Privacy Policy

Last updated: 2026-07-28

1. What the service stores about you

• Account data — your email address and a password hash (argon2id; the service never stores your password itself).
• Credentials you create — API tokens (stored hashed) and browser sessions.
• Your content — media you upload or import, the projects you build from it, exports you render, and derived analysis artifacts (transcripts, scene markers, frame strips).
• Usage accounting — per-account storage and usage counters that enforce quotas.
• Operational logs — including client IP addresses, kept for rate limiting and abuse prevention.

2. What it is used for

Only to operate the service: authentication, editing and rendering your projects, enforcing quotas and rate limits, and preventing abuse. Your data is not sold and is not used for advertising or profiling.

3. Deduplicated analysis caching

Media analysis is derived purely from the bytes of a file and is cached by the file's content hash. If two accounts store a byte-identical file, they share one cached analysis result. What one account can never see is another account's projects, media library, or any information about who else holds the same file — the shared cache carries no account information.

4. Who else receives data

Email (address confirmation, password reset) is delivered through Resend (resend.com), which receives your email address and the message content. No other third party receives your data. The service fetches URL imports you explicitly request, from the destination you name, within a network allowlist.

5. Cookies

One signed session cookie, used solely to keep you logged in. No tracking or analytics cookies.

6. Retention and deletion

Your data is kept while your account exists. Deleting your account (a self-service action) removes your projects, media files, exports, tokens, sessions, quota records and account row. A cached analysis result shared with another account (see section 3) is removed when the last account referencing that content is deleted. Operational logs rotate on a short schedule.

7. Your rights

You can read and export your own content through the service itself at any time, change your password, revoke tokens and sessions, and delete your account without asking anyone. For anything else — correction of account data, questions about this policy, or a complaint — contact noreply@orccut.com. If you are in a jurisdiction with statutory data-protection rights (for example the GDPR), those rights apply and the same contact handles them.

8. Changes

Changes to this policy update the "last updated" date above; material changes will be announced on this page.