Privacy Policy

1. Information processed

• Account information: email address, authentication-provider identifiers, email-verification status, full name, country, profile-picture URL where supplied by Google, account timestamps and authentication metadata managed through Firebase Authentication, together with full name, country and legal-acceptance data stored in Cloud Firestore.
• Submitted content: uploaded video or audio, supported public video URLs, pasted transcripts and processing choices.
• Outputs: generated transcripts and post versions returned to your browser.
• Rights confirmation: a random job ID, confirmation timestamp and accepted legal-policy version. The confirmation record does not contain your submitted URL, content or IP address.
• Authentication and security data: Firebase Authentication processes signup, login, email verification, password reset, Google sign-in and session information. The application server verifies Firebase ID tokens for protected processing requests and temporarily processes a network address to enforce rate limits. The network address is converted into an in-memory, process-specific hash and is not written to confirmation or legal-request files.
• Legal-request information: information you voluntarily submit through a copyright, creator opt-out, counter-notice or privacy form, including name, email, URLs, explanations, declarations and signature.
• Blocked-URL records: normalized URLs, a reason, a random block ID and the time a URL was blocked after review.
• Diagnostic logs: limited server-console messages about errors and service operation. The code is designed not to intentionally write submitted content, legal-form contents or confirmation IP addresses into those messages, although the production hosting provider may capture console output.
• No payments or analytics: this build does not process payment-card information and does not include analytics or advertising services.

2. How information is used

Account information is used to create and secure your account, verify your email, reset or update credentials, complete your profile, display account details and authorize protected requests. Submitted content is used to process an authorized public link or temporary upload, create a transcript and generate the requested posts. Rights confirmations are retained to document acceptance of the applicable policy version. Security data is used only for authentication, rate limiting and abuse prevention. Legal-request information is used to investigate, respond to and enforce copyright, creator and privacy requests.

3. Service providers and platform requests

Firebase Authentication is used for email/password accounts, email confirmation, password reset, persistent sessions, Google sign-in and account deletion. Cloud Firestore stores full name, country and legal-acceptance profile records and, in production deployments configured with the Firestore legal backend, private rights confirmations, legal requests and blocked-URL records. Firebase Storage temporarily receives audio and video uploaded directly from your browser; the application server verifies the object, creates a short-lived access reference or registers a Cloud Storage reference with Gemini, and requests deletion after processing. When Google sign-in is selected, Google provides basic identity information to Firebase under Google’s terms. When AI features are enabled, submitted transcripts, media references and public YouTube URLs are sent to Google’s Gemini API for transcription and content generation. Where the Gemini Interactions API is used, this build requests stateless processing with store=false; Google’s remaining processing and retention practices are governed by its applicable terms.

The interface loads the Inter typeface from Google Fonts. A browser request to Google Fonts may disclose ordinary connection information such as an IP address and user agent to Google.

Third-party processing may occur in other countries and is governed by the relevant provider’s terms and privacy practices. The application does not claim that information remains in your country.

4. Retention and deletion

• Accounts and profile metadata: retained by Firebase Authentication and Cloud Firestore until the account is deleted or retention is otherwise required by applicable law or the relevant Google terms. Full name, country and legal-acceptance information are stored in a Firestore profile document. Passwords are handled by Firebase Authentication and are not stored in plaintext by this application.
• Authentication sessions: Firebase Authentication stores session credentials using browser-managed persistent storage and refreshes them while the session remains valid. Signing out removes the local session; signing out all devices revokes refresh tokens, while already-issued ID tokens may remain valid briefly until they expire.
• Processing URLs: ordinary processing URLs are held for the request and are not written to result or confirmation records. URLs submitted in legal requests or added to the blocklist follow the separate periods below.
• Uploaded media: uploaded directly from the browser to a private, user-scoped temporary path in Firebase Storage. The server requests deletion when processing succeeds, fails, times out or is cancelled. A maintenance sweep removes abandoned temporary objects after approximately 24 hours while the server is operating.
• Gemini media references: short-lived signed URLs or registered Cloud Storage references may be supplied to Gemini for transcription. Registered Gemini file references are submitted for deletion immediately after processing on a best-effort basis. Google’s own handling is governed by its applicable terms.
• Transcripts and generated posts: not stored as server-side result pages. They remain in the current browser tab’s memory and disappear when the page is refreshed or closed, unless you copy or download them.
• Rights-confirmation records: stored in the configured private legal-record backend and pruned after 168 hours during request-time or hourly maintenance cleanup.
• Rate-limit entries: held only in server memory and expire after approximately 15 minutes.
• Legal requests: stored in the configured private legal-record backend and pruned after 365 days during request-time or hourly maintenance cleanup, unless an operator separately preserves a record where legally necessary.
• Blocked URLs: retained until the restriction is reviewed and removed through the protected server-side administration command.

5. Cookies and browser storage

Firebase Authentication uses browser-managed persistent storage to maintain and refresh authentication sessions. Local storage is also used to remember the light or dark theme preference. Session storage may temporarily hold the email used for a verification-resend screen. Transcripts, generated posts and submitted media are not intentionally saved to local storage or session storage. No analytics or advertising trackers are included, so no nonessential-cookie banner is shown. A future deployment must update this policy and obtain consent where required before adding nonessential tracking.

6. AI training

Submitted media, transcripts and generated posts are not used by this application to train its own AI models unless a separate, explicit and optional consent mechanism is introduced. No such training opt-in exists in this build. Third-party AI processing remains subject to the provider’s terms and data controls.

7. Security

The application limits collected data, uses random identifiers, keeps legal and blocklist records outside public web routes in protected Firestore collections or restricted local files, applies authenticated access controls and rate limits, sends private API responses with no-store headers and requests deletion of temporary Firebase Storage media after processing and performs stale-object cleanup. No claim is made that the service uses end-to-end encryption, AES-256 encryption, or that every security risk can be eliminated. A production operator must configure HTTPS, server access controls, backups and hosting logs appropriately.

8. Your choices and rights

You can edit your name, country, email and password from account settings; sign out of all devices; request account deletion; avoid submitting content; close or refresh the page to clear browser-held results; and submit a privacy request below to ask about or request deletion of a legal-request record. Applicable law may provide additional access, correction, deletion, objection or complaint rights. The operator may need your account email, request reference or job reference to locate information, and may still be unable to locate browser-only results because they are not stored server-side.

9. Children

The service is not intended for anyone under 18 or below the legal age required to form a contract. Do not submit information about children unless you have a lawful basis and the submission complies with applicable law.

10. Changes

This policy may be revised when data practices or providers change. The effective date and policy version at the top identify the current version.