Privacy Policy

1. Introduction

Scene24 ("we," "our," or "us") operates the scene24.so website and the Scene24 platform (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. Information we collect

2.1 Information you provide

• Account information: When you sign in with Google or GitHub, we receive your name, email address, and profile picture from that provider.
• Content: Product URLs you submit, prompts you write, images you upload, and videos generated by the Service. When you submit a URL, we visit that public page and record its screenshots, colors, fonts, and text to build your video.
• Waitlist (closed): If you joined the waitlist before launch, we keep the email address and any optional answers you gave (your role, product URL, biggest pain, most wanted feature, and social handle). Email us to have them deleted.
• Settings: Your preferences (theme, language, default export settings).
• Communications: If you contact us directly, we may collect your name, email, and the contents of your message.

2.2 Information collected automatically

• Usage data: Pages visited, features used, generation counts, and session duration. Recorded as individual events linked to your account while it exists, in our own database and in PostHog (product analytics, hosted by PostHog in the United States), and measured by Google Analytics 4 (acquisition and Search Console attribution).
• Device data: Browser type, operating system, screen resolution, and language preference.
• Log data: IP address, access timestamps, and error logs, kept by our hosting providers (Vercel and Railway) for their log retention period.
• Generation records: The steps of each video run (what the AI was asked and what it returned, and what each call cost), so we can support you and keep costs in check.

2.3 Information we do NOT collect

• Payment card numbers. Payments are handled entirely by Polar, our merchant of record, and its payment processor.
• Passwords (we use OAuth only; no password-based authentication).
• Biometric data.
• Data from your product's end users. We only access the public-facing URL you provide.

3. How we use your information

• To provide and maintain the Service, including generating videos from your inputs.
• To authenticate your identity and manage your account.
• To send you Service-related messages, such as notices about your account and billing.
• To understand how the Service is used and improve it, through the usage analytics described above.
• To respond to your inquiries and provide support.
• To detect and prevent fraud, abuse, or security incidents.

4. How we share your information

We do not sell your personal information. We share data only in these limited circumstances:

• Service providers: These providers process data on our behalf under contractual obligations.
  • Supabase: authentication, database, and file storage for site captures, voiceovers and the clips you upload (hosted in Singapore)
  • Cloudflare R2: storage and delivery of the media each video run produces, files you attach in chat, and your exported videos
  • Vercel: website hosting
  • Railway: backend hosting and job processing
  • Modal and E2B: rendering your video to MP4 (on Modal's GPUs, with E2B sandboxes as a fallback)
  • Polar: checkout, subscriptions, and billing (merchant of record)
  • Resend: delivered waitlist emails before launch
  • PostHog and Google Analytics: usage and acquisition analytics
  • The AI providers listed below
• AI providers: When generating and editing videos, we send your prompts, uploaded images, and material captured from your product URL to:
  • Google (Gemini): planning, writing, and editing your video
  • Anthropic (Claude): conversation titles, and some generation steps
  • fal.ai: AI-generated footage clips, from text prompts we write for your video
  • ElevenLabs: voiceover and audio, from your video's script
  These providers have their own privacy policies. We do not send your account information to AI providers.
• Legal obligations: If required by law, subpoena, or government request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

5. Data storage and security

Your account and the records of your work are stored in Supabase (PostgreSQL, hosted in Singapore), and so are site captures, voiceovers and the clips you upload (Supabase Storage, same region). The media each video run produces, files you attach in chat, and exported videos are stored in Cloudflare R2. We implement industry-standard security measures including:

• Encryption in transit (TLS) and at rest (AES-256).
• Row-Level Security (RLS) ensuring users can only access their own data.
• Token-based authentication and ownership checks on backend API requests.
• No plaintext storage of secrets or credentials.

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data retention

• Your account and content: Kept while your account exists. When you delete your account in Settings, we cancel any subscription and delete your account, films and their versions, chats and generation records, projects, site captures, workspaces you own and their brand kits, and your billing record at once. Exported videos, site captures, the music, voiceovers and clips made for your films, and the files you uploaded or added to a film are removed from storage at the same time; anything a failure leaves behind is removed within 30 days. A site capture that another user's film also uses is kept for that film, without any link to you.
• Films you delete from your reel: Deleting a film deletes its chat, the film and its versions, its exported videos and the files you added to it in the editor. A record that the film was made stays, so it still counts toward that month's videos, and the site capture it was made from, with the music, voiceover and clips made for it, stays with your project until you delete your account or ask us to delete it.
• Usage analytics: Linked to your account while it exists. When you delete your account, the events in our own database stay without any link to you. PostHog keeps the events it recorded under your account id and email address until we remove them; email us and we will delete your PostHog profile and its events.
• Cost records: We keep the cost of each AI call for our accounts. When you delete your account, those records lose the link to you and the content of the call.
• Log data: Kept by our hosting providers for their log retention period.
• Billing records: Polar, as merchant of record, keeps the invoices and tax records it must under its own policy.
• Backups: Copies in our providers' backups expire on their backup schedules.

7. Your rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Delete your account and its data yourself in Settings (Privacy & data), or ask us by email.
• Data portability: Request an export of your data in a machine-readable format by emailing us (Settings links there).
• Objection: Object to processing of your data for certain purposes.

To exercise any of these rights, contact us at hi@scene24.so. We will respond within 30 days.

8. Cookies and tracking

We use essential cookies for authentication sessions and locale preferences. Google Analytics 4 sets first-party analytics cookies (_ga and _ga_*) on scene24.so to measure how visitors find and use the site; it is loaded on every page, and you can block it in your browser or with a content blocker without losing any part of the Service. We do not use advertising cookies or cross-site tracking pixels.

PostHog analytics stores its data in your browser's local storage rather than cookies, and is configured to respect Do Not Track (DNT) browser signals.

9. Children's privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected such information, we will delete it promptly.

10. International data transfers

Your data is transferred to and processed in countries other than your country of residence: Singapore, where our database is hosted, and the United States and other countries where the providers in section 4 operate. These countries may have different data protection laws. By using the Service, you consent to such transfers.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact

If you have questions about this Privacy Policy, contact us at:

hi@scene24.so