Privacy Policy

Push Refresh (“we”, “us”) builds plugins and integrations that connect third-party services to design and content tools. This policy covers all current and future Push Refresh plugins unless a specific plugin publishes its own policy that replaces this one.

Who we are

Push Refresh is operated by Michael Rossi. For privacy questions or data requests, email hello@pushrefresh.com.

Scope

This policy applies to:

• Any Push Refresh plugin you install in Framer, Webflow, or another host platform
• Backend services we operate to support those plugins (currently hosted on Vercel under domains like plugins.pushrefresh.com)
• Optional purchases of paid plugin tiers, processed through Polar.sh

What we collect

When you connect a third-party service (e.g., Square, Contentful, Notion) through one of our plugins, we store on our servers:

• Your account, workspace, or merchant identifier on that service
• Your business name or workspace name (whatever the service exposes)
• OAuth access tokens and refresh tokens, encrypted at rest with AES-256-GCM
• The API endpoint or region your account uses

While the plugin operates, we additionally store:

• Sync history records — what was synced, when, and any errors
• Webhook events that the third-party service sends us
• Plugin diagnostic events (errors and timing) for troubleshooting

If a plugin includes commerce features (e.g., embedded checkout), we additionally store order metadata: order ID, total, currency, shipping address, line items, and customer email if the checkout collects one. We do not store payment-card numbers, CVVs, or any full card details — those go directly to the payment processor (e.g., Square Web Payments, Stripe).

If you purchase a paid license, we additionally store:

• The license key issued by Polar.sh
• The activation ID returned by Polar
• The customer email associated with the Polar purchase
• The third-party account identifier the license is bound to (e.g., your Square merchant ID, Contentful space ID)
• The activation date

What we do not store

• Your password to any third-party service
• Customer payment-card numbers, CVVs, or any full card details
• The content of synced media files — we proxy URLs; the underlying assets stay with their original host (e.g., Square's CDN, Contentful's asset host)

How we use it

• To call the connected third-party API on your behalf when the plugin requests data
• To process transactions through the third-party (e.g., Square Web Payments) when an embedded checkout is used
• To validate paid licenses against Polar.sh and enforce free-tier limits when no valid license is present
• To send transactional notifications about sync failures or licensing — only if you have opted in

Third parties

The plugin you install determines which third-party services your data flows to. Once your data leaves our servers, the receiving service's own privacy policy governs what they do with it. Services our plugins commonly interact with:

• The third-party API your plugin connects to — receives API calls made on your behalf (e.g., Square, Contentful, Notion)
• Polar.sh — receives license validation and activation requests when you enter a license key
• Vercel — hosts our backend infrastructure; standard HTTP request logs apply
• Neon (Postgres) — hosts our database
• The host platform your plugin runs in (e.g., Framer, Webflow) — we do not share data with them beyond what is required for the plugin to render in their iframe

Security

• OAuth access and refresh tokens are encrypted at rest using AES-256-GCM with a key held only in our server environment
• All database connections use TLS
• We do not commit secrets to source control
• License-key handoffs use single-use, time-limited records (10-minute TTL)

Data retention

• Account and license records: retained while your connection or license is active, plus 30 days after a deletion request
• Sync history: 90 days
• Order records: 7 years (financial record-keeping requirements)

After a deletion request, we retain only what we are legally required to keep.

How to revoke access and delete your data

1. Revoke the OAuth grant from the connected third-party service (most services expose this under their dashboard's Apps, Integrations, or Connected Apps section).
2. Email hello@pushrefresh.com with your account, workspace, or merchant identifier(s). We will delete your records within 30 days.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be communicated through the plugins themselves where reasonably possible.

Contact

Questions, data requests, or security reports: hello@pushrefresh.com