Privacy Policy

Who we are

Cropus (“we”, “us”) is an online service that reframes videos into vertical, square and landscape formats. The operator of the service is [legal name and address of the operator]. For any privacy question, write to [email protected].

What we collect

• Your Google account basics. When you sign in with Google we receive your email address, your name and your profile picture (avatar), plus Google’s account identifier. We use them to create and identify your account. We never see your Google password.
• Your videos. The videos you upload, the reframed versions we create and the analysis of where the subject is in each frame.
• Sign-in sessions. For each sign-in we store a session in our database: a random session token, the IP address and the browser’s user agent it came from, and when it expires. Your browser keeps the token in a cookie.
• Account and usage records. Your minute balance and its history, your plan, the videos you processed and when, when you last signed in, and technical logs that our servers keep to run and secure the service.
• Payment records. Your Stripe customer and subscription identifiers and what you bought. Payments are handled by Stripe: we never receive or store your card number.

How we use it

• To provide the service: process your videos, keep your balance and let you download the results.
• To bill you for plans and minute packs, and to handle refunds of minutes when processing fails.
• To keep the service secure, prevent abuse and fix problems.
• To answer you when you contact support.

We don’t sell your personal data, and we don’t use your videos to advertise or to train AI models.

Who processes data for us

• Google — sign-in.
• Stripe — payments, invoices and subscriptions. Stripe processes your payment details under its own privacy policy.
• An AI vision provider — to find the subject, we send frames sampled from your video (still images, not the full video or its sound) to a third-party AI vision service, which returns where the subject is. We send frames only for this purpose; the provider processes them under its own terms.
• Cloudflare (R2) — storage. The videos you upload, the reframed versions, their analysis and our database backups (which include your account, payment and session records) are stored in Cloudflare R2, which encrypts all stored objects at rest. Your browser uploads videos to it and downloads results from it directly.
• Piqo — page-visit and click counts (see below). Piqo is self-hosted: it runs on our own server, and this data isn’t passed to a third party.
• Hosting — our servers (the app and its database), operated by [hosting provider, country].

How long we keep it

• Uploaded videos, their reframed outputs and their analysis are deleted automatically 7 days after upload, or 30 days if, when you upload, you have an active plan or have ever bought a minute pack (“Try again” on a failed video starts the period again). The record that the video existed (its name, length and status) stays in your history.
• An upload you don’t finish is deleted about 24 hours after you start it (at once if you cancel it).
• You can delete a video and its files at any time from its page in the app.
• A sign-in session ends 30 days after you last used it, or when you sign out; ended sessions are deleted from our database.
• The database is backed up once a week and each backup is kept for about 8 weeks. Backups include your account, payment and sign-in session records, so records we delete can remain in a backup until it is replaced.
• Account data stays while your account exists. To delete your account and everything linked to it, write to [email protected] — we’ll confirm and delete it, except records we must keep by law (such as invoices).

Cookies and storage in your browser

We use one essential cookie to keep you signed in, plus short-lived cookies during Google sign-in. We don’t use advertising cookies. To understand how the site is used, we count page visits and button clicks with Piqo, a privacy-friendly analytics tool that runs on our own server; this data isn’t sold or shared with advertisers.

If you pick a video before signing in or buying minutes, your browser keeps a copy of it (and your chosen formats) in its own local storage so the upload can continue after sign-in or checkout. That copy stays on your device; it is removed once used or the next time you open the upload form, and is ignored after 6 hours. While a tab is open, it also remembers an id for each video you upload (in session storage), so sending the same file again never charges you twice; it is cleared when you close the tab.

Legal bases and transfers

We process your data to perform our contract with you (running your account and processing your videos), for our legitimate interests (security and preventing abuse) and to meet legal obligations (such as keeping invoices). Some of the providers above may process data outside your country; where required, transfers rely on [safeguards, e.g. standard contractual clauses — to be confirmed by the owner].

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict how we use it. Write to [email protected] and we’ll respond within 30 days. You can also complain to your local data protection authority.

Security

Data travels over encrypted connections (HTTPS), and everything stored in Cloudflare R2 (videos, outputs and database backups) is encrypted at rest. The session cookie is signed with a server secret, so it can’t be forged, and access to our servers is restricted. No system is perfectly secure, but we work to protect your data and will tell you if a breach affects you.

Children

Cropus is not meant for children under 16, and we don’t knowingly collect their data.

Changes

If we change this policy, we’ll update the date at the top, and tell you in the app or by email when the change is significant.