Privacy notice
This notice explains what RoundCut needs to run the service, where creator media goes, and how to remove it.
Effective 3 August 2026
Source VODs, review frames, and rendered clips live in user-scoped private storage. Browser access uses short-lived signed URLs.
Data we process
- Account identity from Supabase Auth: email, provider identity, and user ID.
- Uploaded gameplay media, extracted audio/frames, candidate metadata, edits, captions, and renders.
- YouTube and TikTok account identifiers, encrypted OAuth tokens, consent snapshots, and publishing status.
- Subscription, invoice, and entitlement status from Stripe. RoundCut does not store card numbers.
- Operational logs, job attempts, security events, and usage totals required to run and protect the service.
How we use it
We use this data to analyze uploaded gameplay, create requested exports, publish approved posts, enforce plan limits, prevent abuse, diagnose failures, and meet legal obligations. We do not sell creator media or train public models on it.
Retention and deletion
Workspace retention settings control raw VOD cleanup. Account deletion queues scoped deletion of media, connections, tokens, projects, and publishing metadata, except records we must retain for billing, fraud prevention, or legal compliance.
If you ever subscribed, we keep a one-way fingerprint of your email address (a SHA-256 hash, not the address itself). It is kept after account deletion and used only to prevent repeat free trials.
Service providers
Supabase provides authentication, PostgreSQL, and storage. Stripe handles payments. Google/YouTube and TikTok process account authorization and approved uploads. Deployment and email providers are listed in the production subprocessor register before launch.
Your controls
You can disconnect platforms, change retention, export key records, or request deletion from workspace settings. See the data deletion page for the exact process.