Privacy

What we keep

• Your account: your sign-in address and display name, kept by our sign-in provider, Supabase, and by us; your usernames, kept by us.
• Where your address is: your account's record, the address noted on a top-up you pay by hand, our directory of accounts, the record of a share if someone shares their credit with you, and Stripe, which receives it when you pay or save a card so that your receipt has somewhere to go, and which keeps its own payment records.
• Your money: every top-up, hold, charge and refund.
• Your files, if you choose FilmOpen Cloud. Your devices: their names and keys.

Our logs

We log everything our servers do, so that we can find and fix what goes wrong. That includes your own data: your address and names, the prompts you send, and the messages to and from AI providers on your credit. API keys are never logged. Very long messages can be cut, and a request that has logged a great deal stops logging its later frames.

We keep these logs for 90 days. That expiry is a policy applied by our storage, so they are deleted typically within a day after it. Cloudflare's own log view keeps them for 7 days. We cannot delete them for one person: they are not indexed by person.

One exception: audio. When you dictate through FilmOpen's live transcription, the raw audio you send is not written to our logs; we count it. When a call passes through us to a provider, its text and JSON, and the provider's, are logged as they are, with anything they carry. Of a binary answer, such as an audio file, we log its type, status and headers, never its body.

Who else receives your data

• AI and media providers, when you use them on FilmOpen credit: OpenAI, OpenRouter and the companies it routes to, xAI, fal, Atlas Cloud, ElevenLabs and Salad. They receive what you send them, and their own terms govern what they keep.
• Stripe for payments, Resend for the mail we send, Proton for the mail you send us, Cloudflare, on whose servers all this runs, and Supabase for sign-in.
• GitHub, for bug reports.

Bug reports

A report you send goes to a support box of ours, encrypted. Our site keeps the ticket and the messages written about it, never the recording: who sent it, when, which box holds it, which issue it became, its state, and anything you and we wrote to each other about it. It is linked to you for twelve months after the ticket closes, or a day after our last reply if that is later; then the link and the messages are removed. The original recording is kept until a scrubbed copy reproduces the problem. Otherwise, 30 days after your report or your last request that a person look at it, we ask the box holding it to delete it. The issue on GitHub, with its scrubbed copy, is kept for good.

Deleting your account

You can delete your account at any time from your profile. It is never refused.

What goes: your sign-in; the address and name on your account and your top-ups; your files on FilmOpen Cloud; your device names; your project names and locations; any voice you saved at ElevenLabs through FilmOpen; connected apps; your saved card. Your support tickets are anonymised at once, and any recording still held is asked to be deleted. Anything still running is stopped.

What stays:

• Our accounting records, kept under an internal id that no longer has your name or address on it: every top-up, charge and refund, so that our books still reconcile. Text entered in them, such as the reason for an adjustment, stays as written.
• The address on a share someone else made with you, in their records.
• Your usernames. A username is never freed, and it stays public.
• Any groups you owned, without an owner.
• Our logs, until they expire, as above. Stripe's own payment records, and what any provider already received.

Any credit you have left is lost. The page where you delete shows your balance first, with a link to request a refund.

A device still signed in may keep working until its current session expires.