Privacy Policy
This policy explains what Shorts Studio collects when you use it, why, who else handles it, and how you can see or delete it. We only collect what the app needs to make your videos, and we never sell your data.
1. Who we are
Shorts Studio is operated by David Teyu, in Singapore. Questions about privacy go to shortsstudio.help@proton.me.
2. Your account
Accounts are handled by Supabase, our sign-in and database provider. When you sign up we store your email address (or the details your sign-in provider shares, such as your name and email), a user id, and when you signed in. The data in section 3 is stored on our own server at Fly.io, in Singapore.
3. What we store for you
Each account has its own space. Other users can't see it.
- Projects and storyboards: titles, scripts, scene timings and settings.
- Media you make: finished videos, AI-made pictures and clips, voiceovers, AI-made music, and each video's title and captions (kept so the YouTube form can fill itself in).
- Media you upload: pictures, footage for the AI editor, long videos for "Clips from a long video", music, and the small copies we make of them (a low-resolution "watch" copy and a low-quality sound copy used for the AI to understand them).
- Saved characters: invented characters' names, descriptions and one AI-made portrait each.
- What the AI remembers about you: short facts you tell the assistant to remember (for example, your channel's topic). We never save passwords, keys or card numbers; the app is built to refuse them. You can ask the assistant to forget any fact.
- Your ratings: when you press 👍 or 👎 under the assistant's replies, we keep the rating, what you asked, a short note of what it made and any reason you type, so it learns what you like. They're kept with your account only and never shared with other users. Press the same thumb again to take a rating back.
- Your face and your voice (optional): see section 5.
- Spending log: one line per paid AI call (what kind of call, when, and its estimated cost), used to show your spending and enforce usage limits.
- YouTube connection (optional): a refresh token that lets the app upload videos to your channel. It is never shown on the page or written to logs.
4. Services that process your data
To make videos we send some of your data to these providers. They process it to provide their service to us.
| Provider | What we send | Why |
|---|---|---|
| Supabase | Your email address and sign-in details | Sign-in and accounts |
| Fly.io | Everything in section 3 | Running the website and storing your files |
| Google Gemini API | Your prompts and chat messages, scripts, the facts the AI remembers about you, your 👍/👎 ratings and reasons, picture and clip descriptions, character portraits used as references, the small watch and listen copies of videos you upload, your face-check recording, photos you mark as "This is me" and your voice-clone recording | Writing scripts, answering, web research, making pictures, clips, voices and music, understanding your footage, and the face and voice checks |
| MiniMax | Clip descriptions, and the AI-made pictures a clip starts or ends on (never your uploads or your face) | Making moving clips |
| fal.ai (including models by HeyGen, Kling and MiniMax that it runs) | Clip descriptions, the AI-made pictures a clip starts or ends on, and the AI-voiced lines a made-up presenter says (never your uploads, your face or your own voice) | Making moving clips and talking presenters |
| ElevenLabs | The script text to be spoken, lines spoken in your own voice clone, and the recording you make to clone your voice | Voiceovers, only if you choose an ElevenLabs voice; making and keeping your voice clone, only if you make one |
| Stripe | Your email, your account ID, what you buy, your billing address (country, and postcode or full address where tax rules need it), your tax ID if you give one, and the card or other payment details you type on Stripe's payment page (we never see your full card number) | Taking payments for plans and packs, renewals, invoices and Manage billing, and working out and collecting any sales tax, VAT or GST that applies where you live |
| Cloudflare Turnstile | Signals from your browser and device while you're on the sign-in page | Telling people from bots when you sign up or sign in |
| Cloudflare Workers AI | Picture descriptions | Free AI pictures in the free mode |
| Pixabay and Pexels | Search words taken from your script (never your name or files) | Finding free stock photos and videos |
| YouTube Data API | The video you choose to post, with its title, description and settings | Posting to your channel, only when you press Upload |
Uploaded footage is only cut, reframed, captioned and mixed. It is never sent to a picture or video-generating model, and nobody in it is animated or given new words, except as described in section 5.
5. Your face and your voice (optional features)
You can let photos of yourself move and talk. Because this uses your face, we treat it as biometric data and only turn it on after you give separate, explicit consent.
- The live check: you record a few seconds of webcam video reading random words. A small copy goes to Google Gemini, which checks that one live adult is on camera saying every word. The recording is deleted straight after the check.
- What we keep: one still image from that recording, used as your reference face.
- Approving photos: when you mark a photo as "This is me", it is compared with your reference face by Google Gemini. If it matches, we store a fingerprint of the file (a SHA-256 hash) so we know that exact photo was approved. A changed file is no longer approved.
- Not identity verification: this check stops someone using a photo or an old video, but it is not a guarantee of identity and we don't use it to verify who you are for any other purpose.
- Turning it off: "Reset" in the Your face panel deletes the reference still and every approval. Deleting a photo also deletes its approval.
You can also clone your own voice, so your videos are read in it. A voice is biometric data too, so it only happens after you tick a consent box and say a consent sentence aloud.
- The live check: you record yourself reading a consent sentence, four random words and a few sentences (30 seconds to 3 minutes). Google Gemini listens to check that one adult is reading it live, in their own voice. If it passes, the recording goes to ElevenLabs, which makes your voice clone.
- What we keep: the recording is deleted straight after cloning. We keep only the clone's ID at ElevenLabs, when it was made and your consent. The clone itself is stored by ElevenLabs in our account, and only your account can use it.
- Turning it off: "Delete my voice" in the Your voice panel deletes the clone at ElevenLabs. Closing your account deletes it too, and so does not using it for 60 days.
6. YouTube
Connecting YouTube is optional. We ask Google only for the youtube.upload permission, which lets us upload videos you choose. We can't read, change or delete your other videos, comments or channel details.
Shorts Studio uses YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.
You can disconnect inside Shorts Studio, which deletes our stored token, or remove our access at any time from your Google account's security settings.
7. Cookies
We use one sign-in cookie (or similar browser storage) so the app knows it's you and can load your own videos and pictures. The editor also keeps some of your work in your browser's local storage so it isn't lost on refresh. We don't use advertising or tracking cookies.
8. How long we keep it
- Your account data and media: until you delete them or close your account.
- Face-check recordings: deleted immediately after the check. Voice-clone recordings: deleted immediately after cloning; the clone stays until you delete it, close your account or don't use it for 60 days.
- Stock search results: cached for up to 24 hours, without your name.
- AI analysis of uploaded footage (transcripts, shot lists): kept with the video so you aren't charged twice, and deleted with it.
- Spending log: 24 months for billing and abuse prevention.
- Sign-up checks: so free credits can't be claimed again and again with new accounts, we keep a scrambled code (a salted hash) of the internet connection and of the email inbox each account first signed in with. We never keep the address itself. A connection's code only counts for 30 days. Both codes are kept after you delete your account, so deleting and re-creating an account doesn't bring free credits back. On their own the codes don't show your address.
- Backups: deleted data may stay in backups for up to 5 days before it is overwritten.
Our providers keep data under their own policies. For example, Google may keep API inputs for a limited time to detect abuse.
9. We don't sell your data
We don't sell or rent your personal data, and we don't use it for advertising. We share it only with the providers in section 4, or when the law requires it.
10. Children
Shorts Studio is not for anyone under 18. We don't knowingly collect data from children. If you think a child has an account, contact us and we'll delete it.
11. Your rights
You can:
- See what we hold about you, most of it directly in the app.
- Download your videos, pictures and projects.
- Correct or delete any of it, including closing your account.
- Withdraw consent for the face and voice features at any time.
Depending on where you live you may have further rights, such as objecting to processing or complaining to a data protection authority (in Singapore, the Personal Data Protection Commission). Email shortsstudio.help@proton.me and we'll answer within 30 days.
12. Security
Data is sent over encrypted connections, each user's files are kept separate, and secret keys stay on our servers. No service is perfectly secure; if a breach affects you, we will tell you as the law requires.
13. Changes
If we change this policy we'll update the date above, and for important changes we'll tell you by email or in the app before they take effect.
14. Contact
David Teyu · Singapore · shortsstudio.help@proton.me