Privacy Policy

TheBoringApp LLC, a Delaware limited liability company operates theboringapp.com and is the controller of the personal data described here. You can reach us at admin@theboringapp.com.

This policy covers the website and the product behind sign-in. It does not cover any third-party site you reach from a link here.

Only what the product needs to work. In four groups:

Account

Your email address, and the account identifier our authentication provider issues. If you sign in through a social provider, we receive the email address and name it releases to us, never a password.

What you make

Prompts, scripts, clip descriptions and titles, project settings, any image you upload as a reference, and the metadata of the clips generated from them - status, timing, ordering, and the provider task identifiers.

Payments

A Stripe customer identifier, and a purchase ledger of which pack you bought, how many videos it granted, the amount, and when. Card numbers go to Stripe directly and never reach our servers.

Support and technical

Messages you send through the contact form, and ordinary server and analytics data: IP address, browser and device type, pages visited, timing, and error traces.

We do not collect special category data, we do not build advertising profiles, and there are no third-party advertising or social trackers on this site.

Under the GDPR and the UK GDPR, each purpose has a lawful basis. Ours are:

• Performance of our contract with you: creating and running your account, generating stills and videos, tracking your credit balance, taking payment, and answering support requests.
• Legitimate interests: keeping the Service secure and available, preventing abuse and fraud, understanding aggregate usage so we know what to build, and defending legal claims. We have weighed these against your interests and consider them proportionate to what the product does.
• Legal obligation: keeping the tax and accounting records that a sale creates.
• Consent: where we ask for it separately. You can withdraw it at any time without affecting what was done before.

We do not make decisions with legal or similarly significant effects about you by automated means, and we do not profile you for advertising.

This is the part that matters most in an AI product, so it is set out plainly.

• When you write or rewrite a prompt or plan a script, the text is sent to Anthropic and processed by a Claude model to produce the rewrite.
• When you generate a still or render a clip, the prompt, any reference image, and the continuity anchor from the previous clip are sent to Kie.ai, which runs the image and video models.
• When you export, the cut list is signed and your browser sends it to our stitching worker, which assembles the file and streams it back. The video does not pass through our application and the worker stores nothing.

We do not train models on your content, and we do not permit our providers to train their models on content we send them under our commercial terms. We do not sell your content or share it with anyone for their own purposes.

Generated clips are stored by the video provider, not by us. They are available for 13 days and are then deleted at source. We never hold a second copy of the video file.

These are our sub-processors. Each is bound by a data processing agreement and may use your data only to provide its service to us.

Clerk - authentication

Holds your sign-in identity, email address and session. United States.

Supabase - database and file storage

Holds the application database and the images you upload. United States, us-east-1.

Anthropic - language models

Receives prompt and script text for rewriting and planning. United States.

Kie.ai - image and video generation

Receives prompts and reference images, and stores generated media for the retention window. United States.

Stripe - payments

Receives your payment details directly and holds them as an independent controller under its own policy. United States.

Resend - transactional email

Receives your email address to deliver account email. United States.

Vercel - hosting and analytics

Serves the application and collects aggregate performance and traffic data. United States.

We will also disclose data where the law requires it, to respond to a valid legal demand, to enforce our terms, or to protect the rights and safety of people. If we are ever part of a merger or acquisition, data moves with the business and we will say so before it does.

Account and content

For as long as your account exists. Deleting the account deletes them immediately.

Generated video files

13 days from generation, held at the provider, then deleted at source.

Support messages

With your account, and deleted with it.

Payment and tax records

Up to seven years, because tax law requires it. These are records of a transaction and are held by Stripe and in our purchase ledger.

Deletion feedback

Indefinitely, and deliberately anonymous - the reason you gave, whatever you wrote, and three counters describing the account. It carries no name, email, or identifier, and cannot be linked back to you.

Server logs

Short-lived operational logs at our hosting and infrastructure providers, on their own rolling schedules.

Encrypted backups of the database may hold a copy of deleted rows briefly until the backup ages out of rotation. Nothing is restored from a backup to reinstate deleted data.

Settings has a delete button. It is not a request queued for review - it runs immediately, and there is no grace period and no undo.

When you confirm it, in this order: your reason for leaving is recorded without anything that identifies you; every image you have uploaded is removed from storage; your sign-in is deleted at our authentication provider so the account can never be signed into again; and your database rows go, taking your projects, clips, scripts, credit history and support tickets with them.

What survives is the anonymous deletion feedback, and the payment records that tax law obliges us and Stripe to keep. Nothing in either can be joined back to you through our systems.

Unused credits are forfeited on deletion. If you have a balance and want it refunded rather than lost, email us before you delete.

Depending on where you live, you have some or all of these rights. We honour them for everyone, wherever you are:

• Access: a copy of the personal data we hold about you.
• Correction: fixing anything inaccurate. Your email address can be changed from your account.
• Deletion: erasure of your account and its contents. Self-serve, from Settings.
• Portability: your data in a structured, machine-readable format.
• Objection and restriction: to processing based on our legitimate interests.
• Withdrawal of consent: at any time, where consent is the basis.
• Non-discrimination: exercising any of these never changes the price you pay or the service you get.

Use the delete button for erasure. For anything else, email admin@theboringapp.com from your account address and we will respond within thirty days.

For California residents: in the twelve months before this policy's date we collected the categories described above, for the business purposes described above. We do not sell personal information, and we do not share it for cross-context behavioural advertising - so there is nothing to opt out of. We do not knowingly collect data from anyone under 16.

For residents of the EEA and the UK: you may lodge a complaint with your local supervisory authority. We would rather you told us first.

We are based in the United States and our processors operate there. If you use the Service from outside the United States, your data is transferred to and processed in the United States.

Where data leaves the EEA or the UK, the transfer is covered by the European Commission's Standard Contractual Clauses and the UK Addendum in our agreements with the processors involved, together with the technical measures described below.

There is no cookie banner because there is nothing here to consent to beyond what the site needs to function.

• Strictly necessary: the session cookies our authentication provider sets to keep you signed in, and the security cookies that go with them. The Service does not work without these.
• Analytics: privacy-preserving, aggregate measurement from our hosting provider. It records page views and performance, not identity, and does not follow you to other sites.

We set no advertising cookies and run no third-party ad or social pixels.

Data is encrypted in transit with TLS and at rest by our database and storage providers. Access to production data is limited to the people who need it and is authenticated individually.

Provider callbacks are authorised per resource with signed URLs, webhooks are signature-verified, and generated media URLs are checked against an allowlist before they are stored.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant regulator within the time the law requires.

If you have found a vulnerability, email admin@theboringapp.com and we will work with you. Please do not test against other people's accounts.

The Service is not for anyone under 18, and we do not knowingly collect personal data from children.

If you believe a child has given us data, email admin@theboringapp.com and we will delete the account and its contents.

We will update this policy as the product changes. The version and date at the top always identify the current one.

If a change materially affects how we handle your personal data, we will tell you by email or in the product before it takes effect.