Privacy Policy

Account information includes your email address, account identifiers, profile name, authentication state, and onboarding preferences. If you join a waitlist, we record your submitted contact information and signup-interest state. Support correspondence includes the information you choose to send.

Project information includes names, ideas, briefs, production settings, references, creative direction, scenes, continuity decisions, prompts, and editing history. Uploaded images, text files, and PDF documents and their analysis results are processed to provide the selected features.

Usage and operational records include limited first-party product events such as signup, project creation, successful plan or prompt creation, prompt-copy actions, and coarse failure categories. Product analytics does not include prompt text, project ideas, reference contents, email addresses, or raw IP addresses. AI usage records include actions, outcomes, credit reservations and adjustments, provider usage and cost telemetry, and error/security logs. Billing records include subscription and customer identifiers, payment/event identifiers, plan and period information, and refund status. The application does not store full payment card numbers; payment details are handled by the payment provider.

We use information to authenticate accounts, save projects, perform requested AI analysis and planning, maintain credit balances and subscriptions, provide support, communicate about service matters, and protect the service. We also use limited information to manage signup availability and introductory-credit eligibility.

Depending on the law that applies, these purposes may rely on providing the service you request, legitimate interests in operating and securing it, legal obligations, or consent where required. Contact us to discuss a particular use of your information.

Supabase provides the authentication, database, and private file-storage integration. OpenAI processes the reference content and relevant project, scene, and prompt context needed for AI features you explicitly request. Generated results are saved in your project. Private storage does not mean selected content stays solely in storage when you request AI processing.

Polar processes paid checkout and subscription billing. ProdLocker receives the billing records needed to confirm subscriptions, provide credits, manage access, and support payment issues; it does not store full payment card numbers. Cloudflare Turnstile is integrated into signup and waitlist forms to help distinguish legitimate visitors from automated abuse; it processes browser and interaction signals under its own privacy terms.

Infrastructure and email services also process information needed to host and communicate about the service. External generation tools you independently choose are separate services governed by their own policies; ProdLocker currently prepares prompts rather than generating final videos through them. We may disclose relevant records when required by law or necessary to investigate misuse and protect rights.

ProdLocker uses necessary authentication cookies for sign-in and session continuity. A first-party security cookie stores a random device identifier to help prevent repeated introductory-credit abuse; it is not a hardware fingerprint. A separate first-party product-analytics cookie stores a random, opaque identifier for up to 30 days so we can measure anonymous landing, signup, and return patterns without fingerprinting or cross-site tracking. Optional Google Analytics is loaded only after you choose Allow; it measures page visits and selected product milestones. We do not send email, names, project ideas, prompt contents, reference contents, or private filenames to Google. You can change your choice below.

Browser local storage remembers dismissed onboarding tips, and session storage preserves AI-action feedback during navigation. ProdLocker does not use analytics for advertising or ad personalization. Turnstile and hosted payment pages have their own security and privacy practices. Blocking necessary cookies can prevent sign-in or promotional eligibility checks.

We use limited pseudonymous account, device, and network-related signals, claim records, and usage-protection events to reduce fraud and repeated promotional claims. These records are used for service protection, not advertising. Pseudonymous information can still be personal information and is handled accordingly.

Access controls and private reference storage limit access to project content. No system can guarantee absolute security. Do not send passwords, authentication codes, payment card details, or unnecessary sensitive material in support messages or reference uploads.

We retain information for the purposes described here, including maintaining your projects and account, resolving support issues, administering billing, and investigating misuse. Retention depends on the purpose, provider arrangements, and applicable obligations rather than a single fixed period.

Project deletion removes the project from the workspace and starts reference-file cleanup, which may remain pending. There is no self-service account deletion control; contact support for an account deletion request. We may verify that the request comes from the account holder before acting.

Limited financial, security, and pseudonymous promotional-claim records may remain after account deletion where necessary to prevent repeated promotional abuse, protect the service, maintain financial records, or meet legal obligations. Deletion requests do not imply immediate removal from all backups, provider systems, or records subject to retention obligations.

Providers may process information in countries other than your own. The protections and legal requirements may differ. Contact us for information about applicable provider arrangements and safeguards.

Depending on applicable law, you may have rights to access, correct, receive a copy of, delete, restrict processing of, or object to processing of your information, and to withdraw consent where processing relies on it. Contact support to make a request or raise a concern. Where applicable, you may also complain to the relevant data-protection authority. Requests remain subject to identity verification and lawful exceptions.

We may update this policy as the service and its data practices develop. The date above identifies the current version. We will provide additional notice where required for material changes.