Draft pending legal review. Not yet reviewed by a lawyer.

Privacy Policy

Effective date: [Effective date]

This policy explains what personal data ChopVOD collects, why, who it is shared with, how long it is kept and the choices you have. ChopVOD is operated by [Operator legal name] (“we”, “us”), [Mailing address], which is the controller of the personal data described here. Contact: [Contact email].

In short: we collect what we need to sign you in, make your clips and bill you. Your video’s audio is sent to Groq for transcription; transcripts, chat replay, still frames and your clip feedback are sent to Anthropic so its AI can pick and title clips. We don’t sell your data, show ads or use tracking cookies.

1. What we collect

Account and sign-in

Your email address, and whether it has been verified.
If you sign in with Twitch or Google: the name, email address and profile picture that provider shares, your account ID with it, and the access and refresh tokens it issues at sign-in. We store the tokens with your account but don’t use them to read or post anything on your Twitch or Google account.
For each signed-in session: a session token, its expiry, and the IP address and browser user agent it was created from.
One-time sign-in links (they expire after 15 minutes).

Your videos and clips

The links you submit, the video files you upload and their file names, the creator name you type, and your layout and caption settings.
The time you confirmed that you own each video or have the creator’s permission to clip it.
What we get from the video: its title and length, an audio-only copy, a transcript, still frames, the moments chosen and why, the rendered clips and thumbnails, and each clip’s title, caption text and transcript excerpt.
Job records: status, errors, and processing statistics such as the game being played, how many chat messages were read and how much AI processing was used.

Public data from Twitch and YouTube

For links you give us, we fetch the public video and its information (title, channel name, game, length). For Twitch videos we also read the public chat replay and the channel’s most-viewed viewer clips (their titles, view counts and timing). Chat messages are written by other people and may contain personal data. We use only their text and timing, not the chatters’ usernames, to find highlights during the job (our legitimate interest in finding the best moments for the person who submitted the video), and we don’t keep the messages afterwards (only counts in the job’s statistics).

Your feedback on clips

How many times you download each clip, your thumbs up or down and the reason you pick, and the titles you rewrite (before and after).

Billing

Your plan, subscription status, billing period, video hours used and top-up balance, and a ledger of hour charges and refunds. Payments are handled by Stripe: you enter card and billing details on Stripe’s pages, and we never see or store your full card number. We keep the Stripe customer and subscription IDs linked to your account.

On your device

See section 5 (cookies and local storage).

Messages and logs

Emails you send us. Our hosting providers keep standard server logs (such as IP address, time, the page or API requested and the browser user agent), and our application logs record job processing.

We don’t collect government IDs or precise location, and we don’t use analytics or advertising trackers.

2. How we use it, and our legal bases

If you are in the European Economic Area, the UK or Switzerland, we rely on these legal bases under the GDPR:

To provide the Service (performance of our contract with you): signing you in, fetching and processing your videos, transcribing them, choosing and rendering clips, storing and delivering them, re-rendering renamed clips, metering your video hours, and billing.
To tailor clip picks to you (performance of the contract and our legitimate interest in making clips you want): your most recent feedback (up to 8 clips you liked or downloaded, 8 you rated down, with the reasons, and 5 title rewrites) is included when the AI picks and titles clips for your next jobs. It is used only for your own account.
To improve the Service (legitimate interests): we review feedback and processing statistics across users, such as which clips are kept or rejected and why, to improve how clips are chosen and titled. We don’t train AI models on your videos or clips.
To keep the Service secure and enforce our terms (legitimate interests): preventing abuse and fraud, handling copyright notices, and keeping records of rights confirmations.
To meet legal obligations: keeping tax and accounting records, and responding to lawful requests.

The only emails we send are sign-in links and messages about your account, plan or legal matters. We don’t send marketing email. The AI picks clips and writes titles automatically, but this doesn’t produce decisions with legal or similarly significant effects on you.

3. Who we share it with

We use these service providers (processors) to run ChopVOD. Each receives only what it needs, under its terms and data processing agreement with us:

Groq (speech-to-text): the audio of your video, and a short vocabulary hint made of the creator name, game and video title. When you rename a clip, the audio of that clip’s stretch is sent again.
Anthropic (AI that picks moments and writes titles): transcript text (around candidate moments, or the whole transcript in sections for videos without chat), samples of chat replay text, still frames from the video (also used to find your webcam in the Split layout), the video title, game and creator name, and your recent clip feedback. Anthropic does not receive the audio.
Stripe (payments): your email address and account ID, the payment and billing details you enter at checkout, and your subscription and purchase history.
Resend (email delivery): your email address and the sign-in link we send you.
Turso (database hosting): the account, job, clip, feedback and billing records described above.
Cloudflare R2 (file storage): uploaded videos, audio-only copies, clips and thumbnails.
Vercel (website and API hosting): every request to the site, including your IP address, and server logs.
Railway (processing servers): your videos and audio while they are downloaded and processed, and processing logs.

Twitch, YouTube and Google are not our processors. We request public videos, chat replay and information from Twitch and YouTube for the links you give us; those requests come from our servers, not your device. If you sign in with Twitch or Google, that provider handles the sign-in under its own privacy policy and shares your name, email address and profile picture with us.

We may also disclose data when the law requires it, to protect rights and safety, or as part of a merger or sale of the Service (in which case this policy continues to apply to your data). We don’t share your data for anyone else’s advertising.

[Confirm each provider’s data processing agreement, data retention and AI-training terms before launch.]

4. How long we keep it

Uploaded videos: deleted when the job fails or is canceled. When a job finishes, kept for the 48-hour editing window and deleted once it closes. An upload that never becomes a job is deleted after 24 hours.
Audio-only copy of each finished job’s video: kept for the same 48 hours, then deleted.
Working files on our processing servers (downloaded audio and video, frames, full transcripts, chat replay): deleted when each job ends.
Clips, thumbnails, clip titles, caption text, transcript excerpts, feedback and job history (including the links and file names you submitted and your rights confirmations): kept until you delete the clip, the job or your account. When you rename a clip, the previous version’s files are deleted.
Sessions expire after 30 days; sign-in links after 15 minutes.
Billing records: Stripe keeps payment records (invoices, receipts and the customer record they belong to) for as long as tax and accounting law requires, even after your account is deleted. Your plan details and video-hour history in ChopVOD are deleted with your account.
Server logs are kept by our hosting providers for their standard log periods.

You can delete a clip or a whole job from its page, and your whole account from the Account page. Deleting takes effect right away: the files are removed from our storage within minutes and the records from our database at once, and deleting your account also cancels your subscription and signs you out. Copies in our database provider’s backups expire on its backup schedule [confirm Turso’s backup retention period]. Payment records stay with Stripe as described above.

5. Cookies and local storage

Sign-in session cookie: keeps you signed in for up to 30 days. It is strictly necessary.
Short-lived sign-in cookies: set while you sign in with Twitch or Google, to protect the sign-in from forgery. Strictly necessary.
Local storage on your device: the new-clip form remembers the creator name you last entered for an upload and your Clean captions and Jump cuts choices, so you don’t have to set them again. They stay in your browser and reach us only as part of a job you submit. The rights confirmation is never remembered: you confirm it for every video.

We don’t use analytics, advertising or tracking cookies, and our fonts are served from our own site. Stripe’s checkout and billing pages are on Stripe’s site and Stripe sets its own cookies there, mainly to prevent fraud.

6. Your rights

Depending on where you live, you can ask us to: access your personal data, correct it, delete it, export it in a portable format, restrict how we use it, or object to processing based on our legitimate interests (including the use of your feedback to tailor clip picks). Where we rely on your consent, you can withdraw it at any time.

You can do the most common requests yourself, at any time: on the Account page, download your data (one JSON file with your account, sessions, jobs, clips with download links, feedback and video-hour history) and delete your account; on a job’s page, delete single clips or the whole job. You can also rename clips for 48 hours after a job finishes. For anything else (for example correcting your data, restricting or objecting to its use, or a copy of something the export doesn’t cover), email [Contact email] from the email address on your account (so we can confirm it’s you). We reply within one month (45 days for California requests), and tell you if we need longer as the law allows. You won’t be treated differently for using your rights.

If you are in the EEA, the UK or Switzerland, you can also complain to your data protection authority, though we’d appreciate the chance to help first.

California and other US states

In the last 12 months we have collected these categories of personal information, from you, from Twitch or Google when you sign in with them, and from the public videos you link: identifiers (email, account IDs, IP address); commercial information (plan and purchases); internet activity (sessions, use of the Service); audio and visual information (your videos and clips); and preferences inferred from your clip feedback. We use them for the purposes in section 2 and disclose them only to the providers in section 3 for those purposes. We do not sell or share personal information (including for cross-context behavioral advertising), and we don’t use sensitive personal information for anything beyond providing the Service. You have the right to know, delete and correct your personal information, and to not be discriminated against for using these rights. An authorized agent may make a request for you with your signed permission.

7. International transfers

Our providers process data mainly in the United States and in other countries where they operate, which may not be where you live. When we transfer personal data from the EEA, the UK or Switzerland to countries without an adequacy decision, we rely on the transfer safeguards in our providers’ data processing agreements, such as the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider participates in it.

8. Children

ChopVOD is not for children under 13, and we don’t knowingly collect their personal data. Teens aged 13 to 17 may use it only with a parent’s or guardian’s permission. If you believe a child under 13 has given us personal data, contact [Contact email] and we will delete it.

9. Security

All traffic to ChopVOD is encrypted with HTTPS. We don’t store passwords: you sign in with one-time email links or through Twitch or Google. Files are kept in private storage and served through links that expire, our processing servers authenticate to our API with a secret key, and access to production systems is limited to the people who run the Service. No system is perfectly secure; if a breach affects your personal data, we’ll notify you and the authorities as the law requires.

10. Changes to this policy

We’ll update this policy when what we collect or how we use it changes. If a change is material, we’ll tell you by email or in the app before it takes effect. The effective date above shows when it last changed.

11. Contact

[Operator legal name]
[Mailing address]
Email: [Contact email]