Privacy Policy

1. Information we process

• Account data: Supabase Auth user ID, login email, provider information needed for Google OAuth, and session data.
• Project data: YouTube reference URL and video ID, title, channel, thumbnail, duration, project status, and timestamps.
• Content data: source videos you upload, clip selections, titles, text, templates, layout drafts, and rendered exports.
• AI data: transcripts, scenes, recommended clips, generated titles and explanations, analysis status, model names, and token usage.
• Plan and payment data: plan, free analysis usage, payment status, amount, currency, transaction references, subscription state, and webhook events. Production checkout is currently disabled.
• Technical data: authentication and locale cookies, operational logs created by hosting providers, and privacy-safe diagnostic stages.

2. Why we use it

• Authenticate members and enforce project ownership.
• Provide upload, AI analysis, editing, rendering, and download workflows.
• Apply plan limits and prepare secure payment verification.
• Investigate errors, prevent duplicate requests, protect the service, and improve reliability.

3. Storage and service providers

Account, project, usage, and payment records are stored in Supabase. Private source and export objects are stored in Cloudflare R2 and accessed through limited signed URLs. Vercel hosts the web app, while Google Cloud Run processes video analysis and rendering.

Google supports OAuth and YouTube metadata access, OpenAI processes transcription and AI analysis inputs, and PortOne processes payment verification and webhooks only when payment features are used. Each provider receives data only for its service role.

4. Retention and deletion

The current code does not define one fixed, time-based retention period for accounts, projects, media, or operational logs. Users can delete their account from Settings to remove the Auth account, projects, source and export files, analyses, drafts, and usage data.

Payment records and related webhook events may be retained after removing the direct user link and supplemental metadata. Final legal retention rules will be disclosed before paid checkout is enabled.

5. Cookies and authentication

We use HttpOnly, Secure-in-production, SameSite=Lax cookies for sessions, a short-lived OAuth return-path cookie, and cookie/browser storage for your language choice.

6. Your rights

You may request access, correction, or deletion of your information. Account deletion is available in the danger area of Settings after typed and final confirmation. Active work or a paid subscription can temporarily block deletion until safe cleanup is possible. The official support channel will be published once finalized.

7. Contact and changes

Business details, the privacy contact, and the official support channel will be published once finalized. Material changes will be announced in the service or on this page before they take effect.