Privacy Policy

ClipSpell is operated by Adrian Borislavov Tolev, an individual established in Bulgaria rather than a registered company, of ul. Vetrusha 5, Pavlovo, Sofia, Bulgaria. In this policy that person is “we”.

Privacy questions, and any request about your own data, go to clipspell@yahoo.com.

ClipSpell is operated from Bulgaria, so the law that applies is the General Data Protection Regulation (EU) 2016/679 together with Bulgaria’s Personal Data Protection Act. The supervisory authority you can complain to is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, kzld@cpdp.bg. Complaining to them costs you nothing and does not require you to ask us first.

There is no data protection officer and no Article 27 representative, and neither is required here. A DPO is mandatory under Article 37 only for a public authority, for large-scale systematic monitoring, or for large-scale processing of special-category data, and none of those describes this service. An Article 27 representative is for a controller established outside the EU; this one is inside it.

The legal basis for each use described below:

• Running the service — Article 6(1)(b), performance of a contract. Your email address and password hash, your workspace, your projects, scripts, renders and the credit ledger. All of it exists because you asked for an account and asked it to make videos; without it there is no service to perform. Consent is deliberately not cited for any of this, because consent you could withdraw while still expecting the product to work would be a fiction.
• Security and abuse prevention — Article 6(1)(f), legitimate interests. The sign-in throttle, the IP address recorded against a session, and the server logs in section 3. The interest is keeping accounts from being taken over by password guessing; the data is the minimum that makes a rate limit work, and section 9 says how long each part is kept.
• Records we must keep — Article 6(1)(c), legal obligation. Ledger rows retained after an account closes, where accounting or tax law requires them. Nothing else is held on this basis.
• Connecting a social account — Article 6(1)(b), and the platform’s own consent screen. The OAuth grant you give YouTube, TikTok or Instagram is a permission you hand to them, on their screen, and you can withdraw it there or here. What we then store under it — the sealed tokens and the account name — is contract performance: it is what posting on your behalf requires.
• A review you choose to write — Article 6(1)(f) to keep it, Article 6(1)(a) to show it. Keeping what you sent us is a legitimate interest: hearing from the people who use the product, which is why you were asked. Showing your words and the name you chose on the home page is consent, and only consent: it happens only if you ticked the box that says so, which is never ticked for you, and removing the review in Settings withdraws it at once.

Nothing else described on this page relies on consent as its legal basis, and none of it is profiling or automated decision-making with legal effect under Article 22. A review is read by a person before it is shown, never judged by a model.

This is not a template. Every claim below describes the ClipSpell codebase as it stands on the date at the top of this page: the database schema is the inventory of what is collected, the provider registry is the list of what leaves the machine, and the publishing adapters are the list of what a platform is asked for.

Where the truthful answer is “that is not implemented yet”, this page says so plainly rather than describing a control that does not exist. Sections 4, 11 and 14 in particular contain gaps stated as gaps.

One row per database table, because that is the honest granularity: if a column exists and something writes it, it belongs here.

users

Your email address, an optional display name, an optional avatar URL, and a password hash produced by scrypt at N=16384 — the password itself is never stored. Also the time your email was verified, when you were last seen, and created/updated timestamps. An mfa_enrolled_at column exists so that enabling multi-factor sign-in is not a migration; multi-factor sign-in is not implemented.

sessions

A SHA-256 hash of your session token, its expiry, and the time it was revoked. The token itself exists only in the cookie in your browser. Also the IP address you signed in from, where it can be honestly determined — an address behind a proxy that strips the header, or a loopback address, is left empty rather than guessed at, so the column is often null. The user_agent column is declared and nothing writes it: your browser string is not recorded against a session.

workspaces

Workspace name, URL slug, IANA timezone, default language, credit balance, and an optional monthly credit cap.

workspace_members

Which people belong to a workspace, their role, and who invited them.

notifications

What happened in a workspace that somebody should know about: a video finishing or failing, a publication succeeding, failing or going unconfirmed, a series pausing itself, a connected account the platform stopped accepting. Each row holds a short title, an optional one-line body, a link to the thing it is about, and whether it has been read. A notice about YouTube names the platform, never the channel, so nothing here outlives disconnecting it. Addressed to one person when it is their own work and to the whole workspace otherwise. Removed automatically after ninety days by the worker’s hourly sweep.

invitations

An address somebody invited to a workspace, the role offered, who sent it, when it expires and whether it was accepted or withdrawn. The invitation link is not stored: the table holds a SHA-256 of it, so the link exists only in the email. Accepted and withdrawn rows are kept rather than deleted, because who was invited to a workspace and by whom is the record of how somebody got access to it.

projects

Everything you asked for: title, the topic you typed, target platform, aspect ratio, language, target duration, template, tone, quality mode, caption style, voice choice, whether real photos may be used where they fit — and, if you supplied your own script instead of having one written, that script text. Plus a series id and, for a video a series made, a lower-cased copy of that series' brief.

script_versions

Each generated script document, the provider id and model that produced it, the version of the prompt used, the estimated duration and the word count. Versions are kept rather than overwritten, so regenerating does not destroy the previous result.

storyboards

Aspect ratio, style directive, generation seed and colour palette per storyboard.

scenes

Per scene: the narration text, the visual prompt or stock query, any on-screen text, camera move, crop, transition and music ducking, timings, the word-level timings measured against the recorded audio, state, failure reason, and credits spent.

assets

One row per stored file, with the provenance needed to answer a licensing question later: storage key, MIME type, size, dimensions, duration, content hash, origin, provider id, model, prompt, negative prompt, generation seed, source URL, licence and attribution text, for a licensed photo its credit (the file, its title, author, licence and page), the provider request id, and an original_filename column for uploaded files.

video_versions

The canonical timeline handed to the renderer, its content hash and duration.

renders

Storage keys for the output file, thumbnail and caption file; width, height, frame rate, size and duration; the full quality-control report and whether it passed; render time and failure reason.

jobs

State, progress, current stage and stage message, the job input, its result, the credit estimate and the actual spend, an error kind, the message shown to you, an operator-only error_detail visible in the admin job view, and a support error id.

job_steps

Per stage: attempt number, state, provider, model, cost, credits spent, and timings.

queue_messages

The queue payload for work waiting to run, its attempts, lease holder, deduplication key and last error.

credit_transactions

An append-only ledger of every credit movement: event type, signed amount, the balance after it, what caused it, and — for an administrative adjustment — who made it and why. There is no update or delete path.

credit_reservations

Credits held for work whose final cost is not yet known, the amount finally settled, an idempotency key, and expiry.

provider_usage

What an operation cost us at a provider: provider id, model, operation, token counts or units, our estimated and actual cost in millionths of a currency unit, latency, the provider’s request id, and whether the result was cached.

social_connections

One row per connected platform account. See “Connected accounts, tokens and disconnecting” below for the full field list, including how the tokens are protected.

publications

One row per attempt to publish one rendered file to one connected account: platform, state, scheduled time and the timezone you chose it in, the caption and hashtags, the privacy value, the made-for-kids declaration, for a post made straight to TikTok whether you allowed comments, duets and stitches and whether you disclosed it as promoting your own brand or as branded content, for a YouTube or Instagram post your answer, where you gave one, to whether it promotes your own brand or a brand paid for it, the platform’s submission and post ids and URL — for YouTube, deleted as section 8 describes, with the time they were deleted — attempt count, last error, and timestamps.

analytics_snapshots

The numbers a platform reports back about a post, re-fetched on a schedule and kept as a series rather than overwritten: views, likes, comments, shares, saves, reach, impressions, watch time, average watch time and, only where the platform reports it, a completion rate. Also the platform’s own post id, copied so a snapshot can be read without the publication row. Nothing here is derived or estimated — a figure the platform does not report is null, not calculated. For YouTube each reading is deleted once it is 28 days old, so a post’s series reaches back that far and no further, and all of them are deleted when the channel is disconnected, when you close your account, or 28 days after the post could last be read (section 8).

series

A standing brief that makes videos on a schedule: its name, the niche you wrote, the platform, aspect ratio, language, duration, template, tone, quality and voice, the times of day and weekdays and IANA timezone it runs on, which connected accounts it posts to, whether auto-publish is on, for each TikTok account it posts to directly the audience you chose and your answers on comments, duets, stitches and commercial content, for each YouTube channel it posts to, the visibility you chose for its videos, and its own state — including the reason it paused itself if three runs failed in a row.

series_runs

One row per scheduled slot: when it was due, which project and job it produced, its state, and — where it failed — the failure reason and a support error id, or the reason a slot was skipped without being attempted.

password_reset_tokens

A SHA-256 hash of a reset link, never the link itself, with its expiry and the moment it was redeemed — a link works exactly once. Also the IP address and browser user-agent the request came from, so that “who asked to reset my password?” has an answer; both are nullable, and an address that cannot be honestly determined is left empty rather than guessed at.

email_verification_tokens

The same shape: a hash of the link, its expiry, when it was used — plus the address the link was sent to, captured at the time so that changing your address afterwards cannot cause an old link to verify the new one.

auth_attempts

One row per sign-in or reset attempt, holding what was being limited — a lowercased email address, or an IP address — the flow, and whether it succeeded. This is the rate limit: both are recorded because limiting by address alone lets one password be sprayed across many accounts, and limiting by IP alone lets a distributed attacker grind one. A successful sign-in clears the history for that email address.

contact_messages

A message sent through the contact form: the address you gave to be replied to, an optional name, the message itself, and the IP address it came from, which is how the form is rate limited. If you were signed in when you sent it, your user and workspace ids are recorded too, so that "my renders keep failing" can be looked into — context, not ownership. This is the only table here that holds data from people who are not customers, because the form does not require an account.

reviews

A review you chose to write about ClipSpell: the star rating, your words if you wrote any, whether you ticked the box allowing ClipSpell to show your words and name on its home page and when you ticked it, and — only if you did — the name and the channel handle you chose to show. Also where it stands: waiting to be read, published, not published with the reason (spam, abuse or personal data — never the rating), and when and by which operator that was decided. Whether you have made a video is not stored here; it is checked against your renders each time a review is shown. Removing it in Settings erases the words, the name and the handle at once and keeps only the rating and the fact that it was removed; closing your account deletes it entirely.

review_prompt_dismissals

That you pressed “Not now” on the review prompt, and when, so that you are not asked again. Nothing else. Deleted when you close your account.

audit_logs

What an operator did across the installation, two things you do on the Billing page and the emailed acknowledgement of one of them, and each refund or dispute of a payment: the action, who did it, the workspace and object it was done to, and a metadata document. The columns include an IP address. Written by operator actions — an administrative credit adjustment, and a decision on a review (publishing it, not publishing it with the reason, or returning it to the queue), which records the review’s rating beside the decision — and by you in two places: when you tick the box asking for a plan to start as soon as you pay, which records the words you ticked and when; and when you withdraw from a purchase, which records the name and email address you gave for the acknowledgement, the plan, its Stripe subscription id, when it was bought and when you withdrew. Those two are the record of what you agreed to and what you asked for, which the refund depends on. And by ClipSpell itself: when it emails you the acknowledgement of a withdrawal, that it did and the address it went to; and when Stripe reports that a payment was refunded or disputed, so the operator sees it, the Stripe event, charge and invoice ids, the amount and currency, how many credits were taken back and how many had already been spent, and for a dispute the date its answer is due.

brand_kits

A logo, a watermark, colours and voice rules that a project can point at, materialised into a render by the pipeline. You create these in Settings → Brand, and the logo and watermark are files you upload; the image bytes live in object storage and this row points at them.

ad_projects

Ad Studio, which is not open to customers: only the installation’s operator can use it. A campaign set up there: its name, whether it is an ad, a promotion or a demo, what is advertised and its name, whether it is archived, who created it, and when it was created, changed or deleted.

ad_assets

Ad Studio (operator only): one row per file kept there — a picture uploaded as a source, and website captures, generated backgrounds and finished ads. The uploaded file’s name, the storage key, a SHA-256 of the exact bytes, the type decided from the content, size, dimensions, duration and frame rate, which file it was made from, what it is for and whether it was chosen, and where it came from: for an upload, who confirmed the right to use it and when; for a fetched file, the address it came from and when. The file itself is in private storage and is served only through a route that checks access on every request.

ad_briefs

Ad Studio (operator only): each saved version of a project’s brief, never edited afterwards — what was entered, the structured brief made from it, whether the built-in template or a language model wrote it and which model, the template’s version, a hash of its content, who saved it and when.

ad_jobs

Ad Studio (operator only): each import, website capture or ad-making job — its project, the brief version and its hash, the settings asked for, the files it reads, the request key and a hash of the request (so sending it twice is one job), its state and stage, attempts, lease and heartbeat times, the error shown (a code, a sentence, whether it is retried and a correlation id), its result, who started it, and timestamps.

ad_job_events

Ad Studio (operator only): a job’s history — each change of state or stage, each attempt and error, and when.

ad_job_steps

Ad Studio (operator only): which steps of a job are done and what each produced, so a retried job does not repeat them.

ad_provider_operations

Ad Studio (operator only): each request a job makes to an image generator, under a stable key — the provider, whether it is local or paid, the provider’s own id for the request, its state, the file it produced and any error — so an unclear outcome is checked rather than sent twice.

ad_usage

Ad Studio (operator only): what each job counted against the daily limits — the person and the job, the unit and quantity, whether it is reserved, used or given back, and an estimated and actual cost where one is known.

ad_capability_snapshots

Ad Studio (operator only): what the background worker last found it can do on this server — which kinds of job it runs and whether its tools, fonts, capture browser and image generator passed their checks — with the worker’s id and when it checked. No personal data.

ad_self_settings

Advertise yourself, part of Ad Studio (operator only): one row per workspace — the Ad Studio project its pictures, briefs and jobs belong to, the language its ads are written in, who set it up and when.

ad_platform_profiles

Advertise yourself (operator only): each version of this site’s own profile, which is read instead of asking the operator to describe the site — its version number, whether the built-in facts or a later reading made it, a hash of its facts, what changed from the version before, how many facts it holds and how many may appear in an ad, who made it and when. No personal data.

ad_platform_facts

Advertise yourself (operator only): the facts of one profile version — the site’s own sentences, claims, plans and prices, colours and fonts — each with whether it may appear in an ad, the words and figures an ad may use with it, the public pages that show it, and where it was read (a file of the code, a table, or the name of a setting, never its value). No personal data.

ad_platform_profile_assets

Advertise yourself (operator only): which kept files are the site’s logo and pictures in a profile version — the file, what it is for, its handle, the page and screen size it shows and the job that made it; for a screenshot or recording the operator added, who confirmed that it shows no personal data, no customer’s work and no other account’s items, and when.

ad_self_runs

Advertise yourself (operator only): each press of its buttons — the settings chosen and what they became, the profile version used, whether a language model or the built-in template wrote the concepts and which model, notices and errors as codes, counts and times of the work, the request key and a hash of the request (so pressing twice is one run), who pressed it and when.

ad_self_concepts

Advertise yourself (operator only): every ad concept proposed, kept so later ones differ — what it advertises, its angle, format and style, title, audience, opening line, message and call to action, the post text and hashtags made from them, the reason given, its scenes, how it was checked against the profile, and whether it was chosen, kept as a spare or dropped.

ad_self_items

Advertise yourself (operator only): the steps of a run, done one at a time — a page capture, a picture import, the concept step or one ad — with their order and state, the concept and brief an ad is made from, the job that does the step and any error as a code.

project_sources

For a factual video — the documentary, explainer, fast facts, list, mystery and news formats, a motivational, story or custom video whose topic names someone or somewhere in two words or more, or a year, and a product video whose topic is a dated history: a past year, a person, place, company or product named in two words or more, and how something was invented, founded, created or introduced, or began, or its history or origin, in no seller’s own words such as “our”, “your”, “new” or “introducing” — the text of the Wikipedia article its script was written against, the address of the exact revision that was read, and when it was fetched, so that a job which is retried reads the same article. Text published by Wikipedia, not anything about you, and erased with the rest of the workspace’s projects when its data is erased.

The schema declares tables for features that are not built. They exist so that switching a feature on is not a migration. No code reads or writes any of these, so they hold nothing. They are listed because a data inventory that quietly omits a table is the specific way this page could mislead — and because if one of them starts being written, this page has to change in the same commit.

• accounts — linked third-party sign-in providers — the web app implements only email and password
• idempotency_keys — no route stores an idempotency record yet

Four cookies, all strictly necessary, and one of them exists for a few seconds at a time.

vf_session is the one you normally have. It is httpOnly, SameSite=Lax, scoped to path /, marked Secure when the app is served over https, and lasts 30 days. It holds a random token; the database stores only its SHA-256 hash, so the cookie cannot be reconstructed from a database dump.

The second exists during a connect flow only. The social account connect flow keeps its PKCE verifier in a short-lived httpOnly cookie on our own origin, because the OAuth state parameter travels through the platform’s servers and must not carry a secret. It is named vf_oauth_<provider>, it is set on the response that redirects you to the platform and deleted on the one that brings you back, and it holds a random verifier rather than anything about you. It is only ever set for a provider that uses PKCE — Instagram Login does not, and leaving a verifier behind for a flow that will never present one would be a stray credential.

The third remembers which workspace you are working in. vf_workspace holds a workspace id and nothing else. It exists because accepting an invitation can put you in more than one workspace, and something has to remember which one you chose. It is not httpOnly, because it is a preference rather than a credential, and it carries no authority of its own: every request reads your memberships from the database and ignores this cookie if it names a workspace you are not in. Editing it can at most select another of your own workspaces.

The fourth remembers that you said “Not now”. Where this installation sends email, a signed-in account whose address is not confirmed sees a strip asking it to confirm the address, with a Not now button. vf_confirm_later is set only when you press Not now, holds your account id and nothing else, so that the strip stays away for that account and not for another signed in on the same browser, and lasts 30 days. Like the workspace cookie it is not httpOnly, because the page sets it, and it carries no authority: editing it can at most bring the strip back or hide it.

There is no consent banner, and all four cookies above are why you are not asked for one. Each is strictly necessary for something you asked for: one keeps you signed in, one stops an OAuth flow being tampered with while it is in progress, one remembers which workspace you opened, and one remembers that you asked not to be reminded yet. None is used to measure or follow you. There are no analytics cookies, no advertising cookies, no third-party cookies and no tracking pixels; the application loads no third-party front-end scripts and no remotely hosted fonts, so there is nothing here that consent would be the lawful basis for.

The note at the foot of the page says this, and asks for nothing. It has nothing to accept or refuse. When you press OK, your browser’s own local storage keeps vf_cookie_notice so that the note does not come back in that browser. It is not a cookie: it never leaves your browser, and our servers never read it.

That is a statement about this build, not a policy. Adding one analytics script, one embedded video, or one remotely hosted font changes the answer, and the change has to be made here in the same commit.

Two hosted AI providers have an adapter in this codebase, and each sends something only when the operator has configured a key for it.

Anthropic’s Claude models write scripts when the operator has configured an Anthropic key. Without one, a local language model running on the server writes them if the operator has enabled it, and a deterministic template writes them if not. Only the first of those three sends your script request to a third party; while research is switched on, the topic of a video that is looked up (a factual one; a motivational, story or custom one whose topic names someone or somewhere in two words or more, or a year; or a product one whose topic is a dated history: a past year, a person, place, company or product named in two words or more, and how something was invented, founded, created or introduced, or began, or its history or origin, in no seller’s own words such as “our”, “your”, “new” or “introducing”, as section 7 describes) also goes to Wikipedia when either of the first two writes it, and nothing is looked up for the template. The product records which one wrote your script rather than presenting any of them as another.

ElevenLabs synthesises narration. With no ElevenLabs key configured it is never called and the voice is local. With one configured it outranks the local voices, so your narration text is sent to ElevenLabs and the audio comes back from them. Neither this installation nor any default sets that key.

• The database. A PostgreSQL server on the operator’s own machine, in Bulgaria. It is not a managed service and no third party holds a copy. A production process refuses to start against an embedded development database; this installation runs as a development process, which is why that guard does not apply to it.
• Object storage. None. Rendered video, audio and images are written to a directory on the operator’s own machine, the same one the database is on. No bucket exists and no storage provider receives anything.
• Application hosting. The operator’s own machine, reachable at this address through a Cloudflare tunnel. Cloudflare therefore carries the traffic between you and that machine and can see the connection, as any network provider between two points can; it is not sent your account data to hold. Nothing is deployed to a hosting provider.
• Anthropic. Script generation only, on the terms in section 6, and only when a key is configured.
• ElevenLabs. Narration synthesis only, and only when an ElevenLabs key is configured — which on this installation it is not. With one set, the text to be spoken is sent to them and the audio is returned; nothing else about you goes with it. Section 6.
• Wikipedia (the Wikimedia Foundation). Factual videos only — the documentary, explainer, fast facts, list, mystery and news formats, and a motivational, story or custom video whose topic names someone or somewhere in two words or more (“Thomas Edison”, “West Orange”) or a year, and a product video whose topic is a dated history: a past year, a person, place, company or product named in two words or more, and how something was invented, founded, created or introduced, or began, or its history or origin, in no seller’s own words such as “our”, “your”, “new” or “introducing”, as the QR code’s is (“the factory problem Denso Wave invented it to solve in 1994”) — and only when a language model writes the script: the template writer reads no article, so nothing is looked up for it. The topic you typed, up to its first colon or question mark, is sent to Wikipedia’s public search to find the article the script is written against and checked against, and that article’s text is fetched back; a topic with nothing before the mark is not sent at all. When the part before the mark names nobody and the part after it opens with a name (“Real comebacks from history: Abraham Lincoln, who …”), that name alone is sent first. Nothing about your account is sent with it: no name, no email address, no account or workspace identifier. Any other product video, a story whose topic says it is made up (“A ghost story: …”), any other motivational, story or custom video, and scripts you paste, are never looked up.
• The platform you connect. When you connect a social account and publish, the rendered video, the title, the caption and the hashtags go to that platform. Sections 8, 9 and 10.

Three services worth stating precisely, because the honest answer differs for each.

• Stripe. Paid plans are sold through Stripe, so if you buy one, your card details go to Stripe and never to us: checkout and the billing portal are Stripe-hosted pages, and what comes back is a customer id, a subscription id, a status and period dates. There is no card number anywhere in the schema, and there is no field it could go in. Stripe is a processor in its own right and its own notice governs what it does with what you type on its pages.
• Email. The service does send email — a password-reset link, a password-changed notice, address verification, an invitation to a workspace, and the acknowledgement of a withdrawal from a purchase — through whichever provider is configured, which on a default installation is a console driver that prints the message to the server’s log and sends nothing. Where a real provider is configured, the recipient address and the message reach it. On this installation that provider is Yahoo: messages are sent from the operator’s own mailbox there, over an encrypted connection, so Yahoo receives the recipient address and the message as it would for any mail sent from that mailbox, and handles them under its own privacy terms. The reset page says which of the two is happening rather than leaving you waiting.
• Sentry. A DSN is accepted by the configuration and nothing reports to it. No error data leaves the machine.

We do not sell personal data, we do not share it for advertising, and we do not combine it with data from other sources.

ClipSpell uses YouTube API Services. By connecting a YouTube channel you are also agreeing to the YouTube Terms of Service, and Google’s own handling of your data is described in the Google Privacy Policy.

The TikTok adapter asks for user.info.basic plus exactly one posting permission, never both: video.upload when the deployment is configured to deliver drafts, or video.publish when it is configured to post directly. Draft delivery is the default, because it puts the video into your TikTok drafts and you tap publish in the app yourself.

From user.info.basic we read your TikTok open id and your display name, and we store both — the open id identifies the account to the API, the display name is what the interface shows you. If the display-name call fails the connection still works; it is a courtesy, not a requirement.

For a direct post, TikTok requires us to query your creator information first, because a private account genuinely cannot receive a public video. That response tells us your TikTok nickname, which privacy levels you may use, whether you have turned comments, duets or stitches off in TikTok, and your maximum post duration. We show it on the screen you post from and use it to decide what to ask for; the response is not stored. What is stored is what you choose on that screen: who can see the video, whether others may comment, duet and stitch, and whether it promotes your own brand or is branded content. A series keeps those answers for each TikTok account it posts to, because nobody is there when it posts.

On YouTube and Instagram, where you answer whether a video promotes your own brand or a brand paid for it, that answer is stored on the publication too, so the notice that it was posted can tell you which of the platform’s own labels to set.

For a direct post, what we send is the rendered video, the caption and the hashtags, with the answers above and TikTok’s AI-generated content label. A draft is the rendered video alone: TikTok’s draft upload carries no caption or hashtags, so you add them in TikTok before posting, and the final wording is yours. The video’s page in ClipSpell shows the caption ready to copy.

A TikTok application that has not passed TikTok’s content-posting audit is confined to posts only the creator can see. This deployment has not passed that audit unless the operator has said so in configuration, so direct public posting is not available and the product says so instead of offering it.

The Instagram adapter uses Instagram API with Instagram Login and asks for two scopes: instagram_business_basic, which identifies the account, and instagram_business_content_publish, which is the one that posts. Nothing about messages, comments or insights is requested — those are separate permissions and this product does not need them.

After the grant we read your Instagram user id, your username and your account type, and we store the id and the username. The account type is checked so that a personal account is refused at connect time with an explanation, rather than at the first failed post.

Instagram is the one platform that does not accept an upload: it downloads the file from a URL we give it. Publishing a Reel therefore means handing Instagram a link to your rendered video in our object storage, which Instagram’s servers then fetch. A deployment whose storage cannot issue such a link — local development disk, for instance — is refused by the adapter rather than sent a URL that cannot be reached.

Instagram’s publishing API has no per-post privacy setting; a Reel is as visible as the account is. Meta has not yet granted this application App Review for the publishing permission, so publishing works only for accounts that have a role — admin, developer or tester — on the operator’s own Meta app. Connecting any other account will not be able to post.

Plainly: very little expires on a timer. No project, render, job or ledger row is deleted by age, and a policy quoting a retention period for them would be describing a control that does not exist. What is swept is narrower and listed below: dead sessions, spent one-time links, notifications older than ninety days, contact messages after 24 months, data from YouTube that ClipSpell can no longer refresh, and each reading of a YouTube video’s figures once it is 28 days old.

What does exist:

• Every storage key encodes a lifecycle class, and the code declares the retention a deployment’s bucket lifecycle policy should apply to each: intermediate render artifacts 2 days, cache 30 days, and no expiry at all for source files, for regenerable derived files, or for your finished exports. Derived files carry no expiry on purpose — a bucket rule cannot tell whether a project still points at one, so removing them has to be driven from the database rather than from the clock. Those numbers are a declaration for the operator to configure at the bucket, not something the application enforces. There is no bucket on this installation — files are on the operator’s own disk — so no lifecycle rule applies and nothing is expired automatically. The classes above describe what a hosted deployment should configure, not what happens here.
• Session rows carry an expiry 30 days out and are not accepted after it. An hourly sweep in the worker then deletes them, with the periods read out of the code rather than described loosely: an expired or revoked session is removed 7 days after it died — the grace exists because a row revoked last night is the evidence behind “you were signed out on another device” — and rate-limit rows in auth_attempts are removed after 24 hours, which is longer than the longest limiting window and no longer. Spent and expired password-reset and email-confirmation links go on the same hourly pass.
• In-product notifications — a video finishing, a publication failing — are removed 90 days after they were written, on that same hourly pass. Long enough that “what happened to that video last quarter” still has an answer, and one of the few things in this section that expires on a timer.
• Messages sent through the contact form are kept until somebody has dealt with them and then kept after that, because “what did this person ask us three weeks ago” is a question with a real answer in a table and a shrug in a mailbox. Removed automatically after 24 months. The worker’s hourly housekeeping sweep deletes them, on the same pass that prunes expired sessions and old notifications. If you sent one and want it gone sooner, ask at the address in section 18 and say which; that one is done by hand.
• Data from YouTube is deleted when you disconnect the channel or close your account, within a few days of your withdrawing ClipSpell’s access at Google, and otherwise 28 days after ClipSpell last managed to refresh it — and each reading of a video’s view, like and comment counts 28 days after it was taken, newer readings staying — by the worker’s hourly sweep (section 8). This is a YouTube API Services requirement.
• Closing your account is a button now, in Settings. It signs out every device immediately, releases your email address so you could sign up again, clears your stored password, and closes any workspace where you were the only member. A workspace you share with other people keeps running without you — one person leaving must not destroy a colleague’s work. Every YouTube channel you connected is disconnected at once — in a workspace you share too — Google is asked to revoke ClipSpell’s access, and what ClipSpell obtained from YouTube for it is deleted. A review you wrote is deleted at once as well, so it leaves the home page that moment. This marks the account closed; it does not yet erase the stored bytes, which is the next item.
• A review you wrote is kept until you remove it in Settings, which erases its words, your name and your handle at once, or until you close your account, which deletes it. It is shown on the home page only while you allow it and only once a person has approved it.
• Erasure of the underlying rows and files is still a request to us, by email. Closing an account stops all access to it; a separate, deliberate step removes the projects, renders and media behind it, and nothing in this codebase does that on a timer. Saying otherwise would describe a control that does not exist.
• The credit ledger is append-only by design. If you ask us to delete your account, the ledger rows needed to answer a future billing dispute may be retained where the law allows or requires it, and we do keep them. It is the only record that can answer “what was I charged for” two years later, and it holds nothing about you beyond a workspace id, an amount, a reason and a timestamp — no name, no email, no address. Everything that does identify you goes with the account.

Because this service is operated from the EU, the GDPR gives you all of the following, whoever and wherever you are — they are not conditional on where you live:

• Access (Article 15). A copy of your personal data and the information on this page, confirmed against your actual rows rather than in general terms.
• Rectification (Article 16). Correction of anything inaccurate. Your name and email you can already change yourself, in settings.
• Erasure (Article 17), with one stated exception. Deletion of your account and its content. The exception is the publication record — what went out, to which platform, when — which section 12 explains is deliberately kept; say in your request if you want it gone as well and it goes.
• Withdrawing consent (Article 7(3)). The one thing here that rests on consent is showing a review you wrote. “Remove my review” in Settings withdraws it: the review leaves the home page at once, and its words and your name are erased.
• Restriction (Article 18) and objection (Article 21). You can object to the security logging described in section 3 and to our keeping a review you sent us, the two things here resting on legitimate interests. For the review, removing it in Settings is the same thing and takes effect at once.
• Portability (Article 20). Your data in a machine-readable form. In practice that is a JSON export produced by hand, because nothing in the product does it yet.
• Complaint to a regulator (Article 77). To Bulgaria’s Commission for Personal Data Protection, whose address is in section 1, or to the authority where you live. You do not have to raise it with us first.

How to exercise them: erasure yourself, the rest by email. Closing your account is a button in Settings, and it takes effect immediately — your sessions are revoked and any workspace where you were the only member is closed with it. A workspace with other people in it keeps running, because deleting their work when one person leaves would be the worse outcome; you are told which happened to each. Every YouTube channel you connected is disconnected at once — in a workspace you share too — Google is asked to revoke ClipSpell’s access, and what ClipSpell obtained from YouTube for it is deleted.

There is no self-service export, and for everything else — access, rectifying something, objecting, or a deletion that goes further than closing the account — write to clipspell@yahoo.com. Article 12(3) sets the deadline at one month, extendable by two further months for a complex request and only if we tell you why within the first month — that is the commitment, and it is the law’s rather than a number chosen here.

If you arrived from Instagram or Facebook and want the data tied to that connection removed, their apps send the request to our data deletion page, which reports what was removed and gives you a reference to quote.

One related gap worth knowing about: disconnecting a social account intentionally keeps the publication history, so a deletion request should say whether you want that removed too.

ClipSpell is a tool for people publishing video commercially or semi-commercially. It is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has an account, write to clipspell@yahoo.com and we will remove it.

The “made for kids” value stored on a publication is a declaration several platforms require about the video, which they refuse the upload without. It is not a statement about the age of the person using ClipSpell and we do not use it to profile anyone.

Your account, your projects and your finished videos are held on the operator’s own machine, in Bulgaria, and are not copied to any hosting provider. Script generation runs on that same machine, on a model installed locally — nothing you type is sent to an AI company. The tunnel that makes the site reachable is Cloudflare’s, so traffic passes through their network in transit.

What does leave it, and where it goes:

• Stripe, if you buy a plan. When you start a checkout, ClipSpell sends Stripe your workspace’s id and, the first time, your email address, which create the customer your payments are recorded against; what you type on Stripe’s own checkout page then goes to Stripe as well. Stripe is established in the United States, is a processor in its own right and publishes the transfer mechanism it relies on.
• Wikipedia, run by the Wikimedia Foundation in the United States: the topic of a video that is looked up (a factual one; a motivational, story or custom one whose topic names someone or somewhere in two words or more, or a year; or a product one whose topic is a dated history: a past year, a person, place, company or product named in two words or more, and how something was invented, founded, created or introduced, or began, or its history or origin, in no seller’s own words such as “our”, “your”, “new” or “introducing”) whose script a language model writes, as section 7 describes, with nothing about your account.
• Yahoo, which carries the mail this service sends: the recipient address and the message, as section 7 describes.
• The platform you publish to, if you connect a social account and publish: the finished video and its caption, in whichever country that platform operates.

For Stripe we rely on Stripe’s own data processing agreement, which incorporates the European Commission’s standard contractual clauses; Stripe publishes it and it governs what Stripe does with what you type on its pages. For a social platform the transfer happens because you chose to publish to it, and that platform’s own terms and privacy notice govern what it does with the video afterwards — we are not a party to that and cannot undertake it on their behalf.

This page is versioned with the code it describes. When a change to ClipSpell changes what is collected or where it goes, this page is meant to change in the same commit — the terms and the internal note at docs/LEGAL.md record which statements here are commitments made to a platform’s review, so that breaking one is visible.

Material changes are announced by a notice on this site, at least 30 days before they take effect, and the date at the top of this page moves with them. Not by email: the only mail ClipSpell sends goes to one person about something they or a colleague just did — a password reset or change, an address to confirm, an invitation, a withdrawal — and nothing in it writes to every customer, so a notice here is where to look.

Adrian Borislavov Tolev, ul. Vetrusha 5, Pavlovo, Sofia, Bulgaria, clipspell@yahoo.com.