Privacy Policy
Last updated: 2026-04-27
Cinerune is a browser-based ASCII video editor. This page describes what personal data we collect, why we collect it, who we share it with, and how you can remove it. It applies to cinerune.com, app.cinerune.com, and the Cinerune SDK when used against our hosted API.
1. Who we are
Cinerune is an indie project. For privacy questions, write to [email protected]. For deletion / data-access requests, see section 6.
2. What we collect & why
We collect the minimum needed to run the editor and your account.
| Data | Why | Source |
|---|---|---|
| Email address | Account login, password reset, transactional emails (verify, reset) | You, at sign-up |
| Password hash (Argon2id) | Authentication. We never see your plaintext password. | Derived from your password at sign-up |
| Refresh-session token (hashed) | Keeping you signed in across reloads | Issued at login, stored in an HttpOnly cookie + DB |
| Google account ID (when you use “Continue with Google”) | Linking the Google identity to your Cinerune account | Returned by Google OAuth |
| Favorites list (effect type IDs) | So your Favorites tab survives reloads | Set by you in the editor |
Approximate country (ISO code, e.g. DE) |
To decide whether to show the cookie/consent banner | Added to the request by our edge / CDN provider; we don’t store it |
| IP address (transient) | Anti-abuse, edge routing. Not retained beyond CDN/edge logs. | Inherent to any HTTP request |
What we don’t collect. We don’t track your browsing across other sites. We don’t store your video / image / project files on our servers — they live in your browser unless you explicitly upload them. We don’t sell data, we don’t share it with ad networks, and we don’t profile users.
3. Cookies
Strictly-necessary cookie, set by default:
-
cinerune_refresh— keeps you signed in.HttpOnly,Secure,SameSite=Lax. Lifetime: 30 days from last use. Removed when you sign out or delete your account.
Analytics cookies, set by Google Analytics 4 only AFTER explicit consent for visitors in the EU/EEA/UK/Switzerland (we read Cloudflare’s country header to decide whether to show the consent banner; we never store the IP or country on our side):
_ga— distinguishes unique visitors. 13-month TTL.-
_ga_QS214M15NZ— session state for our specific GA property. 13-month TTL.
For visitors outside those regions GA loads on first page-view, which matches default expectations. You can still set a permanent “reject” by clicking Reject non-essential on the banner from any EU IP — the choice persists in your browser’s local storage across regions.
Under the EU ePrivacy Directive, strictly-necessary cookies don’t require consent ( EDPB Opinion 04/2012); analytics cookies do. We honour both.
4. Sub-processors
These third parties process data on our behalf to deliver the service. Each is bound by their own privacy policy / data-processing addendum.
| Provider | Purpose | Where |
|---|---|---|
| Hosting & database provider | Hosts the API and stores user accounts | United States |
| CDN & edge-protection provider | Routes traffic, terminates TLS, blocks attacks. Passes through your IP and country. | Global edge |
| Transactional email provider | Sends verification and password-reset emails | EU / US |
| Google (only if you use “Continue with Google”) | OAuth identity verification | Global |
| Google Analytics 4 (only after consent in EU/EEA/UK/CH; default elsewhere) | Aggregate page-view + interaction analytics. IP anonymised at collection time (anonymize_ip: true). |
Global |
5. Where data is stored
Account data is stored in the United States. Edge traffic is processed globally by our CDN provider (TLS termination, DDoS protection). Email delivery goes through our transactional-email provider; once an email is queued there we no longer control where it’s relayed.
We don’t hold your media files. Projects you create live in your browser’s local storage and exported bundles are downloaded to your device.
International transfers. For users in the EU/EEA, UK, and Switzerland, transferring personal data to the United States constitutes a transfer to a third country under GDPR Chapter V. We rely on the EU-US Data Privacy Framework (and the UK extension) where the recipient is certified, supplemented by the EU Standard Contractual Clauses where required. You can request the names of current sub-processors and a copy of the relevant transfer terms by emailing [email protected].
6. Your rights
If you’re in the EU/EEA/UK/Switzerland, the GDPR / UK GDPR applies. You have the right to:
- Access — ask for a copy of what we store about you.
- Rectification — fix wrong data.
- Erasure — delete your account.
- Object — to specific processing.
- Lodge a complaint with your local data-protection authority.
To delete your account: sign in, open the account menu, and click Delete account. This wipes your user record, sessions, OAuth links, verification tokens, and favorites in one transaction. The action is irreversible.
For access / rectification: email [email protected] from the address registered to your account. We’ll respond within 30 days as required by GDPR Art. 12(3).
7. Retention
- Account data — kept until you delete the account.
- Verification + password-reset tokens — auto-purged after expiry (24h / 1h respectively).
- Session refresh tokens — 30 days from last use, then auto-revoked.
- Edge / CDN logs — managed by our CDN provider, typically days, not retained by us.
8. Security
Passwords are hashed with Argon2id. Refresh tokens are stored as a hash, not the raw value. The signing key for export-watermark verification is derived per-user via HKDF from a server-side master secret; no per-user private key is ever stored.
9. Changes
Material changes are announced on this page (the “last updated” date moves) and via in-app notice when registered users sign in.
10. Contact
[email protected] for anything privacy-related. [email protected] for everything else.