Privacy policy

• Your video footage never leaves your computer. Your browser reads the clips from your disk, analyses them and renders your reels on your computer. Your clips are never uploaded.
• On Pro, we keep your finished reels. Each reel you finish is copied to our storage with Cloudflare, held in the European Union, so your library is there on a new computer or after your browser’s data is cleared. We keep up to your 300 most recent reels, and no more than 20 GB of them. They are deleted when you delete them, when you delete your account, and 30 days after your Pro plan ends. Section 4 says exactly what is kept.
• On the free plan, finished videos stay on your computer. They are kept in your browser’s storage and exported to a folder you choose. We never receive a copy.
• Some text about your clips does leave your computer. To plan and cut your reels, a language model is sent the words spoken in your clips, a short written description of what each clip shows, and the titles of your talking points. Never your audio, your video or a frame of it. Section 8 lists every call.
• We hold what a subscription needs: your email address, your plan and billing state, and counters that enforce plan limits.
• A reel you paste a link to is fetched by our server, passed to your browser, and not stored by us.
• We do not sell personal data, and we run no advertising or cross-site trackers.

ClippyOS is run by ApeTec Ltd, a company registered in England and Wales (company number 17065917), registered office 124-128 City Road, London, England, EC1V 2NX. We are registered with the UK Information Commissioner’s Office, registration number ZC202053.

UK data protection law (the UK GDPR and the Data Protection Act 2018) is our home framework, wherever you are. For the account, billing and usage data described here, we are the data controller.

Your footage is different. It is processed on your own computer and never sent to us, so we are neither its controller nor its processor. We never have it.

The finished reels we keep for a Pro account are ours to look after: we are their controller, and Cloudflare stores them for us as our processor, under its data processing agreement.

You can reach us about anything in this policy at hello@clippyos.com.

When you choose a folder, your browser reads the clips straight from your disk. Everything that happens to them happens inside your browser, on your computer. Open-source models running there transcribe the speech, find faces and scenes, score the picture, and write a short description of what each clip shows. The reels are rendered there too. The clip index, your library of finished reels and your drafts are kept in your browser’s storage on that computer.

What never leaves your computer

• Your clips and their audio.
• Your clip index and your drafts.
• Any frame or picture from your clips, except inside the finished reels a Pro account keeps (section 4).
• On the free plan, your finished videos.
• Your file names. Clips are referred to by a short code, such as “c12”.

What does leave, as text

• The words spoken in your talking clips, with their timings.
• A short written description of each clip the reels could cut away to, a sentence or two about what the picture shows. It is written on your computer by a model in your browser.
• The titles of your talking points and the phrases spoken in them.

This text goes to our server, which passes it to our language-model provider, Anthropic, and stores none of it. It is how the product finds your talking points and chooses what to cut to. Section 8 lists each call.

If you clear your browser’s data for ClippyOS, the clip index and your drafts are gone, and so is a free account’s library: we never had them. A Pro account’s library comes back from the copy we keep.

While you are on Pro, every set of reels you finish is copied from your browser to our storage, and every change you make to it is copied again. When you sign in on a computer that does not hold your library, or after your browser’s data was cleared, your browser reads it back from that copy. Nothing about this asks anything of you.

What is kept, for each set

• Every version of every reel, at full quality, exactly as it was rendered.
• The smaller preview of each version that your library plays, and the set’s cover picture. A version that was only ever made as a preview is kept as that preview.
• Where a reel has no full-quality copy that matches it (you edited it and have not exported it since, it was only made as a preview, or it still carries the free-plan mark), the reel’s picture without its captions, so it can still be exported at full quality.
• The set’s record: its name and date, how each reel is put together (which clips, by their short codes, at which moments, with which captions and styles), the words in its captions, the titles of its talking points, a small picture (128 pixels) of each clip its reels use, and, for a set made from a reference reel, that reel’s link, public caption, account name and track name. Never the reference reel’s video.

What is not kept

• Your clips, their audio, your clip index and your drafts.
• Any reel from a free account.

Where, and who can reach it

The files are stored with Cloudflare’s R2 storage in its European Union jurisdiction, which guarantees they are stored in the EU. They are private: there is no public link to any of them, Cloudflare encrypts them at rest (AES-256), and every copy in or out travels encrypted. Your browser reaches a file only through a link our server makes for your account alone, for that one file, valid for minutes. Our database (Supabase, see section 9) holds the list of what is kept for your account: each file’s name, size and fingerprint, and the dates. It holds none of the files.

How long

• Up to your 300 most recent reels, and no more than 20 GB. A reel counts once, however many versions it has. When a newer reel is kept and you already have 300, or your kept reels would pass 20 GB, the oldest is deleted from our storage, with all its versions. The copy in your browser is not touched.
• Deleting deletes. When you delete a set or a reel from your library, our copy is deleted at once. When you delete your account, every reel we keep for it is deleted before the account is.
• When your Pro plan ends, we keep your reels for 30 days and then delete them. If you come back to Pro within those 30 days, your library is as you left it.

We do not look at your reels, use them to train anything, or share them with anyone. They are kept only to show them back to you.

Account data

• Your email address and a password. The password is stored as a hash by our authentication provider, Supabase. It passes through our server on its way there and we never store it. We do not ask for your name.
• When you signed up and signed in, and the IP address and browser of each signed-in session, recorded by Supabase to keep you signed in and your account secure.

Billing data

• Your plan, your Stripe customer and subscription references, the subscription’s status, when the current period ends, and whether it is set to end. Pro is sold through Onelink, Stripe’s checkout, which is the merchant of record. Onelink collects your card, your name and your billing address on its own checkout page (it needs the address to work out the tax), and keeps the payment records as the seller, under its own privacy policy. We never see or store your card number.

Usage data

• When you used the free generate, and when you started each set (each press of Generate) and in which billing period. These are counts and dates. We record that you made a set, never what was in it. Beside them, what each set and each billing period has cost us to run, so the plan’s limits hold.
• A log line, with your account ID, when you sign up, verify your email, see the upgrade page, start a checkout, upgrade, downgrade or run a generate. These go to our hosting provider’s logs, not to our database.

Security data

• Counts of recent requests, keyed to your account, your email address or your IP address, and temporary blocks for repeated breaches. They stop sign-in guessing and abuse of the service.

Messages and error reports

• When something breaks, an error report to Sentry: the browser, the operating system, the page and the code that failed, plus timings from about one page load in ten. It never carries your footage, and the names of your clip files are taken out of it before it is sent. Your IP address is not stored with it.

Reference links

• The link of a reel you paste passes through our server to Apify, which fetches the reel. We do not store the link. When a set uses a reference, that reel is saved with the set in your browser, on your computer.

• To run your account: signing you in, verifying your email, resetting your password.
• To run your subscription: knowing your plan from Stripe and applying its limits.
• To send the emails the service needs: the sign-up confirmation, the welcome once your email is verified, password resets, notes about sign-up and reset attempts on your address, the Pro welcome, notices that a plan is ending, continuing, ended or paused, failed payments, and payments your bank asks you to confirm. Onelink sends your receipts, invoices and refund notices. We send no marketing email.
• On Pro, to keep your finished reels and give them back to your library on any computer you sign in on (section 4).
• To answer your messages and fix errors.
• To prevent abuse: rate limits, and the weekly limit on generations that stops resale of the service.
• To count how many people sign up, upgrade and generate, from the log lines above.

Our legal bases under the UK GDPR are the contract with you (running the product you signed up for), our legitimate interests (security, preventing abuse, fixing errors and understanding how the product is used), and legal obligations (such as keeping payment records). We make no automated decisions with legal effect about you, and we sell your data to no one.

When you paste the link to a public reel, our server asks our fetching provider, Apify, to fetch it. The video passes through our server to your browser and is not stored on the way. Your browser reads its cut timing, its text layout and the track’s name. Some frames of it go to the language model, as section 8 describes. We never store other people’s reels on our servers.

When a set you make used a reference, ClippyOS saves that reel’s video file with the set in your browser’s storage on your computer, so reusing the reference does not fetch it again. That copy stays on your computer and never reaches us. Deleting the set from your library deletes it. On Pro, the set’s record that we keep names the reel by its link, public caption, account name and track name. It never holds the reel’s video, and a set opened on another computer fetches the reel’s sound again from its link.

Some steps use a language model provided by Anthropic. Your browser sends the material to our server, which passes it to Anthropic. This is the complete list. For the first two below, the answer is kept for 30 days after it was last used, on our database, so the same clip is never read and paid for twice: the words a correction changed, and the talking points found with their titles and timings. Nothing else sent is stored.

From your clips, as text

• The words spoken in your talking clips, with their timings, to find where each talking point starts and ends. They are transcribed on your computer.
• The same words, with the places where a second transcription on your computer heard them differently, to correct misheard words.
• The words of each reel’s lines, to choose which words to emphasise and which to set in script.
• A short written description of each clip the reels could cut away to, with the titles of your talking points and the phrases spoken in them, to choose which clip to cut to and when. The descriptions are written on your computer. Clips are named by a short code, never by file name.

From the reference reel you pasted

• One frame of it, with its caption, to read the quote on its screen.
• One contact sheet of sixteen small frames of it, to read how its text is laid out.
• Its quote and any topic you type, to write fresh lines in its theme.
• The words spoken or sung in it, to correct misheard words, and facts about it (its length, cuts, camera movement and the track’s name), to explain what makes it work.

Never sent

• Your audio, your video, any frame or picture of your own footage, or your file names.

Separately, the reel link you paste goes to Apify (see section 7). Anthropic keeps what we send for up to 30 days to run its service, then deletes it. Under its commercial terms it may not train on it.

We share personal data only with the providers below, each for the one job stated, and never for their own advertising. None of them receives your clips. Only Cloudflare’s storage holds finished reels, and only a Pro account’s.

Beyond these, we disclose data only where the law requires it. If ClippyOS is ever sold, this policy binds the new owner.

We are in the UK, and most of our providers are in the United States. When personal data goes to a provider outside the UK, it is protected by the UK’s adequacy regulations (which cover the EU, and US companies certified under the UK Extension to the EU–US Data Privacy Framework) or by the UK International Data Transfer Addendum in that provider’s data processing terms. A Pro account’s finished reels are stored in the European Union. Cloudflare’s data processing agreement, part of our agreement with Cloudflare, includes the EU Standard Contractual Clauses and the UK Addendum for any access to them from outside the EU.

Each kind of data is kept only as long as its job needs. A daily job removes the short-lived rows, and deleting your account removes the rest at once.

Wherever you are, two things need no request. In Settings, “Download your data” gives you everything our server holds about your account as one file, including the list of the reels kept for a Pro account (each reel itself exports from your library), and “Delete account” deletes it all.

If you are in the UK or the EU, you have the right to a copy of your data, to have it corrected or deleted, to restrict how we use it, to object where we rely on our legitimate interests, and to receive it in a portable form. You can complain to the UK Information Commissioner’s Office at ico.org.uk, or to the data protection authority where you live.

If you are in the United States, we do not sell or share your personal information, and we do not use it for targeted advertising.

Your payment details are held by Onelink as the seller. Ask Onelink, at link.com, to see or delete them. Send any other request to hello@clippyos.com. We may ask you to write from your account’s email address so we know the request is yours.

• Sign-in cookies (Supabase) keep you signed in. The product cannot work without them.
• Layout cookies hold how many sets and reels your library and its set pages showed last time, as numbers with the ids of your account and sets and nothing you wrote, so those pages appear in their own shape while they load. They are sent only with your library’s pages.
• Settings, such as your light or dark choice, are kept in your browser’s local storage.
• Page analytics (Vercel Web Analytics) count page views, with the browser, device type and country they came from. They set no cookie, store nothing on your device and keep no record of you as a person.
• The models. Up to about 2 GB of open-source models, for speech, pictures and descriptions, downloaded from Hugging Face and kept in your browser’s storage. The download starts when you create an account or sign in on a computer. Your first audio montage adds about 1.5 GB more. The models run on your computer and send nothing back.
• Your work. The clip index, your library of finished reels (with the reference reel’s video, for a set made with one) and your drafts, kept in your browser’s storage on this computer. The clip index, the drafts and the reference reels never upload. On Pro, the finished reels are also kept by us, as section 4 describes.

You can clear all of this from your browser’s settings. Deleting a set from your library deletes its files. We use no advertising cookies and no cross-site trackers.

Everything between your browser and our servers is encrypted in transit. Passwords are hashed by Supabase. Card details go to Onelink, Stripe’s checkout, and never touch our systems. Access to production systems is limited to the people who run ClippyOS. Your clips are never on our systems, so a breach of them cannot expose your footage. A Pro account’s finished reels are stored privately with Cloudflare, encrypted at rest, with no public link. They are reachable only through a link our server makes for the account that owns them, for one file, valid for minutes. The keys that make those links are held only by our server and can reach only that storage.

ClippyOS is not directed at children and requires you to be at least 16 years old. If you believe a child has created an account, tell us at hello@clippyos.com.

When we change this policy, we publish the new version on this page and change the date at the top. Questions, requests or complaints: hello@clippyos.com.