ReelFactory Privacy Policy

• You sign in to the app with a ReelFactory account (your email, with a six-digit code, or your Google account), and the app checks your subscription with our server. It sends your session, an anonymous identifier for your Mac (a one-way hash: never its serial number or hardware ID), the Mac's name, model and macOS version, and the app's version. Our server then sends the app the instructions its AI agents follow, encrypted for your account and that Mac.
• Usage statistics and crash reports, on by default and said when you sign in: what happened in the app (screens, steps, counts, durations, error codes, where in our code a crash happened), never your reels, scripts, prompts, brands, files, keys or the text of an error. Turn them off in Setup ("Share usage statistics and crash reports").
• Feedback you write in the app reaches us, with diagnostics only if you include them.
• The app checks for its own updates at our update address.
• Your reels, brands, chats and files stay on your Mac, in folders listed below. We never receive them.
• Claude runs through your own Claude setup. The app starts Claude Code on your Mac, signed in with your Claude account or running on your own Anthropic API key. Claude Code sends what each task needs to Anthropic, under your own agreement with Anthropic.
• Your keys are stored encrypted with your Mac's Keychain: the ElevenLabs key is sent only to ElevenLabs, an Anthropic API key only to Anthropic.
• The other connections the app makes (mostly downloading the free tools it needs, once) are listed in section 4.
• Payments go through Stripe, on Stripe's own pages. We never see your card details.
• The Site sets no cookies of its own and uses no analytics. Downloads are counted without a cookie or an identifier.
• We send no marketing emails: only sign-in codes, messages about your subscription and payments, and replies when you write to us.
• No advertising, no tracking across apps or sites, no data brokers. We don't sell personal data.

The app talks to our server (hosted for us by InsForge, with payments by Stripe) for these purposes only. Every request carries the app's version (for example mac/0.1.0), so the server can ask an app too old to work with it to update.

What for	What the app sends	What we keep, and for how long
Your account (signing in)	Your email address and the six-digit code we email you; or, if you sign in with Google, Google's sign-in (see below)	Your account (your email, and your name if Google gave one), until you delete it
Checking your subscription (when the app starts, about once a day, before each reel, after you sign in, buy or remove a Mac, and when the Mac wakes)	Your session; this Mac's device identifier: a SHA-256 hash of a fixed prefix and the Mac's hardware UUID (the UUID itself never leaves the Mac); the Mac's name as you set it in macOS (for example "Maya's MacBook Pro"), its model (for example Mac15,3) and macOS version; the app's version	The Mac's registration (those fields, and when we first and last saw it) until you remove the Mac or delete your account; a record of each licence issued (account, Mac, plan tier, status, times, app version) for 90 days after it expires
The agents' instructions (sent only to a licensed Mac)	Your session, the licence, the device identifier	A record of each delivery (account, Mac, licence, version, time) for 90 days. The text carries an invisible mark that identifies your account, so a copy shared without permission can be traced to it. Licences we refuse (for example a forged one or one from another Mac) are kept as security signals (account, device identifier, kind, reason) for a year
Subscribing (Subscribe in the app)	Your session, the two statements you ticked (that the app runs on your own Claude and ElevenLabs accounts; that you want access now, with no refunds, and give up the EU/UK withdrawal right), the price tier you were shown, the app's version	The statements as you accepted them (words, version, time, app version) with your subscription; your Stripe customer ID; your subscription's tier, price, status and billing periods. Stripe collects your card on its own page: we never see your card details
Managing billing	Your session	Nothing more (Stripe's portal shows your invoices and lets you cancel or change your card)
Your Macs (listed in Setup; removing one)	Your session, the Mac to remove	As above
Feedback (in the sidebar)	Your message and its kind (feedback, bug, question, billing), the app's and macOS's versions; only if you leave "Include diagnostics" on: a random install ID, the app's recent failures and the latest lines of its own log, with anything shaped like a key or token removed and your home folder and user name taken out of file paths (by the app before sending, and again by our server)	With your account, until you delete it. We reply in the same conversation
Usage statistics and crash reports (unless you turn them off)	A random install ID (made on your Mac, not derived from its hardware), the app's and macOS's versions, and events from a fixed list: the app launched or was used that day, account steps (sign-in shown, signed in, checkout opened…), licence checks and their problems, reels started and how they finished (a state, the stage reached, an error code, a duration), screens viewed (counted per day), updates, Feedback sent (its kind), unexpected errors as a code and an anonymous fingerprint, and crash reports as positions in our code (for example ReelService.start@app:out/main/index.js:120:7). Never reel content, scripts, prompts, brand names, file paths, keys, tokens or the text of an error. Sent signed in, so linked to your account	The events for 180 days, then only daily totals without your account; one record per install (account, first and last seen, versions)
Updates	The app asks our update feed (on InsForge's storage) for the newest version and downloads it, as any download does	Nothing in our own records; InsForge's request logs (below)

Signing in with Google. If you choose Google, Google asks you to share your email address and your basic profile (your name and profile picture) with ReelFactory. Our sign-in service keeps them with your account, and we use only your email address and name, to sign you in and run your account. We get no access to your Google password, emails, files, contacts or anything else in your Google account. We don't sell this information, use it for advertising, or share it except with the service providers in section 8.

Our server, like any server, sees your IP address with each request. InsForge, which hosts it, keeps its own request logs for security and troubleshooting, for the period its service sets. Our own tables don't keep your IP address (the Site's checkout keeps only a keyed hash of it, section 5), and we don't use it to locate or profile you.

Where	What
~/Library/Application Support/ReelFactory	The app's database (chats.db: your reels' and assistant's chats, including the text of tool results the agents produced, your brands and their profiles, ideas, jobs), your appearance choice, your Setup choices (setup.json: how Claude is reached, and the email of the Claude account you confirmed), a record of your Claude plan's usage levels (usage.json), the encrypted secrets (secrets/: your ElevenLabs and Anthropic keys, your ReelFactory session, your licence and the key to the agents' instructions), the agents' instructions as our server sent them, still encrypted (prose/), the usage statistics waiting to be sent (analytics/), the app's own short log (logs/, about a megabyte at most), the tools the app downloaded (tools/), fonts downloaded on demand (fonts/) and small helper scripts (bin/).
~/ReelFactory (your workspace)	One folder per reel and per brand: scripts, voiceovers, storyboards, scene code, renders, covers, captions, publish packs, and the pictures you attach.
~/Library/Caches/ReelFactory	Voice samples you played, so they play again instantly.
~/.claude/projects	Claude Code's own session transcripts for each reel and chat (written by Claude Code, not by the app; see section 4.1).
~/Library/Caches/ms-playwright	The headless Chromium that renders your reels, if you installed it.
macOS Keychain	The key that encrypts the app's secrets ("ReelFactory Safe Storage").

Notifications the app shows are local macOS notifications.

Besides our server (section 2), the app connects to other services only to do what you ask, with your own accounts. What it sends them goes straight from your Mac to them, under your own agreements with them: we don't receive, store or have access to it.

4.1 Anthropic, through your Claude Code

ReelFactory doesn't contain Claude or an Anthropic account of its own. It starts Claude Code on your Mac as the producer of each reel, its builder agents and the studio assistant. You choose in Setup how Claude Code reaches Claude:

• your Claude account: Claude Code signed in with it. If you ask Setup to install Claude Code, it runs Anthropic's official installer (downloaded from claude.ai); if you ask it to sign you in, it runs Claude Code's own sign-in, which opens Anthropic's sign-in page in your browser. The app sees your account's email and plan (from Claude Code), not your password;
• your Anthropic API key: stored like the ElevenLabs key (encrypted, see 4.2), given only to Claude Code for your sessions, which keeps it out of every command its agents run, and sent by the app itself only to api.anthropic.com, to test it when you save it.

Claude Code then sends to Anthropic what each session needs, which can include:

• the app's instructions for the agents;
• your reel's topic, script, style and notes, your brand's settings and profile, and your messages;
• the contents of files the agents read in your workspace, including pictures you attach and frames of your reels;
• the results of the tools the agents use;
• web searches and web pages the agents look up (for example trends for ideas).

The app also asks Claude Code for your plan's current usage, to show it to you.

Anthropic processes this under your agreement with Anthropic and its privacy policy, and your account's settings apply (for example whether your chats may be used to improve Anthropic's models, and how long they are kept). We are not a party to that relationship and don't receive any of this data. The app keeps your keys out of these sessions' work: the agents don't get the ElevenLabs key, Claude Code strips the Anthropic key from the commands they run, and the app blocks them from reading where either is stored.

4.2 ElevenLabs

The app talks to api.elevenlabs.io with your ElevenLabs key to:

• turn your script into a voiceover, with word timings;
• search the voice library and list your voices;
• play a voice's sample (from the sample address ElevenLabs gives), or read one short sentence in a voice when it has no sample (this uses your credits);
• add a library voice you pick to your ElevenLabs account, so your reels can use it;
• test your key when you save it (a tiny voiceover request, your voices and your subscription).

ElevenLabs processes this under your agreement with ElevenLabs and its privacy policy.

Your keys. The app stores the ElevenLabs key (and an Anthropic API key, if you use one) only encrypted, using macOS's Keychain (Electron's safeStorage), in ~/Library/Application Support/ReelFactory/secrets/, readable only by your user account. If the Keychain isn't available, the app refuses to store a key rather than store it in plain text. If you made the key file that the original skill used (~/.config/ai-video/elevenlabs.key or ~/.config/elevenlabs/key), the app reads it when it has no ElevenLabs key of its own. The keys are never logged and never shown in the app's window after you enter them. The ElevenLabs key is never given to the AI agents and is sent only to ElevenLabs; the Anthropic key goes only to Claude Code and Anthropic (4.1). Remove either in Setup at any time.

4.3 Other connections

• The free tools the app needs, downloaded once into its own folder when your Mac doesn't already have them: ffmpeg from its builder's site (ffmpeg.martin-riedl.de), Python from GitHub (python-build-standalone), numpy from the Python Package Index (PyPI), and the headless Chromium browser through Playwright's installer from Playwright's servers. Each file is checked against a fixed fingerprint. Those servers see the download request (your IP address and the file).
• GitHub: when a reel needs a font for a script the app doesn't include (for example Hebrew, Arabic or Chinese), the app downloads that Noto font from the Noto font project's repositories on GitHub. GitHub sees the request (your IP address and the font's name).
• Links in chats open in your default web browser, and so do Subscribe (our checkout, on Stripe), Manage billing (Stripe's portal) and signing in with a provider (its own page).

Nothing else: no third-party analytics, advertising or tracking services, and no data brokers.

• Browsing. The Site sets no cookies of its own and uses no analytics, advertising or tracking tools. Vercel, which hosts the Site, receives each request (your IP address, the page and your browser's details) and keeps its own request logs for security and troubleshooting, for the period its service sets.
• Download counts. Following the Site's download link records one event: the platform, a campaign tag if the link had one, your country (worked out by Vercel from your IP address, which isn't recorded) and the site that sent you. It has no cookie and no identifier, and it is kept like the app's usage statistics (180 days, then daily totals).
• Subscribing on the Site. Before checkout you tick two statements; we keep them (words, version, time, and that you ticked them on the Site) with your subscription. To stop one visitor holding many seats in a price tier, our server keeps a keyed hash of your IP address (never the address itself) with the seat it holds for you, until 30 days after the hold ends. Stripe, our payment processor, then collects your email, card and billing details on its own checkout page, which uses Stripe's own cookies under Stripe's privacy policy. We receive your email, what you bought, its price and status, and your Stripe customer ID, never your card details. A purchase on the Site joins the ReelFactory account with the same email when you sign in to the app.
• Writing to us. If you email support@reelfactory.dev, we receive your email address and what you write, and use it to answer you.

We send only service emails: your sign-in codes (sent for us by InsForge), messages about your subscription and payments (some sent for us by Stripe), and replies when you write to us. We don't send newsletters or marketing emails.

Where the UK GDPR or the EU GDPR applies, we rely on these legal bases:

• To perform our contract with you: your account and sign-in, the subscription checks, the agents' instructions, your Macs, your subscription and billing, Feedback and support, and the service emails in section 6.
• To meet our legal obligations: keeping records of payments for tax and accounting, and answering lawful requests from authorities.
• Our legitimate interests, which we have weighed against your rights:
  • keeping the app from being copied, shared or used without a subscription: the device identifier and the device limit, the mark in the agents' instructions and the security signals. They identify a Mac and an account, not what you make with the app;
  • keeping the app working and improving it: usage statistics and crash reports, with the safeguards in section 2 (no content, a fixed list of events, limited retention). They are on by default, the app tells you when you sign in, and you can turn them off at any time in Setup; that stops them at once and deletes what is waiting to be sent;
  • keeping the Site and our server secure and fair: our hosts' request logs, and the keyed hash that limits seat holds;
  • knowing how people find the app: the download counts, which identify no one;
  • establishing, exercising or defending legal claims.

You may object to any use based on our legitimate interests (section 12).

What the app sends to Anthropic and ElevenLabs (section 4) goes under your own contracts with them, as you direct when you use their services through the app.

We share personal data only with:

• service providers that run ReelFactory for us, under contracts that limit their use of it: InsForge (our accounts, database, storage and server functions, and today the sign-in code emails), Stripe (payments, invoices and the billing portal), Vercel (hosting the Site), and ImprovMX and Google (Gmail), which forward and store the emails you send to support@reelfactory.dev;
• Google, if you sign in with Google, as part of that sign-in;
• professional advisers (for example lawyers and accountants), under a duty of confidentiality;
• authorities, when the law requires it;
• a buyer of our business, or of its assets, who would take over this policy's commitments.

Stripe and Google also use some data for their own purposes (for example Stripe to prevent fraud and meet its legal obligations) under their own privacy policies. We don't sell personal data or share it for cross-context behavioural advertising.

What	How long
Your account, your Macs' registrations, your subscription record (with the statements you ticked) and your Feedback conversation	Until you delete your account (section 12)
Records of each licence issued and each delivery of the agents' instructions	90 days
Security signals (refused licences)	1 year
Usage statistics, crash reports and download counts	180 days, then only daily totals that name no one
The keyed hash of your IP address from a seat hold on the Site	30 days after the hold ends
Emails to support@reelfactory.dev	Up to 2 years after the conversation ends, unless you ask us to delete them sooner
Payment and accounting records (held in Stripe and our accounts)	As long as tax and company law require: in the UK, 6 years from the end of the financial year they belong to
Our hosts' request logs (InsForge, Vercel)	The periods their services set

We are in the United Kingdom. Our service providers process data in the United States (InsForge's servers for ReelFactory are in the US) and other countries where they operate (for example Vercel's global network and Stripe). When personal data goes from the UK or the European Economic Area to a country without an adequacy decision, we rely on the safeguards the law provides: the UK's data bridge and the EU-US Data Privacy Framework where the recipient is certified under them, and otherwise the European Commission's Standard Contractual Clauses (with the UK Addendum) or the UK International Data Transfer Agreement. Personal data from the EEA comes to us in the UK under the European Commission's adequacy decision for the United Kingdom. Write to us for more about these safeguards.

Your data stays in your user account's folders, protected by macOS. The app's secrets (your keys, your session, your licence) are encrypted at rest with the Keychain and their files are readable only by you. Our server's tables are closed to everything but its own functions, and the app reaches it over HTTPS. The app is signed with our Developer ID and hardened against tampering. Keep your Mac, your email account and your Claude and ElevenLabs accounts secure: anyone with access to your Mac's user account can open the app's files and your Claude Code transcripts.

In the app:

• Delete a reel in the app: its folder goes to the Trash and it leaves the app's database.
• Remove your keys (ElevenLabs, Anthropic) in Setup.
• Turn off usage statistics and crash reports in Setup: the app stops recording them and deletes what was waiting to be sent.
• Leave out diagnostics from a Feedback message (the switch under it).
• Sign out in Setup: the app forgets your session, your licence and the agents' instructions on this Mac. Signing out doesn't take the Mac off your account; Remove beside a Mac in Setup does.
• Remove everything the app keeps on your Mac: quit the app, delete the app, then delete the folders in section 3 that you no longer want (~/Library/Application Support/ReelFactory, ~/ReelFactory, ~/Library/Caches/ReelFactory, and the ReelFactory folders in ~/.claude/projects if you want Claude Code's transcripts gone too), and the "ReelFactory Safe Storage" item in Keychain Access.
• Data held by Anthropic or ElevenLabs: use their account settings and privacy tools.

What we hold about you. We hold your account, your Macs' registrations, your subscription record, your Feedback and support messages, and the usage statistics linked to your account (section 2). Depending on where you live (for example under the UK GDPR, the EU GDPR or US state privacy laws), you may have the right to:

• get a copy of that data (access), and receive it in a portable form;
• have it corrected if it is wrong;
• have it deleted;
• restrict how we use it, or object to our using it on the basis of our legitimate interests;
• withdraw any consent you gave;
• complain to a data protection authority.

To use any of these, write to support@reelfactory.dev, ideally from your account's email address, or use Feedback in the app. We may ask you to confirm the request from that address, so we know it is you. We answer within one month (or tell you within that month if we need up to two more months for a complex request), and we won't treat you differently for using your rights.

Deleting your account. Ask in Feedback or at support@reelfactory.dev. We cancel your subscription in Stripe and delete your account and everything kept with it (your Macs, licences, deliveries, subscription record, Feedback, statistics linked to you). What remains: Stripe's own records of your payments, which we must keep for tax (section 9), records of Stripe's events that name no one, daily totals without your account, and an install record that no longer names you. Deleting your account doesn't give a refund for a paid period.

ReelFactory accounts and subscriptions are for people aged 18 or over. The app and the Site are not directed at children, and we don't knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

We will post changes here with a new date at the top. If a change affects how we handle your data in a way that matters, we will tell you in the app or by email at least 30 days before it takes effect, unless the law requires it to take effect sooner.

Wayne Hsu Ltd, a company registered in England and Wales (company no. 16001721), is the controller of your personal data. Email: support@reelfactory.dev.

If you're unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the UK Information Commissioner's Office (https://ico.org.uk), or, if you live in the EEA, to the data protection authority where you live or work.