Privacy Policy

What the product actually stores, mapped to the implemented data models:

• Account and auth: email, name, avatar URL, password hash, email-verification state, role/status, sessions (IP address, user agent, expiry), TOTP two-factor secrets, password-reset tokens, API keys (prefixes and scopes only in listings; full secrets never returned), OAuth client registrations, script-signing public keys.
• Creative work: projects (title, description, genre, format), screenplays and scenes, versions, revisions, characters, timelines, mind maps, mood and research boards, outline nodes, index cards, storyboards, budgets, breakdown items, comments with @mentions and reactions, bookmarks, share links, collaboration invites, teams and memberships.
• AI interactions: prompts, responses, usage counters, feedback signals, style profiles, and memories. AI calls are rate-limited, cached per prompt, and logged for usage tracking against plan allowances.
• Billing: subscription tier, status, period dates, provider customer/subscription ids, billing documents, refund requests, and status events. Card numbers are never stored by IDEOSCREEN; payment details go to the configured payment provider.
• Operational records: activity logs, audit logs, notifications and push subscriptions, support tickets and product feedback, export jobs and consent records (with timestamps and IP addresses).
• Cookies and sessions: strictly-necessary session, admin session, 2FA step-up, and locale-preference cookies (see Cookie Policy). Theme choice (idoscreen-theme) is kept in browser local storage, not in a cookie. There are no advertising or cross-site tracking cookies.
• Emails: verification, password-reset, and product notices sent through the email provider only when configured; sends are rate-limited (5 per minute per recipient).

We use data only to operate the service: authentication, editing and collaboration, AI features within plan limits, billing, support, security (abuse scanning, rate limiting, audit logging), and sending service emails. Model training on your content is opt-in only (see section 4).

Interim basis map, pending counsel: contract (accounts, creative work, billing), consent (analytics, marketing, AI training, third-party sharing, and other optional processing you toggle), legal obligation (billing records, copyright correspondence), and legitimate interest (security logging, abuse prevention). Counsel must confirm the final basis for each category and jurisdiction.

All tools live at Settings > Privacy and require sign-in. Every mutating call is CSRF-protected and rate-limited.

• Export (portability): list past requests with GET /api/privacy/export; file a new one with POST /api/privacy/export in json, csv, or pdf (10 requests per 15 minutes per user/IP; idempotency keys replay duplicates instead of doubling them). Download the bundle at /api/privacy/export/download?id=.... Each export carries a manifest (profile, preferences, API keys, consents, two-factor state) plus a completeness verification block so you or an auditor can confirm nothing is missing.
• Erasure: a two-step confirmed flow. Step 1 requests deletion (optional reason) and returns a confirmation token valid for 10 minutes. Step 2 confirms with that token. Erasure deletes API keys, 2FA secrets, reset tokens, preferences, notifications, push subscriptions, bookmarks, activity logs, AI interactions, memories, export jobs, webhooks, signing keys, proof records, your comments, and team memberships — reported back per scope, with legal holds refused loudly. Preconditions: cancel any active paid subscription first, and transfer or resolve shared-team and collaborator-content obligations first (both return HTTP 409 until resolved). Deleted projects pass through Trash with restore before permanent removal.
• Consent: toggle analytics, marketing, ai_training, third_party_sharing, and data_processing with immediate effect; every grant and withdrawal is timestamped with a full history (your Article 7 proof). The California "Do not sell or share my personal information" switch maps to withdrawing third_party_sharing. Withdrawing AI-training consent stops future training use; withdrawing strictly-necessary processing is not offered because the service cannot function without it.
• Access and correction: review sessions, API keys, OAuth apps, exports, and profile data from Settings; correct profile data there; contact support for anything you cannot change yourself.

Signed-in users can read the live timetable at GET /api/privacy/retention. The enforced defaults are: contact 365 days, auth 730 days, content 3,650 days, usage 730 days, billing 730 days, support 730 days, AI data 180 days, cookie data 90 days. Lifecycle policies add: user, project, asset, and version data 365 days; audit logs 730 days; billing records 730 days with never-delete-without-override; export history 90 days. Legal holds block deletion even past expiry, and erasure preconditions (active subscriptions, shared teams) apply as above. Counsel must approve final periods and the billing-record override procedure.

• Payment processing: the configured payment provider — Stripe, Dodo, or Cashfree (server PAYMENT_PROVIDER setting). The provider adapter creates customers, checkout sessions, portal sessions, and webhook verification; provider credentials come from environment secrets only. No provider is called during the free trial.
• Email delivery: Resend (api.resend.com), only when RESEND_API_KEY is configured; otherwise sending is a recorded no-op and the app keeps running. Default sender is the onboarding address unless EMAIL_FROM is set.
• Hosting and infrastructure: the operator's PostgreSQL database (Prisma), Redis (queues, rate limits, consent/export caches with in-memory fallback), and object storage (pluggable S3 or local adapter). The repository ships deployment targets for Vercel (CI workflow and project config), Fly, Docker, and Kubernetes — the actual data processor is whichever host the operator deploys to. Counsel must confirm the final hosting DPA.
• Explicitly not a processor: Supabase. The architecture record states there is no Supabase client, no Supabase environment variables, and no Supabase project configuration; the similarly named package in the dependency manifest is not wired to any data plane. Do not list Supabase in any customer-facing processor inventory.

We do not sell personal information. Sharing is limited to the processors above, collaborators you explicitly add or @mention, and disclosures required by law or to prevent abuse — each admin or support access flowing through authorization plus audit logging. Traffic is protected with session auth, CSRF tokens, rate limits, security headers, and secret-hygiene rules (no secrets in client code); OAuth client secrets and signing private keys are shown once.

IDEOSCREEN is not directed at children and has no age-gate in the current code; counsel must set the minimum age and parental-consent language. Material changes to this interim policy will be dated above and announced in-app; continued use after a change constitutes acceptance of the interim text until final counsel-approved terms replace it. Contact: the support form or support@videoscreen.app.