Privacy Policy

The short version

• We collect what we need to make, store and post your videos, bill you and keep your account safe.
• We don't sell your data, and we don't use your content to train AI models.
• This marketing website sets no tracking or advertising cookies.
• You can export or delete your data from the app at any time.

What we collect

When you visit this website

Our hosting provider records standard request logs (IP address, browser, page requested, time) to keep the site running and secure. Your light or dark theme choice is saved in your own browser's local storage and never sent to us. We don't run analytics or ad trackers on this site.

When you use the app

• Account: name, email, password (stored only as a scrypt hash), two-factor settings, and your Google account id if you sign in with Google.
• Content: files you upload, AI-generated images, voiceovers, avatars and videos, projects, scripts, captions, business profiles, image collections, campaigns and schedules.
• Connected accounts: for TikTok, Instagram, Facebook Pages, YouTube and LinkedIn — the account name, picture and id, access tokens (encrypted at rest), and statistics for posts we published (views, likes, comments, shares).
• AI provider keys: keys you add in Settings → AI keys, encrypted at rest and used only for your own requests.
• Billing: plan, credit history and Stripe customer id. Card details are handled by Stripe and never stored by us. If you cancel, any feedback you choose to give.
• Usage and security: sign-in sessions (IP address and browser), request logs and error reports.
• Messages: emails you send us and our replies.

How we use it

• To run the Service: generate, render, store and publish your videos, run your campaigns and show your analytics.
• To bill you, apply plan limits and credits, and prevent fraud and abuse (for example, one free trial per person and per card).
• To email you about your account — verification, security, failed posts and billing. You choose which notifications you get in Settings.
• To answer support requests and improve the Service.

Our legal bases (where GDPR or similar laws apply) are: performing our contract with you, our legitimate interest in running a secure and reliable service, complying with legal obligations, and your consent where we ask for it.

Who we share it with

Only the processors needed to run the Service, each for its own task:

• Cloudflare R2 (file storage), our hosting and database providers
• AI providers you use: OpenRouter, OpenAI, Anthropic, fal.ai, Replicate, ElevenLabs, HeyGen — they receive the prompts, text and media needed for each request
• Pexels and Pinterest, when you search stock photos or import images
• Stripe (payments), Resend (email), Sentry (error reports)
• The social platforms you connect, when we publish or read statistics for you
• Webhook endpoints you configure yourself

We may also disclose data if the law requires it, or to protect the rights and safety of our users and the public.

Google and YouTube data

When you connect YouTube we use YouTube API Services to upload your videos and read their statistics. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. See the Google Privacy Policy. You can revoke our access at any time from your Google security settings or by disconnecting the channel in ReelFrames.

International transfers

Our providers may process data in countries other than yours. Where required, we rely on safeguards such as the EU Standard Contractual Clauses.

How long we keep it

• While your account exists. Deleting your account removes your files, videos, posts, projects and connected accounts.
• Billing records are kept as long as tax law requires. Notifications are deleted after 90 days, expired sessions after they end.
• Website request logs are kept by our hosting provider for a short period for security.

Your rights

• Access and portability: download everything we hold from Settings → Privacy → Export my data.
• Deletion: delete your account from Settings → Privacy, or see data deletion.
• Correction, objection, restriction: email [email protected]. You can also complain to your local data protection authority.
• California residents: you have the right to know, delete and correct your personal information. We don't sell or share it for cross-context behavioural advertising.

Security

Passwords are hashed; platform tokens, AI keys and two-factor secrets are encrypted; connections use HTTPS. You can turn on two-factor sign-in and sign out other devices in Settings → Security. No system is perfectly secure, so please use a strong, unique password.

Children

The Service isn't meant for anyone under 16, and we don't knowingly collect their data. If you think we have, contact us and we'll delete it.

Cookies

The app uses one essential cookie to keep you signed in. This website uses none. Details in our Cookie Policy.

Changes

If we change this policy in a meaningful way, we'll tell you by email or in the app before the change applies.