Privacy policy

1. Who this covers

ClipForge is open-source software published by Bytepic ("we", "us"). This policy applies to the ClipForge application and to the hosted control plane we operate for it, reachable at bytepic-clipforge.web.app, and to this website.

ClipForge can also be self-hosted: the source is MIT licensed, and anyone can run it against their own Firebase project. If you are using a deployment somebody else operates, they hold your data and their terms apply, not ours. This policy describes the deployment we run.

2. What is collected

ClipForge is deliberately built so that almost nothing needs to be collected. What is collected falls into five groups.

Account and access

• Your Google account's email address, display name and profile photo URL, received through Firebase Authentication when you sign in.
• A Firebase user id, and your role and approval status in the workspace, plus who approved you and when. Registration is open but access is not: an unapproved account can read nothing.

Work you submit

• Job records — what you asked for, which stage it reached, timings, retry counts and any error.
• Source records — the title, duration and origin of the video you pointed ClipForge at. The video file itself stays on your machine.
• Clip and candidate records — start and end times, scores, titles, descriptions, review decisions and notes, and a short transcript excerpt for each candidate: the passage a reviewer needs to read to judge it.
• A small poster frame per clip, so the review queue still shows something when the clip file is not reachable.

Rendered clips, temporarily

• A finished clip (typically 5–20 MB) is uploaded to Cloud Storage only so it can play on a phone during review. It is deleted when you review the clip, and a bucket lifecycle rule deletes anything left after five days regardless of whether the app is running.

Publishing

• Publication records — for each upload, the resolved title, description, tags, privacy, category, destination channel, the resulting video id and URL, and any error. This exists so "what did we actually send" has an answer.
• Channel settings — the label, defaults and connection state of a connected YouTube channel, and its remaining API quota. No credentials.

Notifications and diagnostics

• A device messaging token, if you allow notifications, so a finished job can reach your phone.
• Worker heartbeats — that a worker is alive, what it can do, and GPU status.
• Firebase's own operational logs, which record request metadata such as IP address, as any hosting provider does.

3. What is never collected

• Your source video. It is read from your disk and stays there. Nothing in the system is permitted to upload it — the Cloud Storage rules deny every path except the clip path.
• Full transcripts. The word-level transcript stays on the worker; only the excerpt a reviewer reads is stored.
• Your YouTube OAuth client secret and refresh token. They are written, encrypted, to the machine running the worker and are never sent to the cloud. This is a deliberate architectural decision: a refresh token can upload to and delete from your channel indefinitely, so it does not belong in a remotely readable database.
• Model weights, and anything you feed a local model. Transcription and analysis run entirely on your hardware.
• Advertising, analytics or tracking data. This website loads no third-party scripts, no fonts from a CDN, and sets no tracking cookies.

4. YouTube API Services

ClipForge uses YouTube API Services to upload videos to a channel you connect, and to read back that channel's title and your remaining upload quota.

By connecting a channel you also agree to the YouTube Terms of Service. Google's own handling of your information is described in the Google Privacy Policy.

You can revoke ClipForge's access to your YouTube account at any time from Google's security settings page. Revoking access stops all publishing immediately. To remove the stored credential as well, delete the worker's youtube-token.enc and youtube-client.json files, which live in the .clipforge directory on your own machine.

5. Google user data and Limited Use

ClipForge's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide the features you asked for — signing in, and publishing clips to the channel you connected.
• It is not transferred to others except as needed to provide those features, for security purposes, or to comply with the law.
• It is never used for advertising, and never sold.
• No human reads your Google user data except with your explicit permission, for security purposes, to comply with the law, or where the data is aggregated and anonymised.

6. How the data is used

To run the product, and for nothing else: authenticating you, deciding whether your account is approved, scheduling and resuming jobs, showing you a review queue on a device that is not the one doing the work, publishing what you approve, and telling you when something finished or failed.

There is no profiling, no automated decision-making about you, no audience segmentation and no marketing use.

7. Who else sees it

We use two categories of third party, and no others.

• Google Firebase and Google Cloud — Authentication, Firestore, Cloud Storage, Cloud Messaging and Hosting. They process the data described above on our behalf as our infrastructure provider.
• YouTube — receives exactly what you publish: the video file and the metadata shown to you before the upload starts.

Nothing is sold, rented or shared with advertisers or data brokers. We disclose data otherwise only where the law requires it.

ClipForge is one shared workspace. Every approved member can see the whole library — jobs, clips and publications — regardless of who submitted them. That is the intended design for a small team, and it means anything you submit is visible to the other approved members of your deployment.

8. How long it is kept

• Rendered clips in Cloud Storage: until you review the clip, and in every case no more than five days.
• Job, clip and publication metadata: until you delete it. It is the record of what the pipeline did, and it is small.
• Your account record: until you ask us to delete it.
• Device messaging tokens: until they expire or you remove the device.
• Infrastructure logs: under Google's retention schedule for the relevant service.

9. Your choices and rights

• Revoke YouTube access at myaccount.google.com/permissions, at any time, without asking us.
• Delete a clip from the bucket yourself — the app does it from the review screen, and the copy on your machine is untouched.
• Ask for a copy, a correction or a deletion of anything held about you, by writing to the address below. We will act within 30 days.
• Turn off notifications in your browser or phone settings; the token is then dropped.
• Depending on where you live you may also have rights to object to or restrict processing, and to complain to your data protection authority. We do not require you to give up any of them.

If you self-host, all of this is simply yours: delete the Firestore documents, empty the bucket, or delete the project.

10. Security

• All traffic is over HTTPS.
• Access is enforced by Firestore and Cloud Storage security rules, which deny by default: an account that has not been approved reads nothing, and no client can write to the clip bucket at all.
• Publishing credentials are held only on the worker machine, encrypted at rest, and are handed to it over loopback from the desktop app rather than through the network.
• No system is perfect, and we will tell you promptly if a breach affects your data.

11. Cookies and local storage

This website sets no cookies and loads no third-party resources. The app stores your Firebase Authentication session in your browser's local storage — that is what keeps you signed in — plus a small offline cache so the interface works with a poor connection. Neither is used for tracking. Clearing your browser storage signs you out and removes both.

12. Children

ClipForge is not directed at children under 13 (or under 16 where local law sets that threshold), and we do not knowingly collect their data. If you believe a child has signed up, write to us and we will remove the account.

13. Changes

If this policy changes materially we will update the date at the top of the page and, where the change affects data already collected, tell affected users in the app. Previous versions are visible in the project's public git history.

14. Contact

Bytepic — support@bytepic.dev
Source and issue tracker: github.com/miltonthefirst/ClipForge