Privacy policy

1. Who we are and what this policy covers

SweetFrame is a digital photo frame and its software, developed in Israel by TechRS [registered name, company or business number and postal address: to be completed in the legal review] (“TechRS”, “we”, “us”). This policy covers the frame and its software, the optional settings backup to Google Drive, and the website sweetframe.org. Contact us about anything privacy-related at support@sweetframe.org. The Hebrew version of this policy is the binding one; this English version is provided for convenience.

2. The principle: data stays on the frame

SweetFrame has no central server that collects families' data. The frame is a small computer in your home, and it connects directly to the services it needs: Google Drive and Google Calendar, your Nightscout site if you connect one, the weather service, the Jewish calendar service and our update server. The frame has no telemetry, usage tracking or analytics, apart from the update check described in section 6, and it does not send us your photos, glucose readings, calendar or settings.

The frame does depend on two things we operate: its Google identity, through which it reads your photos and calendar (section 4.1), and the update channel (section 6).

A phone that you pair with the frame talks to it directly over your home network. None of that goes through the internet or through us.

3. What the frame stores, and where

Everything in this table is stored on the frame's memory card in your home, unless stated otherwise.

4. Google: photos, calendar and backup

4.1 Photos and calendar: the frame's own address

This access does not use a SweetFrame Google sign-in: nobody signs in or grants a permission here, and you share with the frame's address as you would with a person. The frame sees only what you share with its address. The only permission the SweetFrame consent screen asks for is drive.file, for the backup (section 4.2).

Each frame has its own Google identity, a service account that we create for it in TechRS's Google Cloud project. This is “the frame's address” that you share a folder or calendar with. The frame signs in to that identity with a key that is kept only on the frame: our preparation process deletes our copy once the key is installed.

• The frame uses read-only permissions (drive.readonly and calendar.events.readonly) and sees only what you share with its address: the folders you shared and approved, the photos and videos in them and their file details, and calendars you shared (titles, dates and times).
• It never uploads, changes or deletes anything in Google, and it cannot see your other files, email or contacts.
• Google receives the frame's requests and its IP address, under Google's privacy policy. In our project, Google Cloud shows request counts per identity (numbers only, no content) and audit logs of administrative actions such as creating a key.
• Please note: as administrators of the Google Cloud project, we are technically able to create a new key for a frame's identity. We use that ability only to reconnect your frame at your request, never to access your photos or calendars. To cut the frame off completely, remove its address from the sharing of your Drive folder and calendar.

4.2 Settings backup to Google Drive (optional, coming in an upcoming update)

If you choose the backup, you connect your own Google account on the frame's screen: the frame shows a code, and you approve it at google.com/device on a phone or computer. Google shows a consent screen named SweetFrame that asks for one permission only: drive.file, access to the files that SweetFrame itself creates. Before saving anything, the frame asks you to confirm on its screen that the connected account is yours.

What the frame receives from Google:

• A refresh token (a long-lived key that lets the frame keep backing up), stored only on the frame in a protected file. Short-lived access tokens are kept only in memory.
• The email address and name of the connected account (from Google Drive), to show you which account is connected and ask for confirmation. They are stored only on the frame.
• The list of backup files that SweetFrame frames created in that account, their contents (to restore), and their older versions (to delete old versions when you choose to remove tokens from the backup).

What the frame writes to your Drive: a folder named SweetFrame with one file per frame, containing the frame's name, its settings (including the town, Shabbat and display settings, and the Nightscout site address), the birthdays and events you entered, names and IDs of linked calendars and of approved photo folders, and IDs of hidden photos. If the option to include access details is on (it is on by default and can be turned off), the file also contains the Nightscout read-only token and the secret calendar links, so a restore is complete. Never in a backup: Wi‑Fi passwords, the settings PIN, paired phones, the frame's own key, family notes and photos.

Do not share the SweetFrame folder or its files. Anyone who can open the file can use the Nightscout token in it to see glucose readings, and can open the linked calendars. To keep these out of Drive, turn off “include access details”; the frame then also deletes the older versions of the file that contain them. And if your Nightscout site opens without a token, the address alone shows the readings, and it is in every backup.

Use: only to back up your frame's settings and restore them, at your request. The backup goes directly from the frame to your Drive. It never reaches us or anyone else.

Retention and revocation: the file stays in your Drive until you delete it (Drive keeps older versions for about 30 days). Disconnecting on the frame deletes the token from it, and you can choose to also revoke the frame's access at Google at the same time. You can also revoke access from your account at myaccount.google.com/permissions. Revoking access at Google disconnects every frame that was backed up with that account.

4.3 Limited use of information from Google

SweetFrame's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

In practice:

• What the SweetFrame app receives through your Google sign-in (the drive.file permission): the backup files, and the account's name and email address from Google Drive. Used only to back up and restore the frame's settings.
• What you share with the frame's address (section 4.1): photos, file details and calendars. Used only to show them to you on the frame.
• We do not transfer it to anyone, do not sell it, and do not use it for advertising, user profiling or credit decisions.
• No person reads it unless you explicitly ask us to (for example, a support report you send us), for security purposes, or when the law requires it.
• We do not use it to develop, improve or train artificial-intelligence or machine-learning models.

5. Nightscout and glucose readings

If you connect a Nightscout site, the frame contacts it directly, about once a minute, with a read-only token, and shows the latest reading. It cannot change anything on the site. Readings are kept in the frame's memory only and are never sent anywhere: not to us, not to Google and not to the backup. The address and token are stored on the frame, and in the Drive backup while the option to include access details is on (it is on by default, section 4.2). Your Nightscout site receives the token and the frame's IP address. We do not operate your Nightscout site and are not responsible for it.

Anyone standing in front of the frame can see the reading. Guest mode hides it, and you can also hide it on Shabbat.

6. Other services the frame contacts

The browser that draws the frame's screen is configured not to contact anything outside the frame itself.

7. What we, TechRS, do receive

• Support requests: what you email us, including a support report from the frame if you attach one (it contains no passwords or tokens). A request can contain sensitive information, such as a photo of the screen showing a glucose reading or children's photos, so we treat every request as sensitive: only the people who handle support at TechRS read it, and we use it only to help you. Email reaches a TechRS business mailbox through Cloudflare's email routing [mail provider and storage country: to be completed in the legal review].
• Frame preparation records: the frame's identifier, its Google address and whom we gave it to, so that we can support it and reconnect it when you ask.
• Order details, if you bought a frame from us: the contact details you gave us, used only for the order, delivery and warranty.
• The frame's Google identity, which we create and administer (section 4.1).

We do not receive your photos, glucose readings, calendar, settings or backups, and we do not access them. What we can do technically: section 10.

8. This website

sweetframe.org is a static website. The website itself sets no cookies and has no analytics or advertising and no scripts or fonts from outside services. It is hosted on Cloudflare Pages: Cloudflare processes your IP address and request details to deliver and protect the site, may set a strictly necessary security cookie if it sees suspicious traffic, and may keep logs for a limited time, under Cloudflare's privacy policy. The email link on this site opens your own email program.

9. Children and sensitive data

• SweetFrame is made for families and may show children's photos, names and birthdays, and, if you turn it on, a child's glucose readings.
• Under Israel's Protection of Privacy Law, health information is information of special sensitivity. That is why the glucose readings themselves never leave the frame, and we do not receive or access them. The access details for your Nightscout site (address and token) are stored in your Drive backup while the option to include access details is on, which is the default (section 4.2).
• The information is shown only on the screen in your home, to whoever stands in front of it. Parents decide whether to turn on the glucose display, where to place the frame, and when to use guest mode. We recommend involving your child in that decision, especially older children.
• This website is not meant to collect information from children. Children who want to contact us should do so with a parent.

10. Security and our technical access

• The frame accepts connections only from your home network, behind a firewall. Nothing on it is reachable from the internet.
• Software updates are installed only when digitally signed by us, and after a failed update the frame returns to the previous version by itself.
• Google and Nightscout permissions are read-only (except the backup, which is limited to files SweetFrame created). Tokens and links are kept in protected files and are never written to logs.
• A limitation to be aware of: the frame's memory card is not encrypted. Someone who physically holds the frame or its card can read what is stored on it. If the frame is lost or stolen, follow the steps in the guide (Hebrew) and contact us.

What we can do technically, and how we limit it

• An administrator account on the frame. Every frame has an administrator account of whoever prepared it (TechRS). It can be used only with an encryption key and only from inside your home network, never from the internet. Whoever uses it can see and change everything on the frame. We use it when we prepare the frame, and after that only when you ask for help and agree. Reinstalling the frame also removes it. [Whether you can ask us to remove it, and what that means for support: to be completed]
• Software updates. Updates run on the frame with full privileges, as on any device, so an update could technically access everything on the frame. The frame installs only updates we signed digitally, and we do not put code that collects families' data into updates.
• The frame's Google identity. As described in section 4.1, we can technically create a new key for a frame's identity and read through it what was shared with that frame. We do this only to reconnect your frame at your request.
• Glucose readings. We do not receive or access them. Technically, someone using the administrator account while the frame runs could see them too.
• Who is authorised, and how this is protected. [The people at TechRS authorised for this access, two-step verification, access logs and a policy that blocks creating keys outside preparation: to be completed in the legal review]
• Security incidents. If we learn of a security incident that may affect your information, we will tell you and act as the law requires.

11. Retention

• On the frame: as listed in the table in section 3. A full reset deletes all of the family's information from the frame. Deleted data on a memory card can sometimes be recovered with special tools, so before a frame goes to another family we recommend a new card.
• In your Drive: the backup, until you delete it.
• With us: support requests for up to 24 months after they are closed, unless the law requires longer; order details for as long as needed for the warranty and by law; a frame's preparation records while it is in use and we support it [and after that: a period to be set in the legal review].
• With providers: request counts and audit logs of our Google Cloud project, under Google's retention periods (administrative audit logs: about 400 days); access logs of the update channel and of this website, under GitHub's and Cloudflare's policies.

12. Your controls

• Guest mode: hides glucose, calendar and notes from the screen.
• Shabbat: you can hide glucose on Shabbat.
• Nightscout: “Disconnect Nightscout” deletes the address and token from the frame; deleting the Subject on your site revokes the token.
• Photos and calendar: remove the frame's address from the Drive folder or calendar sharing, or remove a folder on the frame.
• Phones: disconnect one phone or all phones.
• Backup: disconnect on the frame, revoke access at myaccount.google.com/permissions, and delete the SweetFrame folder from Drive.
• Reset: a settings reset, or a full reset before handing the frame on.
• With us: ask us to delete your support correspondence.

13. Your rights

Under Israel's Protection of Privacy Law, 5741-1981, you may review information about you that we hold and ask us to correct or delete it. Since most of the information is with you, on the frame, we usually hold only what section 7 lists. Requests: support@sweetframe.org. We will answer within 30 days. You may also contact the Israeli Privacy Protection Authority.

Giving us information (for example in a support request) is voluntary, and there is no legal duty to do so. Without it we cannot handle your request.

14. Changes and contact

If we change this policy, we will update the date at the top of this page, and we will announce material changes on this website. Questions, requests and complaints: support@sweetframe.org, TechRS [registered name, company or business number and postal address: to be completed in the legal review].

מדיניות הפרטיות בעברית (the Hebrew version)