FramePrivacy Policy
Frame for CardputerZero
Last updated: November 9, 2026
Frame ("the app") is a free, open-source video streaming application for the CardputerZero handheld, developed by Dmytro Makovieiev ("the developer", "we"). This policy explains what information the app accesses, how it is used, where it is stored and how you can delete it. It also covers this website, frame.hexlook.com.
The short version: Frame has no developer-operated backend for the app, no analytics, no ads and no tracking. Your Google and YouTube data travels only between your device and Google and is never sent to the developer or sold or shared with anyone.
1. Google sign-in and the data Frame accesses
Signing in with Google is optional. Without it you can still browse popular
videos, search and watch. If you sign in, Frame uses Google's OAuth 2.0 sign-in
for limited-input devices: you enter a short code at
google.com/device on another device, and Google shows you what
Frame requests before you approve. Frame never sees your Google password.
Frame requests a single permission (scope):
https://www.googleapis.com/auth/youtube.readonly— "View your YouTube account". This is read-only; Frame cannot post, comment, like, subscribe, upload, delete or change anything in your account.
Using that permission, Frame reads the following through the YouTube Data API:
| Data | Why Frame uses it |
|---|---|
| Your YouTube channel name, avatar image, channel ID and country | To show which account is signed in, and to choose the region for the list of popular videos. |
| The channels you are subscribed to | To show your subscriptions in the Account tab and let you open a channel. |
| Recent uploads of a channel you open | To list that channel's videos so you can play them. |
| Videos you have liked | To show your liked videos in the Account tab. |
| Popular videos for your region | To fill the Home tab. |
This data is used only to display it to you on your device. It is not used for advertising, profiling, analytics or any other purpose, and it is not used to develop, improve or train machine-learning or AI models.
2. How Google user data is stored and protected
- Authorization token. After you approve, Google issues an
access token and a refresh token. The access token is kept only in memory and
is never written to disk. The refresh token is saved on the device so you stay
signed in after a restart, in
~/.config/frame/tokens.json; the file is readable only by your user account (permissions0600in a0700folder), and the app refuses to use it if those protections are missing. - Account and list data (channel name, subscriptions, liked videos and similar) is kept in memory while the app runs and is not saved to disk.
- Images (your avatar and video thumbnails) are downloaded from Google's public image servers into a temporary folder that is deleted when the app closes. Image requests never include your credentials.
- All communication with Google uses HTTPS.
3. Sharing of Google user data
Frame does not transfer, sell or share Google user data with the developer or any third party. The developer does not operate a server for the app and has no access to your account, tokens or YouTube data. The only parties involved are you, your device and Google.
Frame's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Other data stored on your device
- Frame watch history — the ID, title and channel name
of videos you play in Frame, saved in
~/.local/state/frame-history/so you can find them again. It stays on the device, is never uploaded, and is not your YouTube watch history (Frame does not read or write your YouTube history). You can clear it in the app. - Settings — app preferences such as dark mode.
5. Requests to YouTube without your account
Searching and streaming videos for playback are done with anonymous requests to YouTube that do not include your Google credentials or tokens. Like any request on the internet, these and the sign-in requests reveal your device's IP address to Google, which processes it under the Google Privacy Policy.
6. YouTube API Services
Frame uses YouTube API Services. By using Frame's YouTube features you agree to be bound by the YouTube Terms of Service. Information obtained through YouTube API Services is also subject to the Google Privacy Policy.
Frame does not place cookies or similar identifiers on your device and does not allow third parties to do so.
7. Retention and deletion
- Sign out in the Account tab: Frame deletes the saved authorization from the device and asks Google to revoke it.
- Revoke from Google: you can remove Frame's access at any time on your Google Account permissions page. Frame then can no longer read your data.
- Uninstall: removing the app and the folders listed above deletes everything Frame stored on the device.
Because the developer holds no copy of your data, there is nothing for the developer to delete on their side. If you have questions, contact us below.
8. This website
frame.hexlook.com is a static information site. It uses no cookies, analytics or third-party scripts. Like most web servers, it keeps standard access logs (IP address, time, requested page and browser user agent) for security and troubleshooting; these are not combined with any other data.
9. Children
Frame is not directed at children under 13 and does not knowingly collect personal information from children. Google accounts are subject to Google's own age requirements.
10. Changes to this policy
If this policy changes, the updated version will be published at this address with a new "Last updated" date. If Frame starts using Google user data in a new way, you will be asked for consent again where required.
11. Contact
Dmytro Makovieiev — idarkmen@gmail.com
Source code: github.com/CardputerZero/frame