Privacy policy

Your account. When you sign in with Google, our sign-in provider Supabase passes us your email address, name and profile picture. We keep your email address and a user id, and use them to find your workspace and to contact you about the service.

Your workspace — on your computer. The scripts, prompts, scene plans, cast and library entries, job history, thumbnails and settings you create live on your own computer, in the agent's folder. Our server does not store them. When you open the studio away from that computer, our server passes your requests to it and its answers back to you, encrypted between our server and your computer, and keeps nothing of what passes through.

Workspaces created before this design are still kept on our server, apart from every other customer's, until you move them. Move workspace here on the account page copies yours to a computer of your choice and deletes it from our server.

Billing. Payments are handled by Stripe. We store your plan, its status and a Stripe customer reference. We never see or store card numbers.

Technical records. Server logs (IP address, requested address, time) and an audit trail of security-relevant events in your workspace, such as sign-ins, computers paired or removed, a workspace moved and plan changes. We keep them to run and protect the service. We do not log what your requests contain.

The studio runs through the agent, a program you install on your own computer. It keeps your workspace there and does the work there, so your data does not rest on our servers:

• Video and audio files are downloaded to, processed on and kept on your computer.
• Your provider accounts — your VideoExpress login, your Higgsfield sign-in and any API keys you add (OpenAI, the video reviewer, image search) — are stored encrypted on your computer by the agent, never on our disks or database.
• Calls to those services (generating pictures, clips and voices, writing scripts, searching for images) are made from your computer, so the services see your own connection, not our server.
• Your YouTube connection is stored on your computer by the agent, and uploads go from your computer straight to your channel.

If you remove the agent's data from your computer, those connections are gone. You can connect them again at any time.

We use your information to provide the service you signed up for, keep it secure, bill you and tell you about changes that affect your account. We do not sell personal data. We do not use it for advertising. We do not use your scripts, prompts or videos to train AI models. We share it only with the service providers listed below, and only as far as each one needs.

• Supabase: sign-in with Google and user identity.
• Google: sign-in, and YouTube if you connect a channel.
• Stripe: subscriptions and payments.
• Oracle Cloud: hosting of our sign-in, account and relay server, in India (Hyderabad). It holds workspaces only for customers who have not yet moved theirs to their computer.
• The generation providers you connect — VideoExpress, Higgsfield — with your own accounts, which the studio uses from your computer, on your instruction, to generate images, clips and voices. What you send them is governed by their own terms and privacy policies.
• OpenAI: only if you add your own OpenAI API key in Settings. That key is kept on your computer. It is used only to send the text of prompts and scripts you ask the studio to write or improve, from your computer. No credentials or media are sent.
• GitHub: hosts agent downloads and updates, so it sees the IP address of a computer fetching them.

Imanginable's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in data only to identify you. We use YouTube access only for the actions you ask for, such as uploading a video you chose to publish to the channel you selected, and never for advertising. People do not read this data, except with your permission, for security or to comply with the law.

A workspace on your computer is yours to keep or delete; we hold no copy. We keep your account (email, plan, paired computers) while your trial or subscription is active, and for 90 days after it ends so you can come back. A workspace still on our server is deleted 90 days after your plan ends, or as soon as you move it to your computer.

You can delete your account yourself at any time from the account page, and we remove it straight away. Server logs are kept for up to 90 days.

On the account page you can see your account details, remove any paired computer or AI-assistant access, and delete everything. For a copy of the data we hold, a correction, or anything else, write to simplemilagetracker@googlegroups.com. Depending on where you live (for example the EEA, the UK or India), you may also be able to complain to your data-protection authority.

All traffic to the service is encrypted with TLS, and the studio's traffic to your computer is encrypted again to a certificate made on your computer, which our server checks. Each computer you pair signs in with its own device token, which you approve and can revoke. No system is perfectly secure. If we learn of a breach that affects you, we will tell you without undue delay.

The service is for adults. It is not meant for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

If we change this policy in a way that matters, we will show a notice in the studio before the change takes effect. The date at the top shows when the current version was published.