Privacy Policy

AppToReel (“we”) is responsible for the personal data described here, as its controller. For anything about your data — a copy of it, a correction, a deletion — write to apptoreel.help@gmail.com and a person will answer. If you’re in the EU or UK you can also complain to your national data protection authority, and if you’re in California you have the rights described in section 7.

Account. Your email address, and either a password (stored only as a hash, by our authentication provider — we never see it) or a Google account identifier if you sign in that way.

Plan and balance. Which plan you’re on and how many credits you have.

What you make. For each video you render and each free graphic in your library: the hook, caption, format, the link the batch came from, what it cost, and when. Opening lines you didn’t pick are not stored.

Links you submit. The address you paste, and what we read from that page: its title, description and preview image.

Technical data. Your IP address and browser user-agent, used to apply rate limits and detect abuse. These are held only briefly, in memory, and are not built into a profile of you.

Screenshots you upload. If you upload your own screenshots instead of using a store listing, they are stored in a private bucket only the server can read, and a temporary link to them is given to the video renderer so it can build your video. Only your two most recent sets are kept — older ones are deleted automatically the next time you upload.

Screen recordings you add. If you add a screen recording, your browser makes a smaller, silent copy of it and only that copy is uploaded. It is stored in the same private bucket. To find its best moments it is sent to our AI provider (see below), and the video renderer gets a temporary link to it so it can cut those moments into your video. Only your two most recent recordings are kept — older ones are deleted automatically the next time you add one. Turn on Do Not Disturb before recording, so no notifications or personal details are in it.

Messages you send us. If you write to us through the contact form: your name, email address, the topic, the message and, if you add one, your app’s link — so we can answer. The message is stored with us and a copy is emailed to our support inbox (sent through Resend, received in Google’s Gmail), which is where we reply from.

Sign-up record. The free video is given once per email inbox. To check that, we keep a one-way fingerprint (a hash) of your email address — not the address itself. It stays after you delete your account, because that is its only job.

Payments. Plans and credit packs are paid for through Paddle, our reseller (see section 5). Card details go to Paddle, never to us. We keep what Paddle tells us about your purchases: your plan, its billing period and status, and your Paddle customer and subscription ids.

Bot check. Signing up, signing in and resetting a password run a Cloudflare Turnstile check in your browser, to tell people from automated sign-ups (see section 5).

This is the part worth being specific about, because it involves someone else’s servers. When you submit a link, our server fetches that page, reads its title, description and preview image, and discards the rest. That text may be sent to our AI provider to write the homepage preview’s hooks and the voice-over script of a video you render. We don’t store a copy of the page, and we don’t pass on anything about you to the site you linked to beyond an ordinary web request.

The homepage preview works without an account. For it we keep a short-lived cache of what we read, keyed by the website’s domain, so the same link pasted twice doesn’t cost a second fetch. That cache holds no personal data and expires within the hour.

To provide the service. Account, plan, drafts and submitted links — we can’t run the product without them. In GDPR terms, performance of our contract with you.

To keep it working and honest. Rate limiting, abuse detection and security logging, on the basis of our legitimate interest in not being knocked over or defrauded.

To meet legal obligations. Records of what you bought, as tax and accounting law requires. Paddle, as the seller of record, keeps its own.

We don’t sell personal data, and we don’t use it for advertising or profiling.

Supabase. Authentication and database — where your account, plan and drafts live.

Google (Gemini API). Our AI provider. It receives the text read from your link, your app’s screenshots and any screen recording you add, to write hooks and the script of a video you render and to find a recording’s best moments. During the beta we use the free tier of this service, under which Google may use what it receives to improve its products and people at Google may review it — so please don’t put anything private in a screenshot or a recording.

OpenAI. A second AI provider. It receives the text read from a link — on the homepage preview, to check a page against our content rules and write the preview, and as a fallback when a script has to be written without Gemini. It doesn’t receive your screenshots, recordings or anything about your account.

Video rendering and the voice. Amazon Web Services, Inc. — the render runs in our own AWS account, in Sweden — and ElevenLabs Inc., which reads the script aloud. When you render a video they receive the public screenshot links from your app’s store listing (or temporary links to the screenshots or recording you uploaded), the words on that draft and the script that is read aloud. Nothing about your account goes with them, and the finished video and the recording are stored by us rather than left with them.

Email. The emails we send you — confirming your address, resetting a password — go out through Google’s Gmail, and copies of contact-form messages reach our inbox through Resend. They receive your email address and the text of that one email, nothing else.

Payment provider. Paddle.com Market Ltd (Paddle), our reseller and merchant of record, which sells plans and credit packs to you on our behalf. It takes the payment, holds the card details and is responsible for them under its own privacy notice. We receive from it your email, country, what you bought, the state of your subscription and its Paddle customer id — never your card number.

Cloudflare (Turnstile). The bot check on the sign-up, sign-in and password-reset forms. It receives your IP address and technical details of your browser for that check, and nothing about your account.

Hosting. Our site and servers run on Vercel Inc. (hosting) and Supabase Inc. (database).

Each of these acts on our instructions only. Where data moves between countries — and with providers of this kind it usually does — the transfer relies on the standard contractual protections those providers publish.

Drafts, rendered videos, uploaded screenshots and screen recordings stay until you delete them or close your account (older screenshot sets and recordings go sooner, as described above). Messages you send us are kept for at most a year, then deleted automatically. The sign-up fingerprint is kept indefinitely, and it can’t be turned back into your address. Account records are kept while the account exists; records of purchases are kept only as long as tax or accounting law requires. Technical data used for rate limiting lives in memory and disappears within hours, or sooner when the service restarts.

You can ask for a copy of your data, correct it, delete it, restrict or object to how we’re using it, or ask for it in a portable form. Deleting a draft in the app removes it for good. To delete your account, write to apptoreel.help@gmail.com. Deleting it removes your profile, drafts, rendered videos, uploaded screenshots and the messages you sent us while signed in — everything except the sign-up fingerprint described in section 2. For anything else, write to apptoreel.help@gmail.com and we’ll respond within one month.

California. You can ask what categories of personal information we collected about you and why, ask us to delete it, and ask us to correct it. We don’t sell or share personal information as those words are defined under the CCPA, and we never have — so there is nothing to opt out of. Exercising any of these rights will not get you worse service or a worse price.

We only set cookies the site needs to work: the session cookie that keeps you signed in; a short-lived one (10 minutes) that remembers where to take you after signing in with Google; and one (15 minutes) that proves a password-reset link was opened, so the new password can be set. There is no analytics, advertising or third-party tracking on this site. If that ever changes, this policy changes first and you’ll be asked where consent is required.

Some pages load another company’s script, which may store what it needs to work under that company’s own privacy notice: the Cloudflare bot check on the sign-up, sign-in and password-reset forms, and Paddle’s checkout when you buy a plan or a credit pack. Neither is used for analytics or advertising here.

Traffic is encrypted in transit. Your data is isolated at the database level so one account cannot read another’s rows, and the balance and draft tables can only be written by our server — never from a browser. No system is perfectly secure; if a breach ever affects your data we’ll tell you and the relevant authority as the law requires.

AppToReel isn’t for anyone under 18. We don’t knowingly collect data from children, and we’ll delete it if we learn we have.

We’ll post material changes here before they take effect, with the date at the top updated. Questions or requests: apptoreel.help@gmail.com. See also our Terms of Service.