Privacy Policy

1. Your media never leaves your device

All editing — trimming, reframing, noise removal, loudness normalization, caption generation, and export — runs locally in your browser using on-device WebAssembly and WebCodecs. Your video and audio files are never uploaded to Plumely. There is no upload endpoint and no cloud processing for your media.

2. Where your projects are stored

Your projects, edit history, and imported media are saved on your own device using your browser's storage (the Origin Private File System and IndexedDB). This data stays in your browser. Clearing your browser storage, or using private/incognito mode, will remove it. We cannot access or recover this data for you.

3. Account information

You can use the editor without an account. If you create one, our authentication provider, Supabase, stores your email address and a securely hashed password (or your chosen sign-in method) so we can identify you across sessions. We use an essential session cookie to keep you signed in. Creating an account does not change where your video is processed — it still stays on your device.

4. Payments

If you subscribe to Plumely Premium, payment is handled by our payment provider, Lemon Squeezy, acting as the Merchant of Record. Lemon Squeezy collects and processes your billing details and any tax information, and they — not Plumely — store your payment-card data. We receive only the information needed to activate your subscription (such as your email and subscription status). Their handling of your data is governed by Lemon Squeezy's own privacy policy.

5. Optional features that send data off your device

Some features are opt-in and only transmit data when you explicitly choose them:

• ✓High-accuracy captions (optional): if you select the high-accuracy transcription option instead of the default on-device captions, the audio for that clip is sent to a transcription service to generate text, which is returned to your device. The default caption feature runs entirely on-device and sends nothing.
• ✓Publish to YouTube (optional): if you connect a YouTube channel, the finished video you choose to publish is uploaded from your browser directly to YouTube. Section 6 covers this in full.

6. Google user data (Publish to YouTube)

Connecting a YouTube channel is entirely optional and off by default. If you use it, Plumely requests a single sensitive Google scope — https://www.googleapis.com/auth/youtube.upload (opens in a new tab) — plus the basic openid and email scopes. We request no other Google scopes: we cannot read, edit, or delete your existing videos, comments, playlists, subscribers, or analytics, and we have no access to your Gmail, Drive, Calendar, or Contacts.

What we receive and store: an OAuth refresh token and a short-lived access token for your Google account, the granted scope string, and the email address of the connected Google account (shown in the app so you can confirm which channel you are publishing to). That is all. We never receive your Google password.

What we do with it: the token is used for one purpose only — to open an upload session on your YouTube channel when you press Publish, using the title, description, tags, and privacy setting (private, unlisted, or public) you enter in the app. The video bytes are then sent from your browser straight to Google's upload endpoint; the media itself never passes through Plumely's servers.

Who we share it with: we do not share, sell, rent, transfer, or otherwise disclose your Google user data to any third party, other than (a) Google itself, when calling the YouTube Data API on your instruction, and (b) the two infrastructure providers that hold the encrypted record on our behalf and process it only under contract on our instructions — Supabase (encrypted database) and Vercel (application hosting). No advertiser, data broker, analytics provider, AI provider, or other Plumely user ever receives it. No Plumely employee reads your Google user data: access is limited to automated server-side code, except where you have given us explicit permission for a specific support request, or where access is necessary for security purposes or to comply with applicable law.

We do not use Google user data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models, and we do not use it for advertising, profiling, or credit assessment.

Plumely's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See https://developers.google.com/terms/api-services-user-data-policy (opens in a new tab)

How to disconnect: choose Disconnect on the YouTube card in your account settings. Plumely asks Google to revoke the token and then deletes the stored tokens and the connected-account email from our database immediately. You can also revoke Plumely's access at any time from your Google Account permissions page at https://myaccount.google.com/permissions (opens in a new tab) — access stops at once, and the stored record is deleted when you disconnect in Plumely. Videos already published to your channel remain on your channel; delete those in YouTube Studio.

7. Analytics

If product analytics are enabled, we use PostHog to measure anonymous, in-app actions — which features are used and how flows perform — so we can improve the editor. This is product analytics, not user tracking: it is cookieless and aggregate, it is not tied to your identity, it does not follow you across other websites, we build no advertising profiles, and we never sell data. Analytics events never include your media, your video content, or your Google user data. Analytics are optional and can be disabled entirely.

8. Cookies and local storage

We use essential cookies — primarily the session cookie that keeps you signed in, plus a short-lived, httpOnly cookie that protects the YouTube connect flow against cross-site request forgery. Plumely shows no ads, so we set no advertising cookies and load no third-party advertising or cross-site tracking scripts. The browser storage that holds your projects (OPFS and IndexedDB) is local to your device and is not a tracking technology.

9. Who we share data with

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not transfer it to data brokers. We disclose data only to the service providers below, only to the extent each one needs it to perform its function for us, and only under contracts that require them to process it on our instructions and not for their own purposes:

• ✓Supabase — account authentication and our database, including the encrypted YouTube connection record. Receives your email address, hashed credentials, subscription state, and encrypted OAuth tokens.
• ✓Vercel — application and API hosting. Processes requests in transit, including the server routes that decrypt a token in memory to call the YouTube API. Keeps no copy of your data.
• ✓Lemon Squeezy — payments, as Merchant of Record. Receives your billing and tax details and your email address. Receives no Google user data.
• ✓PostHog — optional, anonymous product analytics. Receives anonymous feature-usage events only: no media, no credentials, no Google user data.
• ✓Google (YouTube Data API) — receives the video you choose to publish and the metadata you entered for it, sent on your instruction, when you use the optional Publish to YouTube feature.
• ✓Our transcription provider — receives only the clip audio you explicitly submit for the optional high-accuracy caption feature.

10. How we protect your data

Our first protection is architectural: the sensitive material in video editing is the footage itself, and we never receive it. There is no server-side copy of your media to breach.

For the limited personal data we do hold — and in particular for sensitive data such as your Google OAuth tokens — we apply the following safeguards:

• ✓Encryption in transit: all traffic between your browser, Plumely, our database, and Google runs over HTTPS/TLS. The site is served over HTTPS only.
• ✓Application-layer encryption at rest: OAuth refresh and access tokens are encrypted with AES-256-GCM (authenticated encryption, unique nonce per token) before they are written to the database, so the database never holds a usable token. The encryption key lives in server-side environment configuration, separate from the database — a database leak alone cannot be used to post to anyone's channel. This sits on top of the disk-level encryption our database and hosting providers apply.
• ✓Least-privilege access: tokens are readable only by server-side code holding a privileged service credential. Row-level security on the database restricts every user to their own rows. Tokens are never sent to the browser, never included in an API response, and never written to logs or analytics; they are decrypted in server memory only for the moment a Google API call is made, and are never persisted in plaintext.
• ✓Minimum scope: we request only the narrowest Google permission that makes the feature work (youtube.upload), with no read, delete, or account-management scopes — so even a compromise of our systems could not expose your existing YouTube content, your inbox, or your files.
• ✓Abuse limits and CSRF protection: publishing endpoints are rate-limited per user, and the OAuth connect flow is bound to an httpOnly, short-lived, single-use state cookie.
• ✓Secrets management: API keys, service credentials, and the token encryption key exist only in server-side environment configuration, are never exposed in the client bundle, and are rotatable. Administrative access to our providers requires multi-factor authentication.
• ✓Deletion on revocation: disconnecting a channel, or deleting your Plumely account, revokes the grant at Google and deletes the stored tokens and connected-account email. See section 11.

11. How long we keep data

Your projects and media stay on your device for as long as you keep them; we hold no copy, so no retention period applies to us. Your Google OAuth tokens and connected-account email are kept only while your channel is connected — they are deleted immediately when you disconnect, and when you delete your Plumely account. Account and subscription records are kept while your account is open, and afterwards only for as long as we need them to meet legal, tax, and accounting obligations. Anonymous analytics events are aggregate and are not linked to you.

12. Your rights

You control your on-device data directly — clearing your browser storage deletes your projects. For account data, you can request access to, correction of, or deletion of your personal information (and closure of your account) by emailing us. You can withdraw your Google authorization at any time, either in Plumely or at https://myaccount.google.com/permissions (opens in a new tab). Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA, including the right not to have your data sold or shared — which we do not do in any case.

13. Children

Plumely is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them.

14. Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected here with an updated date.

15. Contact

Questions about privacy, or a data request? Email hello@plumely.online.