YOUR-DOMAIN.com and the contact details with your real ones.
The short version
ARCH‑ANGEL is video-processing software. You can use it two ways, and the privacy picture is genuinely different for each:
- The hosted service at
YOUR-DOMAIN.com— we run the servers, so the video you process and the clips it produces are stored on our infrastructure. We are responsible for them. - Self-hosted — you install it on your own machine. Nothing reaches us at all; there is no phone-home, no telemetry, no analytics.
In neither case do we sell your data, use it for advertising, or train anything on your footage. We do not run third-party trackers.
Two ways to use it
| Hosted service | Self-hosted | |
|---|---|---|
| Who holds the files | Us | You |
| Who holds your password | Us (hashed) | You (hashed) |
| Who holds your YouTube tokens | Us (encrypted at rest by the host) | You |
| Data reaching the authors | Only what you send us | None |
| This policy applies | In full | Only the self-hosting section |
Who is responsible
For the hosted service, the operator of YOUR-DOMAIN.com —
dead-angel — is the data controller. Contact details are in
Contact.
If you are using an instance someone else runs, that operator is the controller for your data, not us. Ask them.
What we collect hosted
Because you gave it to us
| Data | Notes |
|---|---|
| Username and password | Password is salted and hashed with PBKDF2-HMAC-SHA256. We never see or store the plaintext. |
| Role | Whether you are a user or a super admin. |
| Source video | Files you upload, and videos downloaded from URLs you give us. |
| Transcripts | Generated from the audio of your source video. |
| Clips and metadata | The output, plus titles, descriptions, scores and timestamps. |
| Your settings | Caption design, effects, tracked channels and their render profiles. |
| Uploaded media | Music and sound effects you add to the library. |
Because you connected an account
| Data | Notes |
|---|---|
| YouTube OAuth tokens | An access and refresh token per connected channel, so we can upload on your behalf. We never receive your Google password. |
| Channel name and ID | So you can tell your channels apart and pick a publish target. |
| TikTok / Instagram tokens | Only if you paste them in. |
Scopes are limited to uploading videos and reading your channel list. You can disconnect any channel at any time, which deletes its stored token, and you can additionally revoke access from your Google account permissions.
Because a server produces it automatically
| Data | Notes |
|---|---|
| Session token | A random opaque value in a cookie. Expires after 14 days. |
| Server logs | IP address, timestamp, requested path and status, kept transiently for security and debugging. |
| Failed-login counts | Held in memory per IP to rate-limit brute force. Not persisted. |
| Error log | Render, upload and server failures, plus browser errors. In memory, capped at 250 entries, cleared on restart. |
We do not use analytics platforms, advertising pixels, fingerprinting, session recording, or cross-site trackers.
Why, and on what basis hosted
| Purpose | Basis |
|---|---|
| Running the service you asked for — processing your video, storing your clips | Performance of a contract |
| Keeping you signed in | Strictly necessary / contract |
| Publishing to a platform on your instruction | Your consent, given when you connect the account and press publish |
| Sending transcript text to a cloud LLM | Your consent, given by choosing that picker |
| Rate limiting, abuse prevention, keeping the service up | Legitimate interests |
| Diagnosing failures | Legitimate interests |
We do not carry out automated decision-making that has legal effects on you. Clip scoring is a creative suggestion, not a decision about a person.
Who we share it with hosted
We do not sell data. We share only what a task requires:
| Recipient | What they get | When |
|---|---|---|
| Our hosting provider | Everything, as the infrastructure it sits on | Always — they are our processor |
| The source site (e.g. YouTube) | A request for the URL you gave us | You start a job from a URL |
| Your chosen LLM provider | Transcript text | Only with the cloud picker enabled |
| YouTube / TikTok / Instagram | The clip, its title and description | You publish, or auto-publish fires |
| Google Fonts, jsDelivr, unpkg | Your IP, as any CDN request reveals | Loading the interface |
We may also disclose data where legally required, or to protect the service and its users from abuse.
How long we keep it hosted
| Data | Kept |
|---|---|
| Account | Until you ask us to delete it, or the instance is shut down |
| Source video downloads | Pruned periodically — treat them as temporary |
| Clips and transcripts | Until you delete them or close your account |
| OAuth tokens | Until you disconnect the channel or delete the account |
| Sessions | 14 days, then automatically pruned |
| Signed public clip links | Expire in 6 hours by default |
| Error log | Max 250 entries in memory; gone on restart |
| Server logs | Short-term, for security and debugging |
Deleting your account removes your credentials, sessions and channel tokens.
Where it is stored hosted
The service runs on servers rented from a hosting provider. Some recipients listed above — platform APIs, LLM providers, CDNs — operate internationally, so using those features involves transferring data outside your country, under whatever safeguards those providers offer.
If that matters to you, use the local pickers and self-host.
If you run your own instance self-hosted
Then this is short: we receive nothing. There is no phone-home, no licence check, no telemetry, no analytics. Everything lives on your disk:
| Path | Holds |
|---|---|
config/auth.json | Users (hashed passwords), hashed super-admin code |
config/sessions.json | Active session tokens |
config/secret.key | The key that signs public clip links |
config/yt_accounts.json | Per-user channel manifest |
secrets/ | OAuth app credential and per-user tokens |
downloads/, output/ | Source video, transcripts, clips |
.env | Your API keys |
Outbound traffic happens only when you cause it: fetching a source URL, calling a cloud LLM you keyed, or publishing. Interface fonts and libraries load from public CDNs, which you can vendor locally to stop even that.
If you host an instance for other people, you become the controller for their data. Adapt this policy — the hosted-service sections above are a reasonable starting point.
Cookies & browser storage
No tracking cookies, no advertising identifiers. Only:
- One session cookie — an opaque random token,
HttpOnly,SameSite=Lax, andSecureover HTTPS. Strictly necessary for signing in; it holds no personal data itself. No consent banner is required for it. - Local storage preferences — theme and accent, your caption design, selected effects, media ordering, and whether you have seen the command-palette tip. Cosmetic, stored in your browser, never transmitted.
Your rights
Depending on where you live you may have the rights below. For the hosted service, ask us; if you self-host, they are all directly actionable because the data is a file on your disk.
| Right | Hosted service | Self-hosted |
|---|---|---|
| Access / portability | Ask us, or download your clips from the Clips tab | Read config/ and output/ |
| Erasure | Ask us to delete your account | Delete the user, or the files |
| Rectification | Change your password in Settings; ask us for anything else | Edit it directly |
| Withdraw consent | Disconnect channels, turn off auto-publish, stop using cloud pickers | Same |
| Object / restrict | Contact us | Stop the server |
| Complain | You can complain to your local data-protection authority | |
We will not charge you for exercising these, or treat you worse for it.
Security
- Passwords and the super-admin code: salted PBKDF2-HMAC-SHA256, 200,000 iterations.
- Sessions: opaque random tokens in
HttpOnly,SameSite=Laxcookies,Secureover HTTPS. - HTTPS enforced, with HSTS on the hosted service.
- Login rate limiting; cross-origin POSTs rejected.
- Role gating enforced server-side, not just hidden in the interface.
- Clip serving is path-traversal-checked and confined to the output directory.
- Links given to social platforms are short-lived and HMAC-signed, scoped to a single file.
- A content security policy restricts what the interface may load.
- YouTube OAuth uses PKCE.
No system is perfectly secure. If we discover a breach affecting your personal data we will notify affected users and any required authority without undue delay. Please report vulnerabilities privately before disclosing them.
Children
This is a production tool, not directed at children, and accounts on the hosted service are created by an administrator rather than public sign-up. If you believe a child's data reached us, contact us and we will remove it.
Changes to this policy
The effective date and version at the top change with the policy. For material changes to the hosted service we will tell account holders. If you self-host, a change only reaches you when you update your copy.
Contact
For anything about your data on the hosted service, or to make a request under
Your rights, contact dead-angel at
privacy@YOUR-DOMAIN.com.
For the software itself, reach us wherever you obtained it. If you use an instance somebody else runs, they are your first point of contact.
See also the Terms of Service, the data section of the manual, and how to self-host.