Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect:

• Email address (required for authentication via Supabase)
• Display name (optional)
• Subscription tier (Free, Founders, Pro, Enterprise)
• Stripe customer ID (for paid subscriptions)
• Founders number (1-100, for Founders tier subscribers)

Usage Data

We automatically collect information about your interactions with our Service:

• Video generation requests (story ID, timestamp, video URL)
• Video playback data (watch duration, completion rate)
• Topic preferences and personalization data
• Search queries and category selections
• Device information (browser type, OS, screen resolution)
• IP address and geographic location (for analytics)

AI-Generated Content

When you generate videos using our AI service, we store:

• Generated video files (MP4 format)
• AI-generated scripts and subtitles
• AI-selected images and narration audio
• Video metadata (trust scores, sentiment, quality metrics)

2. How We Use Your Information

We use collected information for the following purposes:

Service Delivery

• Authenticate your account and process logins
• Generate AI-powered news videos from RSS feed stories
• Track video generation quotas and subscription limits
• Deliver personalized news feed recommendations
• Store and serve generated videos via AWS S3

Personalization

• Analyze your watch history to recommend relevant topics
• Calculate topic preference scores with recency weighting
• Customize your homepage feed based on viewing patterns

Analytics and Improvement

• Monitor Service performance and uptime
• Analyze user engagement metrics (video views, completion rates)
• Identify trending topics and content preferences
• Debug technical issues and improve AI models

Business Operations

• Process subscription payments via Stripe
• Send transactional emails (account confirmations, quota warnings)
• Enforce Terms of Service and prevent abuse
• Comply with legal obligations and respond to lawful requests

3. Third-Party Services

We integrate with the following third-party providers who may collect and process your data:

Essential Services

• Supabase (Database & Authentication) - Stores user accounts, video metadata, and preferences. Data hosted in AWS us-east-1 region.
• Stripe (Payment Processing) - Processes subscription payments and stores billing information. Subject to Stripe's Privacy Policy.
• AWS (Video Hosting) - Stores generated videos in S3 bucket (eu-north-1 region). Videos are publicly accessible via signed URLs.

AI Model Providers

• OpenAI (ChatGPT & TTS) - Generates video scripts, subtitles, and AI narration. Story content is sent to OpenAI API for processing.
• Perplexity AI - Searches for high-quality images based on story content. Search queries contain story keywords and topics.

Analytics

• Vercel Analytics - Tracks page views, user sessions, and performance metrics. No personally identifiable information is shared.

4. Data Retention

User Accounts: Retained until you request account deletion.

Generated Videos: Stored indefinitely on AWS S3. You can request deletion of specific videos via your account settings.

Daily Trailers: Archived after 14 days. Expired trailers are automatically deleted from our database and S3 bucket.

Usage Analytics: Aggregated and anonymized after 90 days.

5. Cookies and Tracking

We use the following types of cookies:

• Essential Cookies: Supabase authentication tokens (required for login)
• Functional Cookies: User preferences (theme, topic selections)
• Analytics Cookies: Vercel Analytics for page view tracking

You can disable cookies in your browser settings, but this may affect Service functionality (e.g., inability to log in).

6. Data Security

We implement industry-standard security measures to protect your information:

• HTTPS/TLS encryption for all data transmission
• Supabase Row Level Security (RLS) policies on database tables
• API key authentication for Lambda function access
• Stripe PCI DSS Level 1 compliance for payment data
• Regular security audits and dependency updates

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.

7. Your Rights (GDPR & CCPA)

You have the following rights regarding your personal data:

GDPR Rights (EU Users)

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your account and data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Export your data in machine-readable format
• Right to Object: Opt-out of personalized recommendations

CCPA Rights (California Users)

• Right to Know: Request disclosure of collected personal information
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do not sell personal information
• Right to Non-Discrimination: Exercise rights without penalty

To exercise these rights, contact us at food@choppedonions.xyz with "Data Request" in the subject line.

8. Children's Privacy

Our Service is not intended for children under 13. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your residence, including the United States and European Union. We ensure adequate safeguards are in place through:

• Supabase Standard Contractual Clauses (SCCs)
• AWS Data Processing Addendum (DPA)
• Stripe Privacy Shield certification

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via:

• Email notification to your registered email address
• Prominent notice on our website
• In-app notification upon next login

Continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Email: food@choppedonions.xyz

Twitter/X: @choppedonionsai

Response time: We aim to respond to all privacy-related inquiries within 30 days.