data: change your details in your settings, download a copy of your account's or team's data, or delete your account or team. You can unsubscribe from marketing email at any time. You can also object to how we use your data, ask us to limit it, or complain to your data protection authority.

Children

The service isn't meant for anyone under 16, and we don't knowingly collect their data.

Changes to this policy

We'll update the date above when this policy changes, and email you before important changes take effect.

The service is run by Placeholder Company, 123 Placeholder St, Suite 100, City, ST 00000, Country.

Questions? Write to support@farinu.com.