OriginShorts ("we", "us", "our") operates the website originshorts.com and provides an AI-powered short-form video generation platform (the "Service"). This Privacy Policy explains how we collect, use, store, and share your personal information when you use the Service.
By using the Service, you agree to the collection and use of information as described in this Privacy Policy. Terms not defined here have the meanings given in our Terms of Service.
1. Information We Collect
Information You Provide
- Account information: Email address, username, and authentication credentials when you create an account (directly or via Google sign-in).
- Content you create: Scripts, topics, prompts, and generation settings you provide to create videos.
- Voice recordings (optional): If you use voice cloning, we store the short voice recording you upload and the transcript you provide with it. The recording is used only to synthesize narration in that voice and is deleted when you delete the cloned voice or your account. See Section 4 for how it is processed.
- Payment information: Processed by our payment provider (see Section 5). We do not store your credit card or bank details.
Information Collected Automatically
- Usage data: Pages visited, features used, video generation activity, credits consumed, and timestamps.
- Device and access data: IP address, browser type, and referring URLs. When you request a sign-in code, we record the email address, IP address, and browser information of the request and retain it for up to 30 days for rate limiting and abuse prevention. Signup attempts we reject (for example, from disposable email domains) are recorded with the same details and retained for up to 90 days. IP addresses may also appear in infrastructure-level logs as part of standard web server operation.
- Cookies: See Section 8.
2. How We Use Your Information
We use your information to:
- Provide, maintain, and improve the Service
- Process your video generation requests
- Manage your account and subscription
- Process payments and maintain transaction records
- Send transactional emails (account verification, password resets, subscription notifications, deletion confirmations)
- Send service-related notifications (e.g., automated series updates, low credit alerts)
- Monitor and enforce our Terms of Service
- Comply with legal obligations
We do not sell your personal information. We do not use your content to train our own AI models. Our AI service providers process your content solely to generate your videos, in accordance with their respective terms of service.
3. Legal Basis for Processing (EEA/UK Users)
If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:
- Contract performance: Account management, video generation, payment processing, and transactional communications are necessary to provide the Service you requested.
- Legitimate interests: Usage analytics, security monitoring, rate limiting, and service improvement, where these interests are not overridden by your rights.
- Legal obligation: Retaining financial records and responding to lawful requests.
- Consent: Where applicable, such as optional analytics cookies. You may withdraw consent at any time.
4. Data Sharing
We do not share your personal information with third parties except as described below.
Connected AI applications
You can connect third-party AI assistants (such as ChatGPT or Claude) to your OriginShorts account through an authorization flow. When you approve a connection, that application can create videos on your behalf and read your videos and credit balance through our API, acting under your account. We share no other personal data with the connected application. You can revoke a connection at any time from your account page (API keys, under the app's "connected app" entry), which immediately ends its access.
Service Providers
We use third-party service providers to operate the Service. These providers process data on our behalf under contractual obligations and are not permitted to use your data for their own purposes. Categories of providers include:
- AI generation providers: We send your scripts, topics, prompts, and narration audio to AI service providers to generate the text, images, speech, and video that make up your videos. If you use voice cloning, your uploaded voice recording is transmitted to our AI voice provider each time that voice is used for narration. These providers process your content solely to produce your videos and currently include, for example, OpenAI, Anthropic, Replicate, and ElevenLabs; the specific providers may change as we improve the Service. Your email address is never sent to them.
- Payment processor (Paddle): Paddle.com is our merchant of record and processes payments, subscriptions, and tax compliance. Paddle receives your email address, subscription plan, and billing information, along with an internal account identifier and analytics identifiers we attach to link purchases to their traffic source.
- Infrastructure and security (Cloudflare): Generated media files and voice-clone recordings are stored with Cloudflare. Cloudflare also provides our sign-in human-verification check, which processes your IP address, and hosts the authorization infrastructure for connected AI applications.
- Email delivery (Resend): Transactional emails are sent through Resend, which receives your email address and message content.
- Analytics (DataFast and Google Analytics): DataFast collects traffic and usage statistics for all visitors using cookie-based visitor and session identifiers, which are also used to attribute purchases to their traffic source. Google Analytics collects aggregate usage statistics and is set only if you consent through our cookie banner.
- Support chat (tawk.to): Our support chat widget is provided by tawk.to. If you are signed in, we share your email address with tawk.to so we can identify you in support conversations, and your chat transcripts are stored by tawk.to.
- Error monitoring: When something breaks, an internal alert containing the error details and internal account and video identifiers (never your email address) is delivered to our operations team through Telegram.
- Social publishing (Post For Me): If you connect a YouTube, TikTok, or Instagram account for auto-posting, the connection is managed by Post For Me, which holds the platform authorization tokens. We store your channel name and profile image, and send your videos and captions to Post For Me for publishing. Disconnecting an account or deleting your OriginShorts account revokes the connection.
- Video rendering (Fly.io): Final video assembly runs on Fly.io infrastructure, which receives your video's script, captions, and media files but no account identifiers.
- Authentication provider (Google): If you sign in with Google, we receive your email address and email verification status through Google OAuth. We request only the profile and email scopes.
- Font and CDN providers: Third-party services deliver fonts and media assets. Standard web requests (including your IP address) are visible to these providers.
Legal Requirements
We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of OriginShorts, our users, or the public.
5. International Data Transfers
Our service providers are located in the United States, United Kingdom, and the European Union, with some operating globally via content delivery networks. If you are located outside these regions, your data may be transferred to and processed in countries with different data protection laws than your own. We rely on appropriate safeguards for such transfers, including standard contractual clauses where required.
6. Data Retention
- Account data: Retained until you delete your account.
- Videos and media files: Retained until you delete your account.
- Activity logs: Retained until you delete your account.
- Financial transaction records: Anonymized upon account deletion (user identifier replaced with a placeholder) and retained for financial and legal compliance purposes.
- Sign-in and abuse-prevention records: Sign-in verification records (email, IP address, browser information) are deleted automatically after 30 days; records of rejected signup attempts after 90 days. These security records are retained for their full window even if the associated account is deleted sooner.
- Error and diagnostic logs: Deleted automatically after 180 days.
- System logs: May be partially retained for security and audit purposes.
- Aggregate analytics: Retained indefinitely. These are statistical summaries not linked to individual users.
Account Deletion
You can delete your account at any time through your account settings or by contacting us at [email protected]. When you request deletion:
- Your subscription is cancelled immediately.
- All active sessions are invalidated.
- A 30-day grace period begins, during which you may reactivate your account.
- You will receive a reminder email 5 days before permanent deletion.
- After 30 days, your account, videos, media files, activity logs, and authentication records are permanently deleted.
- Financial transaction records are anonymized and retained for compliance.
- A confirmation email is sent upon completion.
7. Your Rights
All Users
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate personal information
- Delete your account and associated data
- Request a copy of your data in a portable format
EEA/UK Users (GDPR)
In addition, you have the right to:
- Restrict processing of your personal data
- Object to processing based on legitimate interests
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with your local data protection authority
California Users (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose
- Request deletion of your personal information
- Opt out of the sale or sharing of personal information (we do not sell or share your personal information as defined by the CCPA)
- Non-discrimination for exercising your privacy rights
To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law (generally within 30 days for GDPR or 45 days for CCPA requests).
8. Cookies
We use the following cookies and similar technologies:
- Session cookie: Required for authentication. Expires on logout or session timeout.
- OAuth state cookie: Used during Google sign-in to prevent cross-site request forgery. Short-lived.
- Cookie consent cookie: Stores your cookie preferences. Persistent.
- Analytics cookies: DataFast sets visitor and session identifier cookies for traffic measurement and purchase attribution. Google Analytics cookies are set only if you consent through our cookie banner.
- Support chat cookies: tawk.to sets cookies to maintain your chat session across pages.
- Security tokens: Cloudflare's human-verification check may store short-lived tokens in your browser as part of bot protection.
You can manage your cookie preferences through the cookie consent banner displayed on our website.
9. Children's Privacy
The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. Users between 13 and 18 must have parental or guardian consent to use the Service, as stated in our Terms of Service. If we become aware that we have collected personal information from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].
10. Security
We use commercially reasonable technical and organizational measures to help protect your personal information, including encrypted data transmission, secure authentication, session management, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of changes by posting the updated policy on this page with a revised "last updated" date. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.