Legal Documentation
Privacy Policy
This Privacy Policy explains what information ReelDecode collects, why it is processed, how quickly uploaded media is deleted, and your privacy rights.
Last updated:
1. Overview & Data Controller
ReelDecode is operated by an independent developer based in the Republic of Korea for creators and businesses in the United States and worldwide. We treat privacy minimization as a core architectural constraint: uploaded source clips are deleted automatically after processing, full payment card numbers never touch our servers, and no third-party advertising trackers are embedded in the app.
Questions or privacy requests may be sent at any time to getreeldecode@googlegroups.com.
2. Information We Collect
- Account Identity: Your email address and authentication user ID supplied by Google OAuth through Supabase Auth. We request only standard email and basic profile identity—never access to your Gmail, Drive, or social accounts.
- Submitted Clips, Links & Brand Kits: Short-form video URLs you paste,
.mp4/.movfiles you upload, your Brand & Goal Kit entries (brand name, offer summary, target audience, pain points, voice samples, banned phrases, and proof assets), and the breakdowns and remix scripts generated for your account. - Billing & Waitlist Metadata: Plan tier, credit balance, Lemon Squeezy customer and subscription IDs, and waitlist email addresses when Founding Pass waitlist mode is active. Card numbers and tax billing details are collected directly by Lemon Squeezy.
- Operational & Security Telemetry: Salted one-way SHA-256 hashes of client IP addresses (never raw IP addresses in durable job rows), URL failure rate-limit counters, and processing duration / token metrics needed to keep the service reliable.
3. Source Video Deletion & Retention Schedule
ReelDecode deletes raw uploaded video files as soon as forensic extraction completes or fails, with an automated 24-hour backstop sweep for any abandoned upload:
| Data Category | Purpose | Retention Window |
|---|---|---|
| Uploaded .mp4 / .mov clips (temp-uploads) | Transient frame, audio, and metadata extraction for your job. | Deleted immediately upon terminal job status; swept automatically within 24 hours if abandoned. |
| Salted IP hashes & URL failure logs | Abuse prevention, burst controls, and quota protection. | Scrubbed (ip_hash set to NULL and attempt logs deleted) automatically after 7 days. |
| Breakdowns, remixes & Brand Kit | Persistent analysis history, Adopt Studio editing, and shares. | Retained until you delete items from History or request full account deletion. |
| Billing & subscription identifiers | Pro plan entitlement sync, auditability, and tax compliance. | Retained while account is active and as required by applicable accounting and tax laws. |
4. How We Use Data & AI Model Policy
We process your information solely to operate ReelDecode—authenticating your account, running shot/audio analysis, generating Adopt Studio remixes tailored to your Brand Kit, refunding credits on failed jobs, preventing automated abuse, and syncing subscriptions.
No Data Sales & No Public Model Training: ReelDecode does not sell personal information or share it for cross-context behavioral advertising. We do not use your private uploads, Brand Kits, or remix scripts to train public AI foundation models; multimodal analysis requests are sent over paid commercial API endpoints.
5. Subprocessors & International Data Transfers
To deliver low-latency service globally, ReelDecode stores and processes data on cloud infrastructure located primarily in the United States via the following subprocessors:
| Provider | Processing Role | Location |
|---|---|---|
| Supabase, Inc. | PostgreSQL database, Google OAuth session management, and private 24h temporary upload bucket. | United States |
| Vercel Inc. | Web application hosting, request routing, and scheduled cleanup cron execution. | United States & Global Edge |
| Railway Corp. | Isolated Python media analyzer worker for transient video inspection. | United States |
| Google LLC | Google OAuth identity sign-in and Gemini API multimodal analysis / script adaptation. | United States |
| RapidAPI Providers | Public short-form video URL metadata and stream resolution when URL mode is used. | United States |
| Lemon Squeezy, LLC | Merchant of Record payment processing, recurring billing, invoicing, and sales tax/VAT. | United States |
Notice for Users Subject to Korean PIPA & International Transfer Rules: Account emails, submitted URLs/clips, Brand Kits, and generated breakdowns are transmitted over encrypted TLS channels to our US-hosted cloud subprocessors (listed above) immediately upon your sign-in or job submission and retained per Section 3. Because ReelDecode relies on US cloud infrastructure to run, you may decline overseas transfer by discontinuing use and requesting deletion via getreeldecode@googlegroups.com.
6. Cookies & Browser Storage
ReelDecode uses strictly necessary authentication session cookies managed by Supabase Auth to keep you signed in, alongside short-lived browser sessionStorage values to resume a pending URL submission or MP4 upload immediately after Google OAuth sign-in. We do not use advertising cookies, retargeting pixels, or third-party behavioral analytics.
7. Security & Workspace Isolation
All network traffic is encrypted via HTTPS/TLS. PostgreSQL Row-Level Security (RLS) enforces strict per-user isolation on profiles, jobs, analyses, remixes, and Brand Kits, and temporary MP4 uploads use non-public buckets with time-limited signed URLs. Analyses remain private unless you explicitly copy and distribute a /s/[share_token] link.
8. Your Privacy Rights & Data Deletion
Depending on where you live—including US states such as California (CCPA/CPRA), the EEA/UK (GDPR), or the Republic of Korea (PIPA)—you have rights to access, correct, export, or delete your personal data without discrimination.
You can remove any individual breakdown from your History page at any time. To request a full export or permanent deletion of your account and all cascading workspace records, email getreeldecode@googlegroups.com from your registered address with subject Privacy Request.
9. Children's Privacy & Policy Updates
ReelDecode is not intended for anyone under 13 years of age (or under 16 in jurisdictions requiring higher consent age), and we do not knowingly collect information from children. We may update this Privacy Policy as our architecture evolves by revising the “Last updated” date above.