OriginShorts ("we", "us", "our") operates the website originshorts.com and provides an AI-powered short-form video generation platform (the "Service"). This Privacy Policy explains how we collect, use, store, and share your personal information when you use the Service.
By using the Service, you agree to the collection and use of information as described in this Privacy Policy. Terms not defined here have the meanings given in our Terms of Service.
1. Information We Collect
Information You Provide
- Account information: Email address, username, and authentication credentials when you create an account (directly or via Google sign-in).
- Content you create: Scripts, topics, prompts, and generation settings you provide to create videos.
- Voice recordings (optional): If you clone your voice, we store the short recording of your own voice that you upload, with your consent. It is used only to narrate your videos in that voice and is never sold. It is deleted when you delete the cloned voice or your account, and in any case 3 years after the voice was last used; a recording you upload but never turn into a voice is deleted within 2 days. See Section 4 for how it is processed.
- Payment information: Processed by our payment provider (see Section 5). We do not store your credit card or bank details.
Information Collected Automatically
- Usage data: Pages visited, features used, video generation activity, credits consumed, and timestamps.
- Device and access data: IP address, browser type, and referring URLs. When you request a sign-in code, we record the email address, IP address, and browser information of the request and retain it for up to 30 days for rate limiting and abuse prevention. Signup attempts we reject (for example, from disposable email domains) are recorded with the same details and retained for up to 90 days. IP addresses may also appear in infrastructure-level logs as part of standard web server operation.
- Site analytics: We measure visits with our own analytics, which runs on our servers, and with Datamogger (datamogger.com), an analytics service we also run. They record the pages you view, the site or campaign link you arrived from, your device and browser type, and your approximate location (country, region, and city, derived from your IP address, which they do not store). When you are signed in, our own analytics links this activity to your account, and purchases are linked to the visit that led to them.
- Cookies: See Section 8.
2. How We Use Your Information
We use your information to:
- Provide, maintain, and improve the Service
- Process your video generation requests
- Manage your account and subscription
- Process payments and maintain transaction records
- Send transactional emails (account verification, password resets, subscription notifications, deletion confirmations)
- Send service-related notifications (e.g., automated series updates, low credit alerts)
- Monitor and enforce our Terms of Service
- Comply with legal obligations
We do not sell your personal information. We do not use your content to train our own AI models. Our AI service providers process your content solely to generate your videos, in accordance with their respective terms of service.
3. Legal Basis for Processing (EEA/UK Users)
If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:
- Contract performance: Account management, video generation, payment processing, and transactional communications are necessary to provide the Service you requested.
- Legitimate interests: Usage analytics, security monitoring, rate limiting, and service improvement, where these interests are not overridden by your rights.
- Legal obligation: Retaining financial records and responding to lawful requests.
- Consent: Where applicable, such as optional analytics cookies. You may withdraw consent at any time.
4. Data Sharing
We do not share your personal information with third parties except as described below.
Connected AI applications
You can connect third-party AI assistants (such as ChatGPT or Claude) to your OriginShorts account through an authorization flow. When you approve a connection, that application can create videos on your behalf and read your videos and credit balance through our API, acting under your account. We share no other personal data with the connected application. You can revoke a connection at any time from your account page (API keys, under the app's "connected app" entry), which immediately ends its access.
Service Providers
We use third-party service providers to operate the Service. These providers process data on our behalf under contractual obligations and are not permitted to use your data for their own purposes. Categories of providers include:
- AI generation providers: We send your scripts, topics, prompts, and narration audio to AI service providers to generate the text, images, speech, and video that make up your videos. If you use voice cloning, your uploaded voice recording is transmitted to our AI voice provider each time that voice is used for narration. These providers process your content solely to produce your videos and currently include, for example, OpenAI, Anthropic, Replicate, and ElevenLabs; the specific providers may change as we improve the Service. Your email address is never sent to them.
- Payment processor (Paddle): Paddle.com is our merchant of record and processes payments, subscriptions, and tax compliance. Paddle receives your email address, subscription plan, and billing information, along with an internal account identifier and analytics identifiers we attach to link purchases to their traffic source.
- Infrastructure and security (Cloudflare): Generated media files and voice-clone recordings are stored with Cloudflare. Cloudflare also provides our sign-in human-verification check, which processes your IP address, and hosts the authorization infrastructure for connected AI applications.
- Email delivery (Resend): Transactional emails are sent through Resend, which receives your email address and message content.
- Analytics (Google Analytics): Google Analytics collects aggregate usage statistics and is set only if you consent through our cookie banner.
- Support chat (tawk.to): Our support chat widget is provided by tawk.to. If you are signed in, we share your email address with tawk.to so we can identify you in support conversations, and your chat transcripts are stored by tawk.to.
- Error monitoring: When something breaks, an internal alert containing the error details and internal account and video identifiers (never your email address) is delivered to our operations team through Telegram.
- Social publishing (Post For Me): If you connect a YouTube, TikTok, or Instagram account for auto-posting, the connection is managed by Post For Me, which holds the platform authorization tokens. We store your channel name and profile image, and send your videos and captions to Post For Me for publishing. Disconnecting an account or deleting your OriginShorts account revokes the connection.
- Video rendering (Fly.io): Final video assembly runs on Fly.io infrastructure, which receives your video's script, captions, and media files but no account identifiers.
- Authentication provider (Google): If you sign in with Google, we receive your email address and email verification status through Google OAuth. We request only the profile and email scopes.
- Font and CDN providers: Third-party services deliver fonts and media assets. Standard web requests (including your IP address) are visible to these providers.
Legal Requirements
We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of OriginShorts, our users, or the public.
5. International Data Transfers
Our service providers are located in the United States, United Kingdom, and the European Union, with some operating globally via content delivery networks. If you are located outside these regions, your data may be transferred to and processed in countries with different data protection laws than your own. We rely on appropriate safeguards for such transfers, including standard contractual clauses where required.
6. Data Retention
- Account data: Retained until you delete your account.
- Videos and media files: Retained until you delete your account.
- Activity logs: Retained until you delete your account.
- Financial transaction records: Anonymized upon account deletion (user identifier replaced with a placeholder) and retained for financial and legal compliance purposes.
- Sign-in and abuse-prevention records: Sign-in verification records (email, IP address, browser information) are deleted automatically after 30 days; records of rejected signup attempts after 90 days. These security records are retained for their full window even if the associated account is deleted sooner.
- Error and diagnostic logs: Deleted automatically after 180 days.
- Voice recordings: Deleted when you delete the cloned voice or your account, and automatically 3 years after the voice was last used. A recording uploaded but never turned into a voice is deleted automatically within 2 days.
- System logs: May be partially retained for security and audit purposes.
- Site analytics: Visit records are deleted automatically after 36 months; only anonymous daily totals are kept beyond that. Visit records are unlinked from your account when you delete it.
- Backups: Our database is backed up daily, and each encrypted backup is kept for up to 60 days, solely to recover from failures. Data you delete, including a deleted account, can remain in these backups until they expire.
Account Deletion
You can delete your account at any time through your account settings or by contacting us at [email protected]. When you request deletion:
- Your subscription is cancelled immediately.
- All active sessions are invalidated.
- A 30-day grace period begins, during which you may reactivate your account.
- You will receive a reminder email 5 days before permanent deletion.
- After 30 days, your account, videos, media files, activity logs, and authentication records are permanently deleted, and site analytics are unlinked from your account.
- Copies in our encrypted database backups expire within 60 days after that.
- Financial transaction records are anonymized and retained for compliance.
- A confirmation email is sent upon completion.
7. Your Rights
All Users
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate personal information
- Delete your account and associated data
- Request a copy of your data in a portable format
EEA/UK Users (GDPR)
In addition, you have the right to:
- Restrict processing of your personal data
- Object to processing based on legitimate interests
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with your local data protection authority
California Users (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose
- Request deletion of your personal information
- Opt out of the sale or sharing of personal information (we do not sell or share your personal information as defined by the CCPA)
- Non-discrimination for exercising your privacy rights
To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law (generally within 30 days for GDPR or 45 days for CCPA requests).
8. Cookies
We use the following cookies and similar technologies:
- Session cookie: Required for authentication. Expires on logout or session timeout.
- OAuth state cookie: Used during Google sign-in to prevent cross-site request forgery. Short-lived.
- Cookie consent cookie: Stores your cookie preferences. Persistent.
- Analytics cookies: Our own analytics and Datamogger each set a visitor identifier (kept up to 400 days) and a session identifier (30 minutes) to measure visits; ours also links purchases to the visit that led to them. Google Analytics cookies are set only if you consent through our cookie banner.
- Support chat cookies: tawk.to sets cookies to maintain your chat session across pages.
- Security tokens: Cloudflare's human-verification check may store short-lived tokens in your browser as part of bot protection.
You can manage your cookie preferences through the cookie consent banner displayed on our website.
9. Children's Privacy
The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. Users between 13 and 18 must have parental or guardian consent to use the Service, as stated in our Terms of Service. If we become aware that we have collected personal information from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].
10. Security
We use commercially reasonable technical and organizational measures to help protect your personal information, including encrypted data transmission, secure authentication, session management, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of changes by posting the updated policy on this page with a revised "last updated" date. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.