Privacy notice

Last updated: Oct 9, 2026.

This notice explains what personal information FFP Method collects, why, who helps us handle it, how long we keep it and the choices you have. It covers the FFP Method website at ffpmethod.com. There is no FFP Method mobile app, and we don't run ads.

Who we are

FFP Method is run by Esor, Inc. ("we", "us"). For questions about this notice or your information, email us at ffpmethod.hello@gmail.com.

The short version

• We collect what the membership needs: your email address, your membership status from Stripe, and the videos you watched and saved.
• Stripe takes your payment on its own pages. We never see or store your card number.
• We don't sell your information, don't use it for ads and don't track you on other sites.
• Our site sets no cookies. Your browser keeps your sign-in in its own storage.
• You can delete your account in the app at any time.

What we collect and why

Your account. Your email address and when your account was created and last signed in. We use them to create your account and sign you in. We don't ask for your name, phone number, photo or a password.

Signing in. We sign you in with a 6-digit code sent to your email address. For each request we keep, under your email address: a salted hash of the code (never the code itself), when it was sent and when it expires, and counts of emails sent and wrong codes tried. The email names the browser and operating system that asked for it and the time, for example "Chrome on macOS, Sep 30, 2026 at 7:12 AM UTC", so you can spot a request that wasn't yours. We work that out from the request and don't store it.

Your membership. When you continue to payment, we open Stripe's payment page with your email address and your account ID, so the payment is matched to your account. Stripe then collects your card and billing details on its own page. From Stripe's signed messages we store your Stripe customer ID, a copy of your account email, your subscription's status, its start, renewal, cancellation and end dates, and the plan's price and currency. We use them to give members access and to show your plan. If you pay through our payment link without an account, we create one for the email address you gave Stripe; you sign in with a code sent to it. Once a day we read your subscription back from Stripe, so a missed message never leaves your access wrong. If a payment matches no account, we keep the payer's email address and Stripe's checkout reference so our support can connect it to the right account. If you pay twice for one account, we cancel the second membership and refund it in full.

Billing problems. When a payment needs a person (a payment no account can claim, a refund Stripe refused or couldn't deliver, a disputed charge, a second membership we refunded), our support mailbox gets an email with your account ID, the payer's email address where Stripe has one, and Stripe's references and amounts. Never card details. If you dispute a charge with your bank, we end your membership without a refund, because the bank returns the money.

Your billing page. If a payment fails, the page reads your invoices from Stripe each time you open it, to show the date Stripe will next try your card and a link to pay the unpaid one on Stripe's page. We don't store them. "Update card" opens Stripe's customer portal, where you can change the card on file.

Canceling. When you cancel, we cancel your subscription at Stripe and refund the days you haven't used from your last payment. The refund carries your account ID and subscription ID, so it can be traced later. After canceling you can answer one optional question by picking the reason you canceled from a list. We store that reason with your account to improve the membership.

Watching. Which videos you completed and when, where you stopped in a video (saved about every 15 seconds while it plays, and when you pause, skip, switch tabs or leave), and the videos you saved. We use them to open modules in order, show "Watched" dates, let you resume and keep your Saved list.

Refund requests. The Request a refund link opens a Google Form. It asks for the email address on your account, what went wrong and the date of the charge, and, if you choose, your name, the amount, the receipt number and anything else you want us to know. The answers are kept in the form in our Google account, and only we read them, to look into your request and reply by email. The form doesn't ask you to sign in to Google and doesn't record your Google account.

Messages you send us. If you email us at ffpmethod.hello@gmail.com (the "Contact us" and "Email us" links on our pages open your own email app), we keep your email address and what you wrote in that mailbox to answer you.

Technical information. Like any website, the services behind our pages see your IP address, browser type and the time of each request. Google keeps these in its logs for us (see "How long we keep it"). To slow down abuse of the sign-in email, we also keep a scrambled fingerprint of your IP address (a one-way hash, not the address itself), only to count how many sign-in emails and wrong codes came from that network. It is deleted automatically, usually within two days after the last sign-in email or code attempt from that network. Nothing else we store links to your IP address, and we don't use it to build a profile of you.

What we don't collect. No card numbers, names, phone numbers, photos, passwords or uploads. No health information: we don't ask about conditions, symptoms or measurements, and progress only records which videos you watched and where you stopped. No information about you from other companies, no analytics, and no advertising or tracking tools.

How we use it

• To run your membership: sign-in, access to videos and modules, progress and saved videos.
• To take payments, cancel and refund through Stripe.
• To send service emails, like your sign-in code and the confirmation of your membership.
• To keep accounts safe and stop abuse, for example limits on sign-in attempts.
• To show the creator who makes the videos, and our other content editors, how the membership is doing: totals such as how many people signed up, are members, or watched, finished and saved each video. We count them from sign-up dates, memberships, viewing progress and saved videos. Editors see totals only, never one person's activity.
• To meet legal duties, like tax records and answering lawful requests.

We don't sell your personal information, don't use it for targeted ads, don't share it for other companies' marketing and don't use it to train AI models.

Who we share it with

Only with companies that run parts of the service for us, and only what each one needs:

• Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage). Stores your account and progress, signs you in, runs our server code, and keeps request logs and a one-way hash of your IP address to slow down sign-in abuse. Their privacy notice: firebase.google.com/support/privacy.
• Stripe. Takes payments, runs the customer portal, keeps invoices and sends refunds. For some purposes, such as fraud prevention and its own legal duties, Stripe decides on its own under its privacy policy: stripe.com/privacy.
• Google (Gmail). Sends our sign-in code and membership confirmation emails from ffpmethod.hello@gmail.com, with open and click tracking off, and holds the messages you send to that address. A copy of every email we send is kept in that account's Sent folder. Their privacy notice: policies.google.com/privacy.
• Google (Firebase App Hosting). Serves our pages and sees IP addresses in its request logs. Their privacy notice: firebase.google.com/support/privacy.
• Google (Forms). Runs the "Request a refund" form and keeps its answers in our Google account. Their privacy notice: policies.google.com/privacy.
• Mux, Inc.. Streams the videos and sees your IP address, device and playback requests while you watch. Mux also receives the original video files our team uploads. We don't use Mux Data, their viewer analytics product. Their privacy notice: www.mux.com/privacy.

We also share information when the law requires it (for example a valid court order), to protect our rights or someone's safety, and with a buyer if Esor, Inc. or FFP Method is sold, who would then have to follow this notice.

Cookies and browser storage

Our site sets no cookies. It uses your browser's storage for three things:

• Your sign-in. Firebase keeps your session (a sign-in token, your account ID and your email address) in your browser's IndexedDB (firebaseLocalStorageDb) until you log out. It also keeps a small record of its software version (firebase-heartbeat-database), which it sends to Google with requests.
• A sign-in in progress. Between asking for a code and using it, we keep your email address and the page to return to in localStorage (ffp.signIn). It's removed when you sign in; otherwise it stays until you clear your browser's site data.
• A known-device proof. After you sign in on this browser, we keep a short signed string in localStorage (ffp.device) so wrong codes typed on other people's devices can't lock you out on this one. While it's there, a members-only page you open signed out offers log-in instead of sign-up. It never leaves your browser for that. It's not a password and it can't sign anyone in on its own. It stays up to 180 days. Clearing your browser's site data removes it, and Safari removes it after 7 days without a visit.

Stripe's pages (payment, the customer portal and invoices) are on stripe.com and set Stripe's own cookies. Our fonts come from our own site, so loading a page makes no request to Google Fonts. The video player is our own; the request for the video and its subtitles goes straight to Mux (stream.mux.com), and Mux may set its own cookies on that response. We don't load Mux's analytics script, so no viewer analytics IDs are set on our behalf.

Do Not Track and Global Privacy Control

We don't track you across other websites or over time, and no advertising or analytics company collects information on our pages. Because of that, Do Not Track and Global Privacy Control signals change nothing on our site.

Emails

• Service emails. Go to every member and can't be turned off while you have an account: your sign-in code, with the browser, system and time of the request as a security check. A copy of every sign-in email is kept in the Sent folder of our mailbox. Payment receipts and refund confirmations come from Stripe, not from us.
• Membership confirmation. When a membership you bought first becomes active, we email your account's email address once: your plan and its price, that it renews automatically every month until you cancel, the date and amount of the next charge, how to cancel, and our cancel policy. It's a record of your membership terms for you to keep, so it can't be turned off while you have a membership. A copy is kept in our Sent folder like the sign-in emails.

How long we keep it

• Account, progress, saved videos, survey answers and membership record. Until you delete your account. A saved video goes when you unsave it.
• Sign-in request (hashed code, counters). Deleted when you sign in. Otherwise deleted automatically, usually within 2 days of the request.
• Known-device proof in your browser. Up to 180 days from the last sign-in on this browser. Sooner if you clear site data, or after 7 days without a visit in Safari.
• Sign-in counter per network (one-way hash of your IP address). Deleted automatically, usually within two days after the last sign-in email or code attempt from that network.
• A sign-in in progress in your browser. Until you sign in or clear your browser's site data.
• An unmatched payment (the payer's email address, the checkout reference). Until support connects it to an account.
• Copies of the emails we send (sign-in codes and membership confirmations). Kept in the Sent folder of our mailbox. Ask us and we'll delete yours.
• Your emails to us and our answers. Kept in our mailbox to answer you. Deleting your account doesn't delete them; ask us to.
• Refund requests (the form's answers). Kept in the form in our Google account. Deleting your account doesn't delete them; ask us to.
• A deletion mark after you delete your account. We keep a small record under your Stripe customer ID with the deletion time only, so late messages from Stripe about a canceled subscription can't recreate any of your data.
• Google's logs (IP address, browser, time, account ID). About 30 days for request logs. Firebase keeps sign-in IP addresses for a few weeks, and deleted logins leave Google's backups within 180 days.
• Stripe's records (customer, subscriptions, invoices, payments, refunds). Kept by Stripe under its own policy and the law, also after you delete your account.

Your choices and rights

• Delete your account. Open Account, then Subscription and billing, and choose Delete account. If you signed in more than 5 minutes ago, we first email you a code to confirm it's you. Deleting ends any membership right away, refunds the days you haven't used, and at once erases your login, your account record, progress, saved videos, survey answers, membership record and any pending sign-in request. Stripe keeps its own billing records (see above).
• See, copy or correct your information. Email us at ffpmethod.hello@gmail.com. There is no in-app export or email change yet. We confirm it's you by emailing a code to your account address and answer within 30 days.
• Card and billing details. Change the card on file in Stripe's customer portal through "Update card" on your billing page.
• Nevada residents. We don't sell covered information. You can still send us a request not to sell it at ffpmethod.hello@gmail.com, and we answer within 60 days.
• California residents. We don't share personal information with other companies for their direct marketing.

How we protect it

• Connections to our site and services use HTTPS.
• We store sign-in codes only as salted hashes (the email itself, and its copy in our Sent folder, contains the code). A code works once and expires after 10 minutes. We limit new emails (one a minute, 10 an hour for a new device) and wrong codes (5 per code, 10 per address a day on a new device, 30 on a device you've used before, 30 per network a day).
• Our database rules let each member read only their own account data, and only through our own sign-in.
• Content editors (the people who publish videos and tips) sign in the same way. Their pages never give them access to member accounts, billing or sign-in records, and their Stats page shows totals only, never an email address or one person's activity.
• Card details stay with Stripe.
• Only the people who run the service can open member data, each with their own account.

No system is perfectly secure. If a breach affects your information, we'll tell you as the law requires.

Children

FFP Method isn't directed to children under 13, and we don't knowingly collect information from them. A membership needs a payment card, and you must be at least 18 to become a member (see our terms). If you believe a child gave us information, email us at ffpmethod.hello@gmail.com and we'll delete it.

Where your information is processed

We and our providers store and process your information in the United States.

Links to other sites

Payment, the customer portal and invoices open on Stripe's site, and the refund form on Google's. Their own privacy notices apply there.

Changes to this notice

We change the "Last updated" date whenever we update this notice. For a material change, we email members and show a notice in the app at least 30 days before it takes effect. We'll ask for your consent before using information we already hold in a materially different way.

People outside the United States

FFP Method is run from the United States, and your information is processed there. If you live in the European Union or the United Kingdom, data protection law gives you rights over your information: to see it, correct it, delete it, take a copy, and object to or limit how we use it. Email us at ffpmethod.hello@gmail.com and we'll answer within one month. We use your information to provide the membership you signed up for, to keep accounts safe and to keep the records the law requires. You can also complain to your local data protection authority.

Contact

Email us at ffpmethod.hello@gmail.com.