Privacy Policy

EggClip turns a written brief into a finished video and, when you ask it to, publishes that video to accounts you connect. This policy describes every category of data that passes through the service, operated by EggClip ("we", "us"). Questions and requests go to support@eggclip.com — we answer from the same address.

Data we collect

Account data

Your email address, display name, password hash (or, if you sign in with Google, the basic profile Google shares: name, email, avatar), workspace memberships, and session records. Used to operate sign-in, email verification, and workspace access — nothing else.

Content you supply

Briefs, ideas, pasted scripts, links you ask us to read, uploaded media, and reference images. This content is the input to generation: we store it with your project and send the relevant parts to the AI providers listed below to produce your video.

Generated content

Scripts, storyboards, voiceovers, images, video clips, and finished renders produced for your projects. Stored in our object storage so your projects stay editable and exportable. Deleting a project deletes its media; see Data deletion.

Billing and usage data

Your credit balance and its full transaction history, subscription state, and per-feature usage records (which operations ran, what they cost). Payments are processed by Dodo Payments as merchant of record: card numbers and payment credentials go directly to them and never touch our servers. We receive confirmation events (what was bought, for which workspace) — not payment instrument details.

Data we receive from YouTube

EggClip uses YouTube API Services. When you connect a YouTube channel, we ask for permission to view basic channel information (to show you which channel is connected) and to upload videos to that channel (to publish on your instruction). We receive and store: your channel's name, ID and thumbnail, and OAuth tokens that authorize uploads.

• We use this data only to publish the videos you tell us to publish and to display the connected channel in your dashboard. We do not run ads against it, and we do not share it with anyone except the processors below, acting on our instructions.
• OAuth tokens are stored until you disconnect the channel or revoke access. Other stored YouTube data is refreshed or deleted within 30 calendar days.
• You can disconnect a channel at any time in your workspace's connection settings, which deletes the stored tokens. In addition to our own deletion procedure, you can revoke EggClip's access to your data via the Google security settings page.
• By using the YouTube features you also interact with Google; see the Google Privacy Policy.

EggClip's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data we receive from Instagram

When you connect an Instagram professional account, we receive and store: your Instagram username, account ID, account type, profile picture, the OAuth token that authorizes publishing, and records of the posts published through EggClip (media, caption, publish status). We use this data only to show you which account is connected and to publish the Reels you tell us to publish. It is not sold, not used for advertising, and not shared beyond the processors below.

Disconnecting the account in your workspace settings deletes the stored token and account data. Removing EggClip from Instagram's own "Apps and Websites" settings has the same effect — Instagram notifies us and we delete the data. Full instructions: Data deletion.

Processors we share data with

We share data only with the services that operate EggClip, only what each one needs, and never for their own advertising:

• AI providers — OpenAI, OpenRouter, fal, and Fish Audio receive the prompt text, reference images, and audio needed to generate your script, images, video clips, and voiceover.
• Dodo Payments — merchant of record for all purchases; handles payment details under its own privacy policy.
• Cloudflare — object storage for uploaded and generated media.
• Amazon Web Services — renders exports when rendering runs in the cloud.
• Resend — sends account email such as verification messages.
• Stock media services — Pexels, Giphy, Pixabay, Openverse, and Wikimedia receive the search terms you (or a generation acting for you) submit when browsing stock media.
• PostHog — product analytics. Receives anonymous page views from this marketing site, and, once you are signed in, a record of which features you use along with your account ID and email address. If you allowed analytics storage, the anonymous identifier described under "Cookies and sessions" below is what links those two together. It never receives your scripts, prompts, or generated media.

We do not sell personal data, and we do not serve third-party advertising.

Cookies and sessions

We ask before storing anything for analytics, and the answer we assume until you give one is no. Until you choose "Allow", our measurement stores nothing on your device: page views are still counted, but each page load is a separate anonymous reading that we cannot join to any other.

If you choose "Allow", we store one first-party cookie containing a random identifier, scoped so that this site and the EggClip app can both read it, kept for six months. It exists to answer one question we cannot otherwise answer: which page someone was reading before they decided to sign up. It holds no name, no email, and no browsing history from anywhere else. It is never sold, never shared with advertisers, and never used to show you an advertisement — we run none.

You can change the answer at any time with Cookie choices at the bottom of any page on this site. Declining deletes the identifier we had stored here immediately, and removes the copy held by the app the next time you open it — browsers keep the two stores separate and neither site can reach into the other's.

Separately from all of the above, signing in sets the cookies required to keep you signed in. Those are necessary for the service to work and are not a choice we can offer to turn off, and they are not used for analytics. Once you are signed in, product analytics is tied to your account ID so we can tell which features are used and which ones break; if you declined storage, that still happens for the events themselves, we simply keep no identifier on your device between visits. Signing out clears the analytics identifier. The checkout pages served by Dodo Payments may set their own cookies under their policy.

How we protect your data

The most sensitive data EggClip holds is what you grant us on connected platforms: your YouTube channel details and the OAuth tokens that authorize uploads, and the equivalent Instagram account data and token. We protect that data, and everything else described above, with the following measures.

• Encrypted in transit. Every connection to EggClip — the site, the app and the API — is served over HTTPS using TLS 1.2 or later. We make no unencrypted requests to the Google or Meta APIs on your behalf.
• Encrypted at rest. Our database and media storage run on managed providers that encrypt stored data at rest.
• Tokens stay on the server. OAuth tokens are never sent to your browser and are never returned by our API. They are used only server-side, to make the calls you instruct — publishing a video, or reading the connected channel's name so we can show it to you.
• Scoped access. Every project, connection and media file belongs to a workspace, and each request is checked against your membership of that workspace. A request for a workspace you are not a member of is refused.
• Least privilege on scopes. We request the narrowest permissions the feature needs — upload and read-only channel identity — and not the broader YouTube scopes that would let an app edit, delete or moderate your existing content.
• Credentials are not in client code. API keys and platform secrets live only in the server environment.
• Deletion is real. Disconnecting a channel or account deletes the stored tokens, and revoking access on Google's or Meta's side has the same effect. See Retention and deletion below.
• Processors are bound. The processors listed above act only on our instructions and may not use your data for their own purposes.

No service can promise perfect security. If a breach affects your personal data, we will notify you and the relevant authorities without undue delay, and tell you what happened and what to do about it.

Retention and deletion

• Projects and their media: kept until you delete them, then removed from storage.
• Account data: kept while the account exists.
• Connected-platform data: tokens until you disconnect or revoke; stored YouTube data refreshed or deleted within 30 days; Instagram data deleted on disconnect or deauthorization.
• Billing records: retained as required for accounting and fraud prevention even after account deletion.
• Deletion requests of any kind — a project, a connection, or the whole account — are honored within 30 days. See Data deletion.

Your rights

You can request a copy of the data we hold about you, correction of it, or deletion of it at any time by writing to support@eggclip.com from your account email. The right to request deletion is available to every user, wherever you are.

Changes

If we change how this service uses personal data, we will update this page and note the change prominently; the date above always reflects the current revision. Continued use after a change means the updated policy applies.

Contact

EggClip · support@eggclip.com — for privacy questions, complaints, and data requests. See also Contact.