Privacy policy

This policy covers two things, and each section says which it is about. "The free local tool" is the tool you install and run on your own machine, together with this website. "The paid service" is the vfrey console, its API, the remote MCP server, and the worker that posts for it. Sections with no label apply to both. It is written for the Australian Privacy Act 1988 (the Australian Privacy Principles, APPs), the EU and UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA).

The organisation responsible for your personal information is {{LEGAL_ENTITY}} (ABN {{ABN}}), {{POSTAL_ADDRESS}} ("vfrey", "we"). You can reach our privacy contact at privacy@vfrey.ai.

For personal data that you put into vfrey about other people, such as mail recipients and files your team syncs, we act as your processor. See the Data Processing Addendum. For creator profiles in the research index we act as a controller. See the Creator Data Notice.

This policy does not change the privacy notices of YouTube, TikTok, Meta, Reddit, Stripe or Supabase.

The free local tool handles the things a run is made of:

• your accounts and series settings, and the platform keys you give it;
• topics it reads from official feeds, and the scripts, titles and hashtags written for them;
• the rendered video and its transcript;
• the history of each run: its status, timing and any error.

This website handles very little. See "This website" below.

On your machine. Runs, settings and history are kept in one SQLite file, ~/.vfrey/pipeline.sqlite. Rendered videos are ~/.vfrey/renders/<job>.mp4 with a .txt transcript beside each. Set VFREY_HOME to keep them in another folder.

Platform keys can be held in that database, encrypted, when you set a CREDENTIALS_KEY. They can also come from your environment or a .env file in your working folder. Either way they stay on your machine. Delete the folder and the data is gone.

The dashboard (npx vfrey dashboard) is served from your own machine on 127.0.0.1. Opening it does not upload anything.

If you sign in to the console and choose to sync a project or use cloud rendering, copies of those files go to our servers. That is a choice you make, and the sections about the paid service below cover it.

The local tool talks to other services only for a job you start, and only through their official interfaces:

• Reads. Official RSS feeds, the YouTube API and the Reddit API, to find topics.
• Uploads. The official APIs of YouTube, TikTok, Instagram and Facebook, using your own keys, and only for a platform whose key you gave it. With no key, publishing is skipped and the video stays on your machine. Each upload carries the AI-disclosure label.
• Writing the script. Your coding agent can supply the script itself. If you configure a language model instead, the text it needs for the script is sent to the provider you chose, with your key, under that provider's terms. With the built-in mock writer nothing is sent.
• Voice. The default voice is the speech command built into macOS and runs locally. If you set the voice to an OpenAI-style provider, the script text is sent to it.
• First render. Remotion downloads a headless browser the first time you render. That is a download to your machine, not an upload from it.

Those services have their own privacy practices. We do not control them. Some of them are overseas, so data you send them may leave Australia. That is your choice of provider, not a transfer by us.

As of the date at the top, the vfrey pipeline code contains no telemetry, analytics or crash reporting, and it does not send usage data to us. We checked the code for it. If that ever changes, this page will say so before the change ships.

The site is hosted on Vercel. Like any host, Vercel receives the request your browser makes (such as your IP address and browser type) and may keep standard server logs. Vercel is a United States company and may process those logs outside Australia. See Vercel's privacy policy. We use the logs only to run and secure the site.

This website sets no cookies, does not sign anyone in and holds no key. Plausible Analytics counts page views on this website and on the console's public pages (sign-in, sign-up, support). It sets no cookies, keeps no cross-site or cross-day identifier, and does not store your IP address or browser details in readable form. It receives the page address, the referring site, and your country, browser and device type in aggregate. It is loaded only while we have it switched on [OWNER: confirm Plausible is on]. Its fonts are served from its own files. The one thing it stores is your light or dark choice, in your browser's local storage under the name theme. Clear it any time.

The vfrey console is a different site. It does set a few cookies it needs to work (a sign-in session cookie, a workspace cookie and a language cookie). They are listed in the Cookie Notice.

The documentation at /docs is written in Mintlify and exported to static files that this site serves. We have not audited every request those exported pages make, so Mintlify's own terms may apply to that content.

For the paid service, each feature below lists what data it handles, why, who else receives it, in which country, and how long we keep it. All of it is kept in our hosting in Sydney, Australia unless the entry says otherwise. Overseas recipients are listed in "Hosting and overseas transfers" and on the Subprocessors page.

What: your email address and the account id that GitHub, Google or an email link returns, your name or avatar if the provider shares them, and the time you last signed in. There is no shared console password.

Why: to create your account, keep you signed in and protect it. Basis (GDPR): performing our contract with you.

Who: Supabase Auth runs the sign-in. If you pick GitHub or Google, that provider sees that you signed in to vfrey.

Where and how long: Supabase, [OWNER: confirm Supabase project region is Sydney, ap-southeast-2]. We keep it while your account is open. When you delete your account, or your workspace after its 7 days, it is removed (see Closing your workspace and deletion), except billing records (see Billing).

What: the series in your workspace (niche, voice, spoken language, autopilot, which platforms are on), account names, team members and their roles, invitations, API tokens (stored as hashes), and the platform keys and tokens you type in. Keys and tokens are encrypted before they are stored.

Why: to run the service you asked for. Basis: contract.

Who: only us and our hosting providers (Vercel for the app, Supabase for the database). Platform tokens are used only for the channel you connected, and are read by your own worker.

Where and how long: Sydney. Kept while your workspace is open, and deleted when you delete the workspace (after its 7 days; see Closing your workspace and deletion). Deleting a secret in the console removes it straight away.

Security: the database is Postgres on Supabase. Row-level security is switched on for every table in the public schema, and the anonymous and signed-in database roles have all their privileges revoked, so the database's public API cannot read your rows. This is a Prisma migration (the one named rls), so every release applies it. It is not applied by hand. The console server reads and writes rows through its own database connection, and checks every request against your workspace.

What: your plan, subscription status, the Stripe customer id, invoices and receipts, billing email, and country or tax details you give Stripe. We also keep a ledger of credits bought, granted and used. We never see or store your card number.

Why: to take payment, issue invoices, apply credits and meet tax and accounting law. Basis: contract and legal obligation.

Who: Stripe, Inc. and its affiliates receive your payment details and act as an independent controller for fraud, regulatory and its own purposes, and as our processor for the rest. See the Stripe privacy policy.

Where and how long: Stripe processes data in the United States and other countries. Our own billing and credit records are in Sydney. We keep billing records for at least 5 years after the transaction, as Australian tax law requires [LAWYER: confirm the retention period]. When a workspace is deleted, its payment, credit and plan history is copied to a financial archive under a hash of the workspace id, with no names or email addresses, and kept for those 5 years.

What: which metered features you used, how much, when, and what it cost in credits, tied to your workspace.

Why: to meter and bill, stop abuse, and keep our spend under control. Basis: contract and our legitimate interest in running the service safely.

Who: us only. Where and how long: Sydney, for as long as billing records are kept.

What: the niches and keywords you set up, and public posts we collect for them: title, caption or text, link, author handle, post time, and public counts such as views and likes. Posts come from the YouTube Data API, the Reddit API, and the data providers ScrapeCreators and EnsembleData. The search terms you use are sent to those providers.

Why: so you can see what is trending in a niche. Basis: contract with you. For the public authors, our legitimate interests (see the Creator Data Notice).

Who: ScrapeCreators, EnsembleData, Google (YouTube) and Reddit receive the query and our server's address. Customers of the Research plan see the results.

Where and how long: results are cached in Sydney for 30 days and then deleted. YouTube data is refreshed or deleted within 30 days.

What: public profile and post data about creators on TikTok, Instagram and YouTube. This is described in full in the Creator Data Notice, and any creator can ask us to remove their profile at the removal form.

Who and how long: customers of the Research plan. A profile that nobody watches and nobody opens is deleted after 90 days (YouTube data, after 30 days). Watched creators are refreshed daily.

What: the sender identity you set (display name, reply-to address, postal address), and for each message the recipient's email address and name, the subject, the body, who approved it, when it was sent, and delivery events (delivered, delayed, bounced, complained, unsubscribed). We also keep a suppression list of people who unsubscribed, bounced or complained. It stores a keyed hash of the address, not the address itself.

Why: to send, track and honour opt-outs for messages that you wrote and approved. Basis: contract with you. For recipients, we act as your processor. You are responsible for your lawful basis to contact them (see the Terms).

Who: Resend, Inc. sends the mail and sends us delivery events. The recipient's own email provider receives the message.

Where and how long: Resend processes data in the United States [OWNER: confirm Resend region]. Our records are in Sydney. We keep drafts and sent messages while your workspace is open and delete them within 30 days of closure. We keep the suppression hashes without an end date, because they stop us from writing to someone who has opted out.

What: when something happens in your workspace we email the people it concerns, at the address on their account. Account emails: a payment that failed or is past due, vfrey support opening a read-only view of your workspace, a new device signing in, a data export being ready, and a deletion being scheduled or completed. Service emails: your credits running low, a cloud render finishing or failing, a daily summary of items waiting for review, and a teammate joining. Until a message is sent we keep a queue entry with the kind of event, the workspace, the person and the details the message states (such as the workspace name and a credit balance). It holds no address and no secret. We also keep each person's choices for the service emails.

Why: to tell you about things you would otherwise miss, and to protect your account. Basis: contract for account emails, and our legitimate interest in running the service for service emails.

Your choice: account emails cannot be switched off. Each kind of service email is on by default and you can switch it off at any time, from the link at the bottom of the email (one press, no sign-in) or under Settings, then Notifications. The change applies at once, including to anything already waiting to be sent, and we never take longer than 5 business days. The low credits email contains a link to add credits, so we treat it as a commercial message: it names us as the sender, carries our postal address, and has the one-click unsubscribe that mail programs show. [LAWYER: confirm the commercial and service message classification under the Spam Act 2003 (Cth).]

Who: Resend, Inc. sends these emails. Sign-in and confirmation emails are sent through Supabase, which can use Resend as its mail server.

Where and how long: Resend processes data in the United States [OWNER: confirm Resend region]. Our queue is in Sydney. An email not sent within 7 days is dropped. Queue entries are deleted 90 days after they were made. Your email choices are kept while your account exists.

What: the files in projects you sync: scenes, scripts, videos, transcripts and project metadata, with their paths, sizes and checksums. When you delete a file we keep a small record of its path and the time, so other machines can apply the deletion.

Why: to share projects across your machines and team. Basis: contract. We do not look at the content except to deliver the service, handle a support request you make, or investigate abuse.

Who: Supabase Storage holds the files, in one private bucket for each workspace. Only members of the workspace can read them.

Where and how long: Sydney [OWNER: confirm the Storage region]. Kept until you delete them or close the workspace, and deleted within 30 days of closure.

What: the scene files, script and voice audio you send for a render job, and the finished video, its transcript, logs and timing.

Why: to render the video for you. Basis: contract.

Who: Google Cloud (Cloud Run Jobs and Cloud Storage) runs the render. The job reads its inputs and writes its outputs with short-lived signed links. We copy the output to your workspace's storage.

Where and how long: [OWNER: confirm the Google Cloud region, target Sydney, australia-southeast1]. Inputs are removed when the job ends. Outputs stay in the render bucket for its lifecycle rule [OWNER: state the number of days] and in your workspace storage until you delete them.

What: when you connect an AI assistant (an "MCP client") to vfrey, the client registers its name and redirect addresses, and you approve it for one workspace. We then store hashes of the authorisation code, access token and refresh token, which client they belong to, which user and workspace approved, and when each was made, used or revoked. We log the calls the client makes under your workspace's usage records.

Scope: there is one scope, mcp (the client may also ask for offline_access, so it can refresh). It lets the client use vfrey's tools as you, in the workspace you chose, with your role's permissions. It does not give the client your platform keys or your Google, Stripe or provider credentials.

Lifetime: an authorisation code lasts 2 minutes. An access token lasts 1 hour. A refresh token lasts 30 days, and each use replaces it. Showing an authorisation code a second time revokes everything it produced. You can revoke a token at any time in Settings, on the tokens page, and you can ask us from the Support page to remove a client. A daily job deletes expired items.

Who: the MCP client's operator receives whatever the tools return to it. That is the client's own responsibility, under its own privacy policy. Where: Sydney.

vfrey uses YouTube API Services. By using vfrey features that involve YouTube, you agree to be bound by the YouTube Terms of Service, and you should read the Google Privacy Policy.

What API data we access.

• Public data, through our own API key (Research plan: topics and creators): video and channel ids, titles, descriptions or captions, channel names and handles, publish dates, and public statistics such as view, like and comment counts.
• Data from your own channel, when you give vfrey credentials for it (the Google client id and secret, and a refresh token that you create for your channel). The worker uses them to upload videos, set the synthetic-media label, reply to comments, and read channel analytics. The scopes are youtube.upload, youtube.force-ssl (comment replies), yt-analytics.readonly, and yt-analytics-monetary.readonly only if you ask for revenue figures. You choose which of these you grant.

How we store it. Your Google credentials are encrypted before they are stored (see Workspace data). The console does not keep your channel's videos or analytics, except for the video and its metadata that your own worker or team syncs as project files. Public data from the YouTube API is cached and shown only to customers of the Research plan. We refresh or delete stored YouTube API data within 30 days, as the YouTube API Services Developer Policies require.

How we use it. Only to provide the features you asked for: to show topics and creators, to upload and manage your videos, and to show your analytics to you. We do not sell it, use it for advertising, or share it with other people, except as the law requires or to run the service as described here (for example our hosting providers act on our instructions). Humans at vfrey do not read your authorised data unless you ask us to, it is needed for security or to follow the law, or it has been aggregated and anonymised.

Revoking access. You can revoke vfrey's access to your Google account at any time at https://security.google.com/settings/security/permissions. You can also delete the saved credentials on the account or series page in the console. If you do either, the worker can no longer use them. We delete the stored credentials when you delete them in the console, and any other stored data tied to the connection within 30 days of a request.

Limited Use. vfrey's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Contact. For questions about our use of YouTube API Services, or to ask us to delete data we hold from it, write to privacy@vfrey.ai.

This website sets no cookies. The console sets only the cookies it needs to work: the Supabase session cookie that keeps you signed in, a workspace cookie (vfrey_org) that remembers which workspace you chose, and a language cookie (deviance_locale). It also keeps your theme, sidebar width, language and last sign-in method in your browser's local storage. This website keeps only your theme there. We set no advertising or analytics cookies, on either: the page-view counter described under "This website" uses none. See the Cookie Notice for the full list.

Our host (Vercel) and, for the paid service, our database provider keep standard logs of requests, such as IP address, time, path and response code. We use them to run and secure the service, and keep them for as long as those providers' defaults allow (up to 30 days) [OWNER: confirm the log retention in the Vercel plan]. We rate-limit by IP address using memory on the server, and do not write the address to our database for that purpose.

Staff access to customer data is limited to people who need it to run the service or answer a support request.

When the paid service or the staff admin fails, it can send an error report to Sentry. Before it leaves our servers we remove the user, email addresses, tokens and keys, cookies, request headers, request bodies and query strings, so a report holds the error, the stack trace and the page path. Reports are used to fix the fault and nothing else. They are switched on only while we have a Sentry project configured.

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not use platform tokens for any channel other than the one you connected, and we do not put them in a host environment variable. We do not make decisions about you by automated means that have legal or similarly significant effects.

California notice (CCPA/CPRA): in the last 12 months we have not sold or shared personal information as those terms are defined in the CCPA, and we do not sell or share the personal information of anyone under 16. We collect the categories of personal information described above (identifiers, commercial information, internet activity, and the content you upload) for the business purposes described above. We use sensitive personal information only to provide the service, and not to infer characteristics about you. California residents have the rights listed in "Your rights".

We host the console in Sydney, Australia (Vercel region syd1) with the database and file storage on Supabase [OWNER: confirm region]. Some providers process data outside Australia:

• Stripe (United States and other countries): payments.
• Resend (United States): outreach mail and our transactional email.
• ScrapeCreators and EnsembleData: research queries and public creator data, [OWNER: confirm each provider's country].
• Google (YouTube API, Google Cloud): global infrastructure. [OWNER: confirm the render region].
• Vercel (global edge network and logs).
• Mintlify (the public documentation site; no customer data).
• Sentry (United States; error reports without personal data) and Plausible Analytics (European Union; cookieless page-view counts).

Australian law (APP 8) lets us disclose personal information overseas if we take reasonable steps to make sure the recipient handles it consistently with the APPs. We do this by contract. Under the Privacy Act we remain accountable for what those recipients do with it.

For people in the European Economic Area, the United Kingdom or Switzerland, we transfer personal data outside those areas under the European Commission's Standard Contractual Clauses (Decision 2021/914) and, for the UK, the UK International Data Transfer Addendum, as set out in the DPA. Where a provider is certified under the EU-US Data Privacy Framework we may rely on that as well [LAWYER: confirm transfer mechanism for each subprocessor].

For the free local tool, you can skip any platform by leaving its key out, review or delete your data by opening or removing the folder under your home directory, and revoke a platform key at the platform, which stops the tool from posting at once. For the personal information we hold (such as email you send us for support, or your account in the paid service), you can ask to see it, correct it, delete it, restrict or object to how we use it, take a copy in a portable format, or withdraw consent where we rely on it. Write to privacy@vfrey.ai, or use the Support page. We may ask you to prove who you are.

How fast we answer: within 30 days if the Australian Privacy Act or the GDPR applies to you, and within 45 days if the CCPA applies (we may extend this once by a further 45 days if we tell you why). There is no charge unless a request is clearly excessive. If we refuse, we tell you why. You will not be treated worse for using these rights.

California residents may also ask us to disclose the categories and specific pieces of information we collected, to delete or correct it, and to opt out of any sale or sharing (we do neither). You can use an authorised agent.

Complaints. Tell us first and we will try to fix it. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au), the data protection authority in your EU country or the UK Information Commissioner's Office, or the California Attorney General.

Creators who appear in our research index have the same rights. Use the removal form.

If a data breach is likely to cause you serious harm, we tell you and the Office of the Australian Information Commissioner as soon as we can, under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. Where the GDPR applies, we tell the relevant authority within 72 hours of becoming aware of a breach that is likely to put people's rights at risk, and we tell the people affected where it is high risk. We tell our customers without undue delay when a breach affects data we process for them.

vfrey is not directed at anyone under 18, and you must be 18 or over to hold an account. We do not knowingly collect personal information from anyone under 18. If you think a child has given us information, write to privacy@vfrey.ai and we will delete it.

Export. In the console, under Settings, then Your data, any member can export their own data, and an owner or admin can export the whole workspace. It is a JSON file made as a background job. We keep it in your workspace's private storage and email you when it is ready. The download link works for 7 days and the file is then deleted. You can export once every 24 hours. Each export is recorded in our audit log (the ids only, never the content).

Deleting a workspace. Only an owner can do it, by typing the workspace's name. The workspace is locked at once: nobody can use it, its API tokens and the command line stop working, and renders stop. You then have 7 days to change your mind, and any owner can cancel in the console. We email every owner when it is scheduled. When the 7 days are over the deletion runs by itself: we cancel the Stripe subscription and detach saved payment methods, delete the workspace's database rows (projects and files metadata, series, mail drafts and their recipients, watchlists, members, tokens, usage, credit and cost history), empty its file storage bucket and its render files, and delete any export files. We then email the owners that it is done.

Deleting your account. You can delete your own account from the same page. It removes you from every workspace, revokes your tokens, deletes the data that is only yours and your sign-in account, and takes your name off records a workspace keeps (they show "deleted user"). If you are the only owner of a workspace you must delete that workspace, or make someone else an owner, first.

Staff. When you ask us in writing to delete your data, a vfrey owner does the same thing in the admin panel. Because that is a destructive action by a single person, it needs a fresh authenticator code typed at that moment, and it is recorded in the audit log.

What we keep. (1) Financial records: a copy of the payments, credit ledger, plan history and invoice references, and a monthly summary of provider cost, under a hash of the workspace id and without names or email addresses, for 5 years, because Australian tax law requires it [LAWYER: confirm the retention period and basis]. Stripe keeps the invoices itself. (2) A hash of your sign-up address, so deleting an account and signing up again does not earn the free sign-up credits twice. (3) Hashes of mail addresses that unsubscribed, bounced or complained, so we do not email them again. These are keyed hashes, not addresses. (4) The audit log of staff and system actions. It is append-only, so it is never deleted, but when a workspace or account is deleted we remove the personal data from the rows about it (IP address, device, any name or email), through one function that is itself recorded.

Backups. Our database provider keeps backups and point-in-time recovery for [OWNER: confirm the Supabase backup and PITR window]. Deleted data can remain in those backups until they expire, and it is not restored except to recover the service. Resend, which sends our email, keeps message logs for [OWNER: confirm the Resend log retention]. Sentry, if we turn it on for error reports, keeps events for [OWNER: confirm the Sentry retention]. Posts already sent stay on the platforms until you delete them there. A lost encryption key is not a copy that we can hand back.

If we change this policy in a way that matters, such as a new provider that receives personal information or a new use of it, we tell account holders by email, and post a notice on this website, at least 30 days before the change starts. Material changes to what data leaves your machine through the free local tool will be described here at least 30 days before they take effect. The date at the top shows the latest version.

{{LEGAL_ENTITY}} (ABN {{ABN}}), {{POSTAL_ADDRESS}}. Email: privacy@vfrey.ai. For product help, see Support.