Cuplikin is a local-first video application for macOS, iPhone, iPad, and Android, operated by Ghozi Mahdi. This Privacy Policy explains which information stays on your device, which information is processed when you choose online features, why it is used, and the choices available to you.
1. Local-first design
Your local project catalog, source video files, locally generated audio and transcripts, editor state, captions, Final Clips, and exported files remain on your device by default. Cuplikin does not automatically synchronize those files to your account. Audio leaves your device only when you choose cloud transcription, as described in section 2.
On iPhone, iPad, and Android, videos or images you pick are copied into Cuplikin's own storage on your device so the project keeps working, and Final Clips you export are saved to your device's photo library. These files stay on your device.
Having a Cuplikin account does not mean that your entire workspace is uploaded. Information is sent only for the online features you choose and only with the context needed to provide those features.
2. Information we process
Account and session information
We process your email address, password hash, account status, legal-document acceptance, verification status, and session records to register and authenticate your account, verify your email, protect sessions, and recover access. Cuplikin does not store your plaintext password. When you reset your password or request account deletion by email, we store a one-time link record in which only a hash of the link is kept.
Sign in with Apple and Google
If you choose Sign in with Apple or Sign in with Google, we receive from that provider a stable account identifier, the email address the provider shares, and whether that address is verified. With Sign in with Apple you may share a private relay address (ending in @privaterelay.appleid.com) instead of your real email. We never receive your Apple or Google password. Apple may also share your name the first time you sign in; Cuplikin does not store it.
We use this information to create or sign in to your Cuplikin account. If the provider confirms an email address that already belongs to a Cuplikin account, the provider is linked to that account. For Sign in with Apple we also store, in encrypted form, a token Apple issues so that we can revoke Cuplikin's access to your Apple ID when you delete your account.
Device and network security information
We process a pseudonymous installation identifier, platform type, minimized or hashed network-prefix information, request identifiers, rate-limit records, and security events to prevent abuse, protect free-credit eligibility, secure the service, and diagnose failures. Ordinary application logs are designed not to contain passwords, access tokens, provider secrets, raw transcripts, local file paths, or raw resolver URLs.
App diagnostics and usage
On macOS, iPhone, iPad, and Android, Cuplikin uses Google Firebase:
- Firebase Crashlytics receives crash reports and diagnostic messages about errors and stalls, together with device model, operating system and app version, and a Crashlytics installation identifier, so that we can find and fix problems.
- Firebase Analytics receives which screens of the app are viewed, together with an app-instance identifier and device, operating system, app version, and approximate-region information, so that we can understand which features are used.
- Firebase Remote Config uses a Firebase installation identifier to deliver app configuration, such as update notices.
Cuplikin does not send your account email, account identifier, video content, transcripts, or file names to Firebase on purpose, and does not use Firebase information for advertising.
Credits, subscriptions, and purchases
We process your account tier, credit balance and ledger, entitlements, provider product identifiers, and transaction, restore, refund, and reconciliation records. Apple (App Store) and Google (Google Play) process payments. RevenueCat assists with subscription, entitlement, and purchase-state management. Cuplikin does not receive or store your full payment-card details.
Hosted AI information
When you choose Cuplikin Cloud, we process the timestamped transcript, video title and duration metadata, language or locale, permitted instructions, AI output, hook candidates, scores, reasons, and operational provenance needed to run the analysis, return results, record credit use, and provide hosted history.
The hosted hook-analysis path does not receive the local source-video binary, local file paths, Final Clips, exported files, or a custom-provider API key from the Cuplikin app.
Cloud transcription information
When you choose cloud transcription instead of on-device transcription (available on plans that include it), the Cuplikin app extracts the audio track from the source video you selected, compresses it on your device, and uploads only that audio together with its duration, size, checksum, and the selected language. The video picture, other project files, local file paths, and file names are not uploaded. Cuplikin's hosted service sends the audio through a router operated by Cuplikin to a third-party speech-to-text provider and returns a timestamped transcript to the app.
The uploaded audio is deleted from Cuplikin's servers as soon as the speech-to-text request finishes, fails, or is cancelled; any remaining copy is removed automatically within about 24 hours of upload. The transcript produced by the service is kept for about 24 hours so the app can download it, and is then deleted from Cuplikin's servers. After download, the transcript is stored in your local project like an on-device transcript.
URL resolver information
When you ask Cuplikin to import from a supported URL, we process the submitted URL, resolver job status, technical metadata, and temporary resolver output needed to complete the request, enforce limits, prevent duplicate jobs, and support troubleshooting. Temporary resolver output is retained only for the operational period configured for the service and may expire automatically.
Support communications
When you use Help & Support or send feedback, we store your user ID, account email, username, selected message type, and message. Account identity is obtained from your authenticated account, not from editable form fields. The username currently uses the part of your account email before @. We also retain a request reference and notification delivery status to process the message reliably. We store the message on Cuplikin's servers to handle and follow up on your request. An email notification containing these details is sent to the developer at ghozi.dev@gmail.com through our email delivery provider. The in-app form does not request a reply email or subject, and does not send an app version, platform, videos, or device logs. Information you voluntarily include in a direct email is also used to handle your request.
Device permissions
Cuplikin asks for access to your photo library or media files only when you add videos or images to a project or save an exported clip. You can change these permissions at any time in your device settings.
3. How we use information
We use information to:
- provide authentication, sign-in with Apple and Google, email verification, password recovery, credits, entitlements, hosted analysis, URL resolving, and support;
- operate, secure, maintain, and improve service reliability, including crash diagnostics;
- understand which app screens and features are used;
- prevent fraud, abuse, duplicated operations, and unauthorized access;
- process purchases, restores, refunds, and subscription status;
- comply with applicable transaction, audit, security, and legal obligations; and
- enforce our Terms of Use.
Cuplikin does not create training datasets from your projects, transcripts, corrections, selections, history, or feedback. AI providers process requests according to their own service policies and account settings. Cuplikin does not claim zero retention by those providers. Choose local processing if you want your content to remain on your device.
4. AI processing choices
Local or built-in mode
When AI processing runs fully on your device, the content follows the local processing path and does not use Cuplikin Cloud credits.
Custom provider
When you configure a custom AI provider, the information you submit is sent according to your configuration. The provider's privacy terms govern its processing. Cuplikin stores custom-provider credentials in secure on-device storage and does not send those credentials to the Cuplikin backend for hosted analysis.
Cuplikin Cloud
When you explicitly choose Cuplikin Cloud, the minimum transcript and instruction context needed for analysis is sent to Cuplikin's hosted service and its AI processing provider or router. Cuplikin Cloud does not silently upload your entire local workspace. When you choose cloud transcription, the compressed audio described in section 2 is sent instead of a transcript.
5. Service providers and disclosures
Cuplikin may share the minimum necessary information with:
- Apple, for App Store distribution, in-app purchases, Sign in with Apple, and ratings or reviews you submit through Apple's interface;
- Google, for Google Play distribution and in-app purchases, Sign in with Google, and Firebase Crashlytics, Analytics, and Remote Config;
- RevenueCat, for subscription, entitlement, purchase, restore, and refund state;
- an email delivery provider, for account verification, password reset, and account deletion emails, and support or feedback email notifications;
- third-party AI model providers, through a router operated by Cuplikin, to process Cuplikin Cloud requests and cloud transcription that you initiate. Requests may be routed to different providers depending on availability, and these providers process the data only to return the result;
- a server infrastructure provider in Singapore, for hosting Cuplikin's servers; and
- authorities or professional advisers when disclosure is legally required or necessary to protect users, the service, or legal rights.
We do not sell personal information and do not share personal information for cross-app advertising tracking.
6. Retention
Local media remains under your control on your device. Hosted information is retained only for as long as reasonably necessary to provide the relevant feature, maintain security and transaction records, resolve disputes, comply with law, and enforce agreements.
Password reset and account deletion links expire after a short time and can be used only once. URL-resolver output is temporary. Cloud transcription audio and results are deleted from Cuplikin's servers within about 24 hours, as described in section 2. Download links expire according to the service configuration; link expiry does not guarantee that the underlying file is physically deleted at the same time. Support and feedback messages are retained for handling and follow-up until no longer needed or deletion is requested. Crash reports and analytics data are kept by Google according to the Firebase retention periods. Account, billing, credit, security, and legal-acceptance records may be retained longer where needed for fraud prevention, accounting, audit, chargeback, or legal obligations. When you delete your account, data not subject to a continuing legal or security requirement is deleted or de-identified automatically once the recovery window described in section 8 has elapsed.
7. Security
Cuplikin uses access controls, owner scoping, authentication, rate limits, secure on-device credential storage, HTTPS in transit, encryption of stored provider tokens, and safeguards for hosted data. No system is completely risk-free. You should secure your device, use a strong password, and report suspicious activity promptly.
8. Your choices and rights
Depending on applicable law, you may request access to, correction of, export of, or deletion of personal information associated with your account. You may also:
- delete your account from inside the app or on the web;
- choose local, custom-provider, or hosted processing before analysis;
- remove local projects and media from your device;
- revoke the current session by logging out;
- change photo library and media permissions in your device settings; and
- manage or cancel subscriptions through Apple or Google Play.
You can delete your Cuplikin account yourself, without contacting us, in either of these ways:
- In the app: open the account menu and choose Delete account, or open Manage subscription and use the same option at the bottom of the page. Confirm with your account password, or, for an account that signs in with Apple or Google, by signing in with that provider again.
- On the web: open https://cuplikin.com/delete-account, enter your account email, and confirm through the link we send to that address. This works for every account, including accounts that sign in with Apple or Google.
Your sessions are revoked immediately, the account can no longer be used to sign in, and your personal information is erased automatically within 7 days, a short recovery window that guards against account takeover and abuse; the confirmation states the exact date. For accounts that used Sign in with Apple, Cuplikin's access to your Apple ID is revoked at the same time. Records we must keep for accounting, tax, fraud-prevention, or other legal obligations are retained without your identity attached.
Your local projects, source videos, and exported clips stay on your device. Deleting the account never removes files from your computer, phone, or tablet. Deleting a Cuplikin account does not automatically cancel an App Store or Google Play subscription; manage the subscription separately in that store.
For other privacy requests such as access, correction, or export, use Settings → Help & Support and select the relevant category, or email hello@cuplikin.com from the address associated with your Cuplikin account.
9. Children
Cuplikin is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can review and delete it where required.
10. International processing
Service providers may process information in countries other than your own. Where required, we use appropriate safeguards for international transfers and limit processing to the purposes described in this policy.
11. Changes to this policy
We may update this policy when features, providers, security practices, or legal requirements change. Material changes will be communicated in the app or through another appropriate channel before they take effect when required.
12. Contact
Data controller and developer: Ghozi Mahdi
Product: Cuplikin
Privacy, support, and deletion requests: hello@cuplikin.com
Account deletion: https://cuplikin.com/delete-account
Support page: https://cuplikin.com/support/en/