Legal

Privacy Policy

Last updated: July 23, 2026

1. What we collect

Account information

When you sign up, we collect your email address and password (handled by our authentication provider, Supabase — we never see your plaintext password).

Content you upload

Video, audio, and image files you upload, the projects and edits you create, and any text prompts or instructions you give the AI editing features.

Usage & device information

Standard technical data collected automatically — IP address, browser type, pages visited, and similar diagnostic information — mainly for security (like rate-limiting abuse) and debugging.

2. How we use it

  • To operate the service: store your projects, render your exports, and keep your account working;
  • To power AI features you use — sending relevant content to the providers described in Section 4;
  • To keep the service secure — detecting and limiting abuse of paid AI features (see Section 3 of our Terms);
  • To communicate with you — service updates, security notices, and (only if you opt in) product news; and
  • To improve PoppyCut — understanding, in aggregate, how the product is used.

We do not sell your personal information, and we do not use your uploaded video/audio content to train our own AI models.

3. Who we share it with

We share data with the following categories of service providers, only as needed to run PoppyCut:

  • Supabase — authentication and our project database.
  • Oracle Cloud — application hosting and the video rendering pipeline that turns your edit into an exported file.
  • Cloudflare R2 — storage for your uploaded media.
  • Anthropic and OpenAI — process editing instructions and relevant content when you use an AI editing feature (see Section 4).
  • Deepgram / OpenAI Whisper API — transcribe audio to text when local transcription isn't available.
  • Pexels, Pixabay, Freesound — only when you search or import stock media from them; your search terms go to that provider.

We may also disclose information if required by law, to protect PoppyCut's or others' rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice to you).

4. AI processing, specifically

When you use an AI editing feature, we send the minimum content needed to fulfill your request — typically your written instructions, a text transcript of your video, and/or short metadata about your timeline — to Anthropic and/or OpenAI's APIs. As of this writing, both providers' commercial API terms state they do not use this data to train their models and retain API data only briefly (day-to-few-weeks scale) for abuse monitoring — that's their stated policy, which can change; see their own privacy terms for the current version.

Face detection (locating a face in frame, to help with shot framing) runs locally as part of our own processing — it is not facial recognition, does not identify individuals, and this data is not sent to any third party.

5. Retention

We keep your uploaded content and projects for as long as your account is active. If you delete a project, we remove its edit data immediately; underlying uploaded media files are cleaned up on our regular storage maintenance cycle. If you delete your account, we delete your personal data and content within 30 days, except where we're required to keep it longer (e.g. legal or security records).

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export a copy of your personal data, and to object to or restrict certain processing. You can delete individual projects from within PoppyCut directly. For account deletion or any other request, email us at neilsharma425@gmail.com and we'll handle it.

7. California rights (CCPA/CPRA)

If you're a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information for cross-context behavioral advertising. To exercise these rights, contact us at neilsharma425@gmail.com.

8. Children's privacy

PoppyCut is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us personal information, contact us and we'll delete it.

9. International transfers

PoppyCut is operated from the United States, and your information is processed there (and, for the third parties in Section 3, wherever they process data). If you're located outside the U.S., you understand your information will be transferred to and processed in the U.S., which may have different data protection laws than your country.

10. Security

We use reasonable technical and organizational measures to protect your data — including encryption in transit (HTTPS) and access controls on our infrastructure providers — but no method of transmission or storage is 100% secure, and we can't guarantee absolute security.

11. Cookies

We use a small number of strictly necessary cookies to keep you signed in (set by our authentication provider, Supabase). We do not currently use advertising or cross-site tracking cookies.

12. Changes to this policy

We may update this policy from time to time. If a change is material, we'll make reasonable efforts to notify you before it takes effect.

13. Contact

Questions, or want to exercise a privacy right? Email neilsharma425@gmail.com .