Privacy Policy

1. Who operates Frittata

Frittata is independently developed and operated in New Zealand by Rochelle Zettlemoyer. Rochelle determines the purposes and means of processing personal information within Frittata’s operator-controlled services.

Cracked Egg Productions, LLC is associated with Frittata’s verified Meta Business Portfolio. It is not identified here as Frittata’s New Zealand operating entity or data controller.

2. Information Frittata may process

Frittata may process Facebook Page, Post, and Comment identifiers; post and comment text; timestamps; thread relationships; available commenter identity fields; available profile-image URLs; attachments; moderation states; reply information; evidence records; and authorization information needed for Meta services.

Commenter identity information depends on Meta permissions and the information Meta provides. Business Asset User Profile Access remains subject to Meta approval and may not make every requested identity field available.

3. Local storage

Most everyday Frittata data is stored on the authorized user’s computer. This can include SQLite operational records, comment and media caches, a Page-picture cache, moderation journals, local application configuration, and a separate evidence archive. Ordinary local SQLite operational and evidence databases are not application-layer encrypted. Credentials are stored separately through supported operating-system credential storage.

Frittata does not apply one universal automatic retention period to local data. Uninstalling the application may not remove every local data store. Evidence observations are append-only, and media availability depends on what was captured or remains in the relevant local cache.

4. Cloudflare services and international processing

Frittata uses Cloudflare Workers and D1 for specified optional services: Facebook webhook reception, normalized event metadata storage, temporary authorization handoffs, Live Updates registration, and optional moderator-team synchronization.

Signed Page webhooks are normalized into event metadata that can include Page, Post, Comment, and parent-comment IDs, event type, timestamps, and reconciliation metadata. The D1 webhook-event table does not retain raw webhook bodies, comment text, commenter profiles, attachment bytes, or plaintext Meta access tokens.

Cloudflare transiently processes authorization materials and access tokens in supported authentication and subscription flows. Temporary OAuth handoffs are AES-GCM encrypted and deleted when claimed or after their configured short expiry. Live Updates registration may process User and Page access tokens for validation and subscription; its event store keeps hashes and routing or authorization state rather than plaintext tokens.

When team synchronization is configured, Cloudflare may store Page, Post, and Comment IDs; shared workflow states; moderator assignments; classification and review metadata; evidence-selection indicators; and intentionally shared Response Bank text. Ordinary team synchronization does not upload Facebook comment text, commenter names, profile pictures, media bytes, evidence bodies, or Meta access tokens.

Cloudflare infrastructure may process limited application information outside New Zealand. These services support authentication, Facebook webhook notifications, and optional moderator-team synchronization.

5. How information is used and protected

Frittata uses Meta Platform Data to display Page conversations, maintain local workflow, perform user-requested Page actions, and operate the optional services described here. It is not designed for advertising, data brokerage, or unrelated profiling.

Implemented safeguards include HTTPS for service traffic, Facebook webhook signature verification, hashed team and device credentials, scoped authorization, secret redaction in application logs, encrypted temporary OAuth handoffs, and supported operating-system credential storage. These measures do not mean every local or D1 record is application-layer encrypted, every record expires automatically, or that security can be guaranteed absolutely.

Frittata is an independent application and is not affiliated with, endorsed by, or operated by Meta Platforms, Inc.

6. Retention, deletion, and privacy rights

Webhook events are retained for at least seven days after eligible acknowledgement, with a 30-day hard recovery cap. Temporary OAuth transactions expire after ten minutes. Team shared records and audit history do not have a general automatic expiry in the current implementation.

Individuals may contact Rochelle Zettlemoyer to request access to, correction of, or deletion of personal information under the operator’s control, subject to applicable law and legitimate retention obligations. The operator cannot retrieve or delete information held independently by Meta, other administrators, or another service provider. See Data Deletion and Removal Information for request details.

7. Contact

For privacy questions or requests, contact auntie@crackedeggproductions.net.