Privacy Policy

This Privacy Policy explains what personal data DoodleReel (“DoodleReel”, “we”, “us”) collects when you use our website and app (the “Service”), why we collect it, who we share it with, and the choices and rights you have. It forms part of our Terms of Service. We collect only what we need to run the Service, and we do not sell your personal data.

1. Data we collect

• Account data: your email address, name and profile picture from the sign-in provider you choose (Google or Apple). Apple may give us a private relay email instead of your real one.
• Content: the topics, titles and instructions you submit, the ideas, scripts, narration, images, videos, thumbnails and metadata we generate for you, and your edit requests.
• Billing data: your plan, subscription status, renewal dates and payment history, received from our payment provider. We never receive or store your full card number.
• Referral and promotion data: which invite link or promo code you used, who invited you, and the rewards earned.
• Technical and usage data: IP address, browser and device type, pages viewed, actions in the app, timestamps, error logs and similar information our hosting providers record automatically. We use it to run, secure and debug the Service.
• YouTube data (only if you connect YouTube): see section 4.
• Messages: anything you send us by email or support channels.

2. How we use your data

• To create your account, sign you in and keep you signed in.
• To produce your videos: your topic and script are sent to our AI providers to generate ideas, text, narration and images.
• To manage subscriptions, allowances, credits, referrals and promotions, and to prevent fraud and abuse (such as multiple accounts used to claim free credits).
• To provide support and send you service messages (for example, “your video is ready”, receipts, or changes to these policies).
• To keep the Service secure, fix problems and improve it, using aggregated or de-identified data where possible.
• To comply with legal obligations and to enforce our Terms.

Where the law requires a legal basis (for example, under the GDPR), we rely on: performing our contract with you; our legitimate interests in running, securing and improving the Service; your consent where we ask for it; and compliance with legal obligations.

3. Who we share data with

We share personal data only with service providers that help us run DoodleReel, and only as much as they need:

• Supabase — database, authentication and file storage.
• Vercel — website hosting.
• OpenRouter and the AI model providers it routes to (such as Google, OpenAI and ByteDance) — to generate text, voices and images from your topics and scripts.
• Payment providers (such as Lemon Squeezy and PayPal) — to process payments, taxes and refunds. They handle your card details under their own privacy policies.
• Google and Apple — when you sign in with them, and Google/YouTube when you connect a channel.
• Our render servers — computers we operate that assemble your video.

We may also disclose data if required by law, to protect our rights or users’ safety, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply. We do not sell personal data and we do not share it for third-party advertising.

4. YouTube API Services

If you choose to connect your YouTube channel, DoodleReel uses YouTube API Services. By connecting, you agree to the YouTube Terms of Service, and the Google Privacy Policy applies.

• We access only what the feature you use needs: your channel’s basic details, and permission to upload videos, set their title, description, tags and thumbnail, and update channel details you ask us to change.
• We store the access tokens needed to act on your behalf, encrypted, and the IDs of videos we uploaded for you.
• We use YouTube data only to provide the features you asked for. We do not sell it, use it for advertising, or share it with anyone except as needed to provide the feature.
• You can disconnect at any time in DoodleReel, which deletes the stored tokens, or revoke access through Google’s security settings. We delete YouTube data we hold within 30 days of disconnection or of a deletion request, unless the law requires us to keep it.

5. International transfers

Our providers process data in several countries, including the United States and the European Union. When data is transferred across borders, we rely on our providers’ legal safeguards, such as standard contractual clauses, where required.

6. How long we keep data

• Account and content data: for as long as your account is active. You can delete any video at any time from your dashboard.
• After you delete your account, we delete or anonymize your personal data within 30 days, except where we must keep it longer.
• Billing and tax records: as long as tax and accounting laws require (typically up to 7 years).
• Logs and backups: kept for a limited time and then overwritten.
• Data needed to prevent abuse (for example, that an email already claimed a free credit) may be kept in minimal form.

7. Your rights

Depending on where you live (including under the GDPR, the UK GDPR, California law and the Israeli Privacy Protection Law), you may have the right to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data;
• delete your data;
• object to or restrict certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent;
• complain to your local data-protection authority.

To use these rights, email privacy@doodlereel.app from your account email. We may need to verify your identity, and we answer within 30 days.

8. Cookies

We use essential cookies and similar storage to keep you signed in, remember your preferences, and track which invite or promo link brought you (so the right person gets the referral reward). We do not use advertising or cross-site tracking cookies. You can block cookies in your browser, but the app will not work without the essential ones.

9. Security

We use reasonable technical and organizational measures to protect your data, including encrypted connections, access controls and provider-level security. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the authorities where the law requires.

10. Children

The Service is not for anyone under 18, and we do not knowingly collect data from children. If you believe a child gave us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy. If the changes are material, we will tell you by email or in the app before they take effect. The date at the top shows the latest version.

12. Contact

Questions or requests about privacy? Email privacy@doodlereel.app.