Draft for review: replace every [PLACEHOLDER], list your actual processors and regions, and have a qualified lawyer review this policy (for example for GDPR/UK GDPR and CCPA/CPRA) before launch.

Privacy Policy

Effective [DATE THESE TERMS TAKE EFFECT]

The short version
  1. Your video, audio and images stay on your computer — we never receive them.
  2. We store your Google account basics (name, email, profile picture) and the project timelines you save.
  3. AI requests go from your computer straight to the AI provider you choose, under your account with them.
  4. Only essential cookies. No advertising, no selling or sharing of personal information.

1. Who we are

[COMPANY OR OWNER LEGAL NAME] (“we”, “us”), [POSTAL ADDRESS], is the controller of the personal data described here for IngrainedCut (the “Service”). Contact: [PRIVACY CONTACT EMAIL].

2. What we collect

DataSourceWhyLegal basis (EEA/UK)
Name, email address, profile picture, Google account IDGoogle, when you sign inCreate and secure your account, sign you inContract
Session data: session token, IP address, browser user agent, timestampsYour browserKeep you signed in, protect against abuseContract; legitimate interests (security)
Project data you save: project names, timeline structure, clip timings, effects, titles and captions text, and the file names and folder paths of media on your computerYouSave and reopen your projectsContract
Messages you send usYouSupportLegitimate interests

What we do not collect: your media files (video, audio, images), exported videos, the contents of your conversations with AI agents, or your AI provider credentials. The helper keeps these on your computer and talks to AI providers directly.

3. AI providers

When you use an AI feature, the helper on your computer sends your prompt, a text description of your timeline (which can include media file names and paths, clip timings and any title or caption text) and, if you choose, frames from your edit or transcripts of your media, to the provider you selected — Anthropic (Claude), OpenAI (Codex) or Anysphere (Cursor) — using your own account with them. They process that data under their own terms and privacy policies, not ours.

4. Cookies

We use only cookies that are strictly necessary to sign you in and keep your session secure. We do not use advertising or analytics cookies. [IF YOU ADD ANALYTICS, UPDATE THIS SECTION AND ADD CONSENT WHERE REQUIRED.]

5. Who we share data with

We do not sell or share personal information for advertising. We use service providers that process data on our behalf:

We may also disclose data if required by law or to protect the rights, safety and security of users and the Service.

6. International transfers

Our providers may process data outside your country. Where required, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. [CONFIRM WITH YOUR PROVIDERS.]

7. Retention

We keep your account and saved projects while your account is active. Deleted projects are removed from our database immediately [AND FROM BACKUPS WITHIN N DAYS]. Session records expire after 30 days. When you delete your account we delete your account data and projects [WITHIN N DAYS].

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to complain to your data protection authority. California residents have the right to know, delete and correct personal information and to non-discrimination; we do not sell or share personal information. To exercise your rights, email [PRIVACY CONTACT EMAIL]. You can delete individual projects yourself on the projects page, and your whole account (with every project) on the account page.

9. Security

We use encryption in transit (HTTPS), secure session cookies and access controls. The helper only accepts connections from this website and from your own computer. No system is perfectly secure; please keep your Google account protected.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal data.

11. Changes

We will post updates here and, for material changes, notify you before they take effect.

12. Contact

[COMPANY OR OWNER LEGAL NAME], [POSTAL ADDRESS] · [PRIVACY CONTACT EMAIL]