Privacy Policy

1. Overview

SuperFree is a website builder and hosting platform. We let users create accounts, build websites, publish them to free .superfree.site subdomains or connected custom domains, export and import site files, use an optional desktop app, and request paid Enterprise help.

We try to collect only the information needed to operate the service, secure accounts, deliver published websites, and provide support.

2. Information We Collect

Depending on how you use SuperFree, we may collect and store the following:

• Account details such as your name, email address, username, encrypted password, plan, email-verification status, and account creation date.
• Website data you create or upload, including site names, slugs, pages, HTML, CSS, SEO fields, redirect rules, blog posts, and site settings such as favicon, description, maintenance mode, head code, and footer code.
• Password-protected page settings. SuperFree stores a password hash for protected pages rather than storing the page password in plain text.
• Custom domain data such as the hostname you connect, validation records, Cloudflare custom-hostname identifiers, and SSL or activation status.
• Version history, reusable sections, soft-deleted site snapshots, imports, exports, and preview data needed to restore or manage content.
• Enterprise inquiry details you submit through the website, such as your name, email, business or project name, account status, project details, and selected payment method.
• Support and transactional email data needed to send account verification emails, password reset emails, first-publish emails, and support-related messages.
• Limited technical and security data such as your IP address for rate limiting and abuse prevention on login, signup, forgot-password, and similar endpoints.

3. How We Use Information

We use information to operate and improve SuperFree, including to:

• Create and manage accounts, authenticate users, and keep sessions active.
• Store, edit, preview, publish, unpublish, export, import, and restore websites and related content.
• Send verification emails, password reset emails, publishing notifications, and service communications.
• Process Enterprise requests and route project details to our team before payment review and follow-up.
• Provision and manage custom domains and SSL status through our infrastructure providers.
• Prevent abuse, limit automated attacks, and protect accounts and published websites.
• Comply with legal obligations and enforce our platform rules.

4. Public Website Content

When you publish a site, the content of that site becomes publicly accessible at its live URL. This can include page HTML, CSS, page titles, SEO descriptions, blog posts, images or image URLs, and any content or code you place into your pages.

If you connect a custom domain, your connected hostname also becomes part of the public presentation of your site. If you add third-party embeds, forms, analytics, or external assets to your site, those third parties may collect information directly from your site visitors under their own terms and privacy practices.

5. Service Providers and External Services

SuperFree uses third-party service providers to run the platform. Based on the current implementation, these include:

• Cloudflare for infrastructure, hosting, and custom domain management.
• Resend for transactional email delivery such as verification and password reset emails.
• Formspree for Enterprise inquiry submission and, if a user chooses to use it, contact forms embedded in a site.
• PayPal for Enterprise checkout and payment handling.

We may update our providers over time as the service evolves.

6. Cookies and Local Storage

SuperFree uses browser storage and cookies in limited ways:

• The web app stores a JWT auth token in browser localStorage so you can stay signed in.
• The app may store small local preferences in localStorage, such as dismissed UI notices or Enterprise form details.
• For password-protected pages, SuperFree sets an HTTP-only cookie after a visitor enters the correct page password so that visitor can continue to access that protected page for a limited period.

As of the current implementation, SuperFree does not rely on third-party advertising cookies and does not appear to include a separate analytics tracker on the main site.

7. Retention

We keep account and website information for as long as needed to provide the service or until you delete it, subject to technical backups and legal requirements.

• Unverified accounts are currently scheduled for automatic deletion after 7 days.
• Password reset and email verification tokens expire automatically.
• Deleted sites may be retained temporarily in a recoverable state before they expire permanently.
• Published site payloads and preview data may persist in platform storage for operational reasons until they are overwritten or removed.

8. Security

We use reasonable measures to protect data, including hashed passwords, hashed page-password storage, rate limiting on sensitive endpoints, and HTTPS-backed infrastructure. No service can guarantee absolute security, so you should use strong passwords and avoid placing sensitive personal data into public website content unless you fully intend to publish it.

9. Your Choices and Access

You can generally access, edit, export, unpublish, or delete your website content from your account. You can also update your account information and password. If you need help with a privacy request or account issue, contact help@superfree.site.

10. Children

SuperFree is not intended for children under 13, and you should not use the service if you are not old enough to agree to these terms under applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we may update the effective or last-updated date on this page. Your continued use of SuperFree after a change means the updated policy applies going forward.