Privacy policy.

The data controller for shipcut.app is Sigreturn Labs, SASU, RCS Paris 104 567 854, 1 rue Marguerin, 75014 Paris, France.

You can browse the homepage, the demo video, and the marketing pages (Pricing, FAQ, About, Terms, Privacy) without an account. No personal data is collected from this browsing beyond standard server logs (see §5) and anonymous, aggregated usage metrics (see §6 and §7). No fingerprinting, no advertising pixels, no cross-site tracking.

To use the Service we ask for your email address. We use it to (a) create your account, (b) send single-use magic-link sign-in links, and (c) send rare transactional messages directly tied to your use of the Service (e.g. a failure notification). We never use it for marketing.

Magic-link tokens are stored hashed (SHA-256). The raw token is never persisted. Each token expires 15 minutes after issuance and is invalidated on first use.

Legal basis: performance of the contract you enter into by creating an account (Art. 6(1)(b) GDPR).

When you submit a video request we store: the URL you provided, the optional repository URL, your prompt, the chosen duration, and the rendered MP4 and its poster image. We also fetch the URL you provided and store the extracted public metadata (title, description, screenshot URL, headings) for the lifetime of that video record.

This data is associated with your account. It is visible only to you in your dashboard. If you decide to publish a video, the MP4 and the page at /v/<slug> become publicly accessible until you unpublish or delete it.

You can delete individual videos at any time from the video page (Delete this video), or all of them at once from the Account page (Delete all my videos). Deletion is immediate and permanent: the rendered MP4, the poster image, every correction (with its MP4 and intermediate workspace) are removed from disk. Used credits are not refunded.

Corrections to a video can be requested within 30 days of the original submission. Past that window, the intermediate workspace used to apply corrections is purged by an automated cleanup job, the video record's correction state is cleared in our database, and the public video itself stays accessible for viewing and download.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Our server retains standard request logs (timestamp, IP address, user agent, requested path, response status) for up to 30 days, then rotates them. These logs are used for security, abuse prevention and debugging. They are not joined with account data and are not shared with third parties.

Legal basis: legitimate interest in operating a secure Service (Art. 6(1)(f) GDPR).

We rely on a small number of vendors to operate the Service:

• Hosting: OVHcloud (Roubaix, France) — hosts the server, the database file and all rendered videos.
• Transactional email: Resend, Inc. (Delaware, USA) — delivers magic-link sign-in emails.
• Storyboard generation: a third-party AI provider receives your submitted prompt and the public metadata extracted from your URL, and returns a storyboard description. No account identifier is sent.
• Anonymous analytics: PostHog, Inc. (San Francisco, USA) — aggregated usage metrics (page views, conversion events) used to measure traffic and improve the Service. EU region: events are stored on AWS in Frankfurt (Germany). No account identifier or email is sent; events are linked only to a per-browser random ID. Session recording is disabled.
• Ads conversion measurement: Reddit, Inc. (San Francisco, USA) — when you sign up, subscribe, or render a video, we send Reddit a small server-to-server event so we can measure the effectiveness of any Reddit advertising campaign. The event includes a SHA-256 hash of your email address, your IP address, your browser's user-agent string, and, if you arrived from a Reddit ad, the click identifier Reddit appended to the link. No raw email and no other account data is sent. There is no Reddit tracker, pixel or third-party cookie on our pages.

We do not sell or rent your personal data, and we don't allow our sub-processors to do so either. Video rendering happens on our own hosting; the resulting MP4 never leaves our infrastructure unless you publish the video.

We set a single first-party session cookie, signed with our secret key. It keeps you logged in once you sign in, and — if you arrived via a Reddit ad — it also stores the click identifier Reddit appended to the link so we can attribute a later sign-up to that ad (see §6). It is set with HttpOnly, Secure and SameSite=Lax.

We use localStorage to remember your theme preference (light / dark / auto). That value never leaves your browser.

Our analytics sub-processor (see §6) sets one first-party cookie and one localStorage entry holding a random ID used to count unique browsers across sessions. The ID is not linked to your account or email, and is not shared with other sites. No advertising cookies.

Account data and generated videos are retained as long as your account exists. Magic-link records are deleted after their 15-minute expiry. Server logs rotate at 30 days. Intermediate generation workspaces used for corrections are purged 30 days after the original submission (the public video stays). If you ask us to delete your account, we delete personal data within 30 days, except where retention is required by law (e.g. tax or accounting in case of paid usage). For self-serve deletion of specific videos or all your videos, use the Delete buttons on the video page and the Account page.

Under the GDPR you may at any time exercise your rights of access, rectification, erasure, restriction, portability and objection. For per-video erasure or to wipe all your videos at once, use the Delete buttons on the video page and on the Account page — both act immediately. For full account closure or any other request, contact [email protected] from the email associated with your account. We will respond within 30 days.

If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), cnil.fr.

Most processing takes place within the European Union. Some sub-processors (e.g. our transactional email provider, the AI provider used for storyboard generation, and our ads conversion measurement provider) may process limited data outside the EU. In such cases we rely on the European Commission's Standard Contractual Clauses (or equivalent safeguards) for the transfer.

We will update this policy when our practices change. The "Last updated" date at the top will reflect the latest revision. Material changes will be notified to account holders by email at least 30 days before they take effect.

Privacy enquiries: [email protected]

General enquiries: [email protected]