This policy explains what personal data Cinemac ("we", "us") collects when you use the Cinemac app for Mac, the website at cinemac.app and the services around them, why we collect it, and what you can do about it. Cinemac is the controller of that data.
Questions, requests or complaints: bharat@innoventuresai.com.
The short version
- Your screen recordings, camera video, microphone audio, transcripts and projects are processed and stored on your Mac. We never receive them, unless you choose to make a share link.
- To run your account we keep your email address, your plan, and a short list of your Macs.
- Stripe processes payments for us. We never see or store your full card number.
- We don't sell your data, and the app has no ads, analytics or tracking. Our website uses Google's tags to measure visits and ads, and you can turn them off.
1. What stays on your Mac
These are handled only on your computer, and we have no access to them:
- Recordings and projects: screen video, system audio, microphone audio, camera video, takes, edits, presets and exports.
- Transcripts and captions: transcription runs on your Mac with a speech model that you download when you ask for it.
- Face and body analysis: camera framing and background removal use Apple's on-device Vision framework. No face data or biometric template leaves your Mac or reaches us.
- Clicks, pointer movement and keystrokes: Cinemac logs clicks and pointer movement during a recording so it can zoom and redraw the cursor. If you turn on the keyboard overlay (it needs Input Monitoring), keystrokes are logged during recording to show shortcuts on screen. This log is stored with the recording on your Mac and is never sent to us.
- Your AI provider keys: ElevenLabs and HeyGen keys are kept in your Mac's Keychain.
The permissions Cinemac asks macOS for (Screen Recording, Microphone, Camera, Input Monitoring and Accessibility) are used only for these features, on your Mac.
2. What we collect
| Data | Where it comes from | Why we use it | Legal basis (EU and UK) |
|---|---|---|---|
| Email address | You, when you sign in | To create your account, send sign-in codes, receipts and important account messages | Contract |
| Name (optional) | You, or your Stripe checkout | To greet you, and to show your first name to a friend you invite | Contract |
| Plan, billing period (monthly or yearly), subscription status, payment and renewal dates, refund status | Stripe, when you subscribe | To unlock your plan on the Macs you use, and to remind you before renewals | Contract |
| A one-way code for each Mac, its name (for example "Priya's MacBook Pro") and when it last checked in | The app | To keep each plan to 2 Macs and let you sign one out | Contract |
| Sign-in records: time, IP address and browser or app version | Our account service | To keep accounts secure and stop abuse | Legitimate interests |
| Update checks and install reports: the Mac's code, app version and build, update channel, macOS version, chip type, and a short error message if an install fails | The app, when it checks for or installs an update | To offer you the right updates, roll releases out safely, and spot broken installs | Legitimate interests |
| Referral code, who invited you, and the status of invite rewards | Our invite program | To give the friend's discount and the referrer's reward | Contract |
| Billing details: billing country and postcode or address (for tax), the last 4 digits and brand of your card, and Stripe customer, subscription and payment IDs | Stripe | To charge the right tax, match payments, refunds and invoices to your account, and keep tax and accounting records | Contract; legal obligation |
| Messages you send us | You | To answer you | Legitimate interests |
| Email address, if you join the Windows list | You, on cinemac.app/windows | To email you once, when Cinemac for Windows is ready to download | Consent |
| Affiliate referral (if you arrive through a partner's link): which partner, when, the page and the site you came from, never your IP address | Cinemac | To pay the partner who sent you | Legitimate interests |
| Website visits, if Google's tags are on (section 7): pages you view, the ad or link that brought you, device and browser type, rough location, and the identifiers in Google's cookies | Google Analytics and Google Ads on cinemac.app | To count visits, see which pages and ads work, and show Cinemac ads to people who have visited | Legitimate interests (you can turn them off at any time) |
The code for each Mac is a SHA-256 hash of its hardware ID combined with a Cinemac-specific prefix. It identifies the same Mac to us each time without revealing the hardware ID itself.
We don't ask for, and you shouldn't send us, sensitive data such as health information.
3. Payments
We sell Cinemac ourselves, and payments are processed for us by Stripe, Inc. ("Stripe"). When you subscribe, you enter your card details on Stripe's own checkout page (checkout.stripe.com), and you manage your subscription, card and invoices in Stripe's billing portal (billing.stripe.com). Stripe charges you and sends receipts. Stripe shares with us your email, name, billing country and address, what you bought, the last 4 digits and brand of your card, and the customer, subscription and payment IDs. We never see or store your full card number.
Stripe processes this data on our behalf, and for some purposes, such as fraud prevention and meeting financial regulations, as an independent controller under its privacy policy.
4. AI features use your own accounts
AI voice and the AI presenter are optional and run through your own ElevenLabs and HeyGen accounts, with your own keys. When you use them, the app sends the request straight from your Mac to that provider: your script text to ElevenLabs, and your narration audio and avatar choice to HeyGen. Nothing passes through Cinemac's servers and we don't see what you send. Those providers process it under your agreement with them and their own privacy policies, not this one.
5. Share links
If you press Share link, Cinemac uploads only what you share: the rendered video, one poster image, the title, chapter titles and times, and the label and address of the button, if you add one. Your project, original recordings, transcript and other takes stay on your Mac. Shared videos are stored by our hosting provider, Cloudflare, until you press Stop sharing or delete your account. If your subscription ends, your links keep playing for 30 days, then pause. We delete paused videos 90 days later, and email you a week before. Anyone with the link can watch the video, so share it only with people you mean to.
People who watch a shared video are counted anonymously. The watch page uses no cookies and stores nothing in their browser. We keep totals per video (views, how much was watched, button clicks) and don't store viewers' IP addresses or browser details. For rate limiting we briefly use a hash of the viewer's IP address in memory, and never write it down.
6. Downloads from other services
When you choose to download a speech model for transcription, your Mac fetches it from Hugging Face (huggingface.co), which sees your IP address as any website would. The model is checked against a fixed fingerprint before use.
7. On our website
cinemac.app uses:
- Your sign-in session, kept in your browser's local storage, so the account page knows it's you.
- An invite code, kept in your browser's local storage for 60 days after you open an invite link, so your discount applies when you subscribe.
- Links to Stripe. Checkout and the billing portal open on Stripe's own pages (checkout.stripe.com and billing.stripe.com), which set the cookies they need to take payment safely and prevent fraud. cinemac.app doesn't load any Stripe script.
- Partner links: if you arrive through an affiliate partner's link, we remember which partner sent you for up to 60 days, unless you turn this off under "Cookie settings".
- Google's tags: Google Tag Manager loads Google Analytics and Google Ads, so we can count visits, see which pages and ads work, and show Cinemac ads to people who have visited. They're on by default: turn them off with "Cookie settings" at the bottom of any page, and they stay off if your browser sends a Global Privacy Control signal. Google receives the data in section 2 and your IP address. It acts for us for Analytics, and as an independent controller for advertising, under Google's privacy policy.
Details, and how to clear them, are in our cookie policy.
8. Who we share data with
We share personal data only with the service providers who run Cinemac for us, under contracts that require them to protect it and use it only on our instructions. The current list, with what each one does and where, is on our sub-processors page. In short: Supabase (accounts and database), Resend (email), Cloudflare (downloads, updates and share links), Stripe (payments and the billing portal), Google (website measurement and advertising, only when Google's tags are on). Affiliate partners see how many people their link brought and what they earned, never your name or email. For some purposes Stripe and Google act as independent controllers, as described above.
We may also disclose data when the law requires it, to protect people's safety or our rights, or to a buyer if the business is sold, in which case this policy keeps applying to your data.
We don't sell or rent personal data. When Google's tags are on, Google uses your visit to measure our ads and may show you Cinemac ads elsewhere, which some US state laws call sharing for cross-context behavioural advertising. You can opt out at any time with "Cookie settings" at the bottom of every page, and we treat a Global Privacy Control signal as an opt-out.
9. Emails
We send sign-in codes, receipts and messages about your account, your plan, renewals and changes to these policies. We send product news only if you choose to receive it, and every such email has an unsubscribe link.
10. Where your data is stored
Our account database is hosted by Supabase in South Korea (Seoul). Our providers may process data in other countries. When personal data from the EU, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, or the EU-US Data Privacy Framework where a provider is certified.
11. How long we keep it
| Data | How long |
|---|---|
| Account, plan and Mac list | While your account exists |
| A Mac's entry | Until you sign that Mac out, or delete your account |
| Sign-in and security logs | Up to 90 days |
| Update checks and install reports | Up to 12 months |
| Shared videos | Until you stop sharing them or delete your account, or 120 days after your subscription ends |
| Purchase and tax records | As long as tax and accounting law requires, usually 6 to 10 years |
| Support messages | Up to 2 years after the conversation ends |
| Website visits in Google Analytics | Up to 14 months. Google's cookies last as listed in our cookie policy |
| The Windows list | Until we send the one email that Cinemac for Windows is ready, then deleted. Ask us and we remove you sooner |
When you delete your account we remove or anonymise the rest within 30 days. Backups are overwritten within a further 30 days.
12. Your rights
Depending on where you live, you can ask us to:
- tell you what data we hold about you and give you a copy;
- correct it;
- delete it;
- give it to you in a portable format;
- stop or restrict using it, or object to how we use it (including for our legitimate interests);
- withdraw consent you gave, at any time.
Email bharat@innoventuresai.com from the address on your account. We reply within 30 days, and we may need to confirm it's you. We won't treat you differently for using these rights. You can also complain to your local data protection authority, though we'd like the chance to sort it out first.
California residents. In the last 12 months we collected the categories in section 2: identifiers (email, Mac code, IP address), commercial information (purchases) and internet activity (update checks, and website visits when Google's tags are on). We use them only for the purposes above. We don't sell personal information. When Google's tags are on, Google's use of your visit for advertising may count as sharing under California law: opt out with "Cookie settings" at the bottom of any page, or with Global Privacy Control, which we honour. We don't use sensitive personal information to infer anything about you. You have the rights to know, delete, correct and opt out, and to name an authorised agent.
13. Security
Sign-in uses one-time codes, so there's no password to steal. Sessions are stored in your Mac's Keychain. Data travels encrypted (HTTPS), database access is restricted per account, and the pass that unlocks your plan is signed so it can't be forged. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.
14. Children
Cinemac isn't meant for children. You must be at least 16 to create an account. If you believe a child has given us personal data, email us and we'll delete it.
15. Changes to this policy
When we change this policy, we update the date at the top. If a change matters, we email you before it takes effect.
Contact
Cinemac · bharat@innoventuresai.com