Privacy Policy

OfflineContent (operated by Flames Media, Denmark). Last updated: 27 June 2026.

OfflineContent helps creators turn their own stream recordings into short videos and publish them to their own connected social accounts. This policy explains what data we process, why, and your rights. We are based in the EU and follow the GDPR.

What we collect

Account — your email address and a user id (via our auth provider, Supabase), and your credit balance.
Connected platform tokens — when you connect TikTok, YouTube, or Twitch, we store the OAuth access/refresh tokens needed to act on your behalf. Tokens are encrypted at rest and are never shown to you or any other user.
Source video data — for a video you choose to process, we fetch its audio, generate a transcript, and identify candidate clips. We store transcripts, clip candidates, layouts, and the produced short videos.
Posting metadata — the title, caption, hashtags, and posting options you set for a short.

How we use TikTok data

We use the TikTok Content Posting API only to publish videos you explicitly choose to post to your own connected TikTok account.
We query TikTok creator_info solely to show you which account you are posting to and the audience/interaction options your account allows, before you post.
We do not read, store, or analyse your TikTok content, followers, or activity. We do not post without your explicit action.
You can disconnect TikTok at any time in Settings, which deletes the stored tokens.

How we use YouTube and Twitch data

YouTube — we request only youtube.readonly (to show which channel is connected and the status of videos you publish through the app) and youtube.upload (to upload videos you explicitly choose to publish to your own channel, with the title, description, and visibility you set). Nothing is uploaded or changed without your action, and we request no broader channel-management scopes. Use of YouTube data is also subject to the Google Privacy Policy.
Twitch — to list your past broadcasts and highlights and download a video you choose to process.

Google API Services — Limited Use

OfflineContent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer YouTube/Google user data to third parties except as needed to provide or improve a feature you requested, for security, or to comply with law; we do not use it for advertising; and we do not use it to train generalised AI/ML models. You can revoke access at any time by disconnecting in Settings or via your Google Account permissions; disconnecting deletes the stored tokens.

Data security

We apply technical and organisational measures to protect your data, especially the sensitive platform credentials you entrust to us:

In transit — all traffic runs over HTTPS/TLS.
At rest — your OAuth access/refresh tokens are encrypted before they are written to our database, using authenticated encryption (AES-128-CBC with HMAC-SHA256, via Fernet). The encryption key is held server-side in our runtime environment, separate from the database, and tokens are decrypted only server-side at the moment an API call you initiated needs them. A database leak or backup alone does not expose usable credentials.
Per-user isolation — media and transcripts are stored in object storage scoped to your account; tokens are never shown to you or any other user.
Access control — production secrets and the encryption key are restricted to the systems that run the service. We do not access the content of your connected accounts except to perform an action you requested, for security, or to comply with law.

AI processing

To find clips and draft titles/descriptions, transcript text is sent to our AI provider (via OpenRouter) through a server-side proxy. We do not send your platform tokens to the AI provider.

Where data is stored

Account data: Supabase. Media and transcripts: Cloudflare R2 object storage, isolated per user. We process on Cloudflare and Modal infrastructure.

Retention

Source audio is not persisted after transcription.
Produced short videos are auto-deleted after the plan's retention window (14 days on the beta plan).
Transcripts, clip candidates, and your settings are kept until you delete the video or your account.
Platform tokens are kept until you disconnect that platform or delete your account.

Your rights (GDPR)

You can export or delete your account yourself from the Account page. Export gives you a copy of your data; deletion is permanent and removes your stored data, media, settings, and platform connections. We retain billing/invoice records as required by Danish accounting law (5 years), even after deletion. Disconnecting a platform removes its stored tokens (and we also attempt to revoke them at the platform). For any request we can't self-serve, contact us below — we respond within one month.

Cookies

We use only strictly-necessary cookies (your sign-in session and an OAuth security cookie) and no analytics or tracking. See our Cookie Policy for the full list.

Sharing

We do not sell your data. We share data only with the processors needed to run the service (Supabase, Cloudflare, Modal, OpenRouter, and Stripe for payments) and with the platforms you explicitly publish to (TikTok, YouTube), at your direction. Billing and invoice records are retained as required by Danish accounting law (5 years), even after you delete your account.

Contact

Questions or data requests: [email protected].