Privacy Policy — Atropos

Version: 2026.05.23

Effective Date: 2026-05-09

Last Updated: 2026-05-23

1. Introduction

At Atropos, we respect your privacy and are committed to protecting your personal data. We operate on a local-first principle: most processing happens on your device, and we only keep server-side data required to run licensing, billing, legal acceptance, support, and premium publishing automation.

2. Data We Store (Server-Side)

We store only the minimum data needed to manage free access, premium access, billing, legal acceptance, and support.

Account & Billing: Original account email for account recovery, billing email, and account entitlement status when you subscribe, receive VIP access, contact support, or otherwise create account records.
Subscription State: Plan status metadata synced from our payment provider (for example, active/canceled state and renewal timing).
Premium Entitlement State: Premium access metadata used to decide whether publishing, profiles, schedules, presets, retries, and automation are available.
Legacy Trial Usage: Legacy trial counters may remain in records for compatibility, but they do not block free local creation features under the current free model.
Aggregate Local Usage: Daily counts of completed Get Clips runs, failed Get Clips runs, completed or failed Edit to Music runs, Project Ask sessions, Project Ask messages, and Project Ask failures associated with your device account. We do not include media files, source URLs, titles, project names, transcripts, Project Ask question text, Project Ask answers, clip metadata, screen views, or feature-click events in these counters.
Device Authorization Metadata: Limited device-linked metadata used to validate access and help prevent abuse.
Account Role Metadata: Role, VIP, free, premium, and subscription access fields used for entitlement decisions, support, and aggregate analytics.
Legal Acceptance Metadata: Records that track terms/policy acceptance versions required to use the service.

3. Data Stored on Your Device (Local)

Atropos keeps project and workflow content on your machine. Free local creation workflows are designed to run locally and do not upload your media files to Atropos servers as part of normal operation, except as described in Section 3a below for specific premium platform integrations that require it. Free render watermarks are applied locally at render time and do not require uploading your media to Atropos servers.

3a. Temporary Cloud Storage for Platform Uploads

Some destination platforms (currently Instagram) require us to host your rendered video at a publicly reachable URL during upload. When you initiate such an upload, the rendered short is transferred to our Cloudflare R2 storage, served to the platform for ingestion, and then deleted upon upload completion, or within 24 hours, whichever comes first. We do not retain, index, share, or use this content for any other purpose. Source footage is never uploaded — only the final rendered short you have chosen to publish.

Atropos uses a device-bound account identifier (device_id_hash) and does not provide email/password login. We collect an original account email during first-run setup for account recovery and store it with the device-bound account record. Local credentials are stored in your operating system keychain or equivalent secure store. Optional recovery phrases are shown once; only a hash is stored server-side for verification.

Media Files: Source videos, clips, shorts, and exports. Free rendered shorts and exports may include the locally applied Atropos watermark described in the Terms & License Agreement.
Project Ask Context: Project Ask may process your question, transient chat history, transcript excerpts, extracted frames, audio cues, candidate moments, and project metadata on your device to answer questions about a project. Open Project Ask chat history is used as transient request context and is not stored by Atropos after the modal closes.
Connected Account Credentials: OAuth tokens, session cookies, and other platform auth data for services you connect through premium publishing features.
Application Settings: Local preferences and configuration values.
Publishing State: Premium schedules, presets, profile defaults, queue state, retry state, and publishing history may be stored locally and, where needed, sent to Atropos services or third-party platforms to perform the requested publishing operation.
Local Usage Counter: Free local usage counts are accumulated on your device and sent to Atropos as aggregate daily counts at most once per day when pending usage exists. These counters distinguish completed and failed Get Clips runs, completed and failed Edit to Music runs, and aggregate Project Ask sessions, messages, and failures. The local pending count is cleared only after the server update succeeds.

3b. Google and YouTube User Data

Atropos uses YouTube API Services for connected YouTube publishing features.

If you connect a Google or YouTube account for premium publishing features,

Atropos requests only the Google OAuth scopes needed for the feature you choose.

Current YouTube publishing support may request YouTube upload and read-only

channel scopes so the app can confirm the connected channel and upload videos

you explicitly choose to publish. Google's privacy practices are described in

the Google Privacy Policy.

Atropos may access the following Google user data when you connect YouTube:

OAuth Tokens: Access tokens and refresh tokens issued by Google so Atropos can maintain the connection you authorized.
Channel Metadata: YouTube channel identifier, channel title, upload capability/status, and related channel status fields returned by the YouTube Data API.
Upload Content and Metadata: The rendered video file, title, description, tags, and selected privacy status that you choose to upload to YouTube.
Provider Responses: YouTube upload result identifiers, status responses, sanitized error messages, and request/correlation identifiers needed to show upload status, troubleshoot failures, and provide support.

Atropos uses Google user data only to provide or improve the connected YouTube

functionality you request, including account connection, channel status checks,

token refresh, upload execution, upload status reporting, troubleshooting,

support, security, and abuse prevention. Atropos stores and accesses

information on or from your device to provide these features, including local

application settings, publishing state, OS keychain or credential-manager

records, OAuth tokens, and optional browser cookies or cookie references you

choose to provide when YouTube requires sign-in for source downloads. We do not

sell Google user data, use it for advertising, use it to train AI models, or

transfer it to third parties for purposes unrelated to providing or improving

Atropos's user-facing functionality.

Google OAuth tokens are stored locally in your operating system keychain or equivalent secure store. The Atropos integrations service may handle authorization-code exchange, token refresh, and channel status requests, but it does not retain long-lived Google OAuth tokens server-side. The local Atropos service receives access tokens per request when needed to perform an upload and does not store them in project files. YouTube upload content is sent to Google/YouTube as part of the upload you initiate. If you enable feature-gated Reddit NSFW publishing, rendered shorts you choose to publish may be uploaded to RedGIFs so Atropos can create a Reddit link post to the hosted media.

Google user data may be shared only with:

Google/YouTube: To authenticate your account, check channel status, refresh tokens, and upload videos you request.
Atropos service providers: Infrastructure providers that process requests for Atropos under confidentiality and security obligations.
Legal or safety recipients: Only if required by law or necessary to protect users, Atropos, or the service.

We protect Google user data using HTTPS/TLS in transit, local operating-system

secure storage for tokens, secret redaction in logs where supported, limited

server-side retention, access controls, and least-privilege scope selection.

Disconnecting a YouTube account clears locally stored Google OAuth tokens for

that account. Account deletion requests remove Atropos-held account metadata

subject to the retention exceptions in Section 8. To request deletion of stored

Atropos account or publishing metadata, contact

contact@atropos-video.com. We process

deletion requests as soon as possible and within 7 calendar days unless a legal,

security, fraud-prevention, or billing-retention obligation requires us to keep

limited records. Deleting data stored by Atropos does not delete data stored by

YouTube. You can revoke Atropos's Google access at any time from Google's

connected-apps settings:

https://myaccount.google.com/connections?filters=3,4&hl=en.

4. Model Runtimes and Optional Providers

Atropos can use local model runtimes directly on your device. If you enable optional third-party model providers, data is only sent to those providers when you request those features.

Local Model Runtime: Native local inference runtime and compatible model packages run on-device.
Optional Local Connectors: You may connect tools like LM Studio or Ollama, which run on your own hardware.
Project Ask: Project Ask uses only the local model runtime or local connectors running on your own hardware. Project Ask questions, transient chat history, transcript excerpts, extracted frames, audio cues, candidate moments, and project metadata are not sent to cloud model providers by Atropos.
Optional Cloud Model Providers: If enabled by you for other features, prompts/transcript content required for the requested feature can be sent to the provider you configure.

For the current list of model identifiers, third-party packages, and supporting dependencies, see our Open Source Credits.

5. How We Collect Data

Directly from You: When you activate the app or contact support.
From Service Providers: Subscription status webhooks and billing state from Stripe.
From Third-Party Platforms: If you connect publishing profiles, platform authorization and publishing status metadata can be received from those platforms.
From Google/YouTube: If you connect YouTube, Google OAuth and YouTube Data API responses provide the token, channel, upload, and status data described in Section 3b.
Locally Generated: Device and runtime metadata used for entitlement validation, legal acceptance, and service integrity.
Aggregate Usage Counts: Daily local pipeline completion counts generated by the app.

6. Why We Process Data

Access Management: To provide free local access and validate premium publishing automation access.
Product Planning: To understand aggregate local usage by mode without collecting media content, Project Ask prompt/answer text, or detailed behavior analytics.
Billing Operations: To keep subscription status accurate.
Publishing Operations: To publish, schedule, retry, and report on uploads you request through premium features.
Connected YouTube Functionality: To connect your Google/YouTube account, verify channel status, refresh authorized access, upload videos you choose, and report upload results.
Security: To prevent abuse and protect account access.
Support Communications: To respond to user inquiries.

7. Legal Bases for Processing

Depending on where you are located, we rely on one or more of the following

legal bases:

Contract: Processing needed to provide the Service you request.
Legal Obligations: Processing required for tax, accounting, and compliance duties.
Legitimate Interests: Processing for security, fraud prevention, and service reliability.
Consent: Processing based on your permission where applicable.

8. Data Retention

Account Data: Retained while your account is active and needed to provide the Service.
Google OAuth Tokens: Stored locally until you disconnect the account, delete local app data, revoke Google access, or delete your Atropos account data where applicable.
Google/YouTube Metadata: Channel, upload, and status metadata is retained only as needed for publishing history, support, security, and service operation, unless longer retention is required by law.
Billing Records: Retained as required for tax, accounting, and legal compliance.
Deleted Accounts: Data is scrubbed after deletion requests, except minimal records required for compliance, fraud prevention, or legal obligations.
Operational Logs: Retained for a limited period for security and fraud prevention.
Platform Upload Cache (Cloudflare R2): Rendered videos staged for platform uploads that require a public URL (see Section 3a) are deleted upon upload completion or within 24 hours, whichever is sooner.

9. International Transfers

Our services are operated in the United States. If you access the Service from

outside the United States, your information may be transferred to and processed

in the United States.

10. Third-Party Infrastructure

Stripe: Payment processing and subscription state.
Cloudflare: API edge hosting, transport security, and delivery.
Cloudflare R2: Temporary object storage of rendered videos during platform uploads that require a public URL (see Section 3a).
Google/YouTube: Google OAuth and YouTube Data API services for account connection, channel status checks, token refresh, and uploads you initiate.
Third-Party Social Platforms: When you connect accounts or publish through premium features, platform APIs process the content and metadata needed for that upload under their own terms and privacy policies.

Publishing features depend on third-party platform systems outside Atropos's

control, including provider APIs, OAuth permissions, quotas, rate limits, upload

caps, app review status, account standing, content policy review, moderation,

and provider technical or policy changes. These limits may affect whether,

when, or how often Atropos can publish to platforms such as YouTube/Google,

TikTok, Instagram, Facebook/Meta, LinkedIn, and other destinations.

11. Your Rights

Depending on your location, you may have rights to:

Access the account, entitlement, billing, and publishing metadata we hold about you.
Correction of inaccurate account or billing fields.
Deletion of your account record (which ends service access).
Objection to certain processing where applicable under local law.
Complaint to your local data protection regulator, where applicable.

12. Children

The Service is not directed to children under 13 (or higher age where required

by local law).

13. Contact Us

If you have questions about this policy or want to exercise your rights, contact contact@atropos-video.com.