Your film plans are yours. This is how we look after them.
A short, plain account of how we protect your account, what we store, and who sees the part of it the service needs. The legal detail is in the Privacy Notice.
TLS 1.2+
encrypted connection on every page
0
card details held by us
30
days before uploaded images are deleted
01
Protecting your account
An encrypted connection
Every page is served over HTTPS only, and your browser remembers for a year not to try anything else. The server refuses old, weak encryption.
A password even we can't see
Your password is stored only as a one-way hash. The cookie that keeps you signed in can't be read by scripts in the browser, and it only ever travels over an encrypted connection.
Against guessing
Sign-in and payment are rate-limited: anyone firing off attempts in quick succession is locked out for a while. On the sign-in and sign-up forms, Cloudflare Turnstile filters out bots.
No framing by other sites
Our pages can't be loaded inside another site's frame, so nobody can lay a fake button over our interface. We never ask for your camera, microphone or location.
02
Your data
We only ask for what the service genuinely needs. No profiling, and we never sell data to anyone.
Payments are handled by Stripe. Your card details stay with Stripe alone and never reach us.
Images you upload (references, start frames, Hollywood Box photos) are deleted automatically after 15 days.
We never analyze your images on our own. They only reach the AI if you ask for a description.
If you connect your Claude account, we store only a one-way digest of the access tokens, and you can disconnect at any time on the My account page.
After you delete your account we erase everything within 30 days, apart from what accounting rules require us to keep.
Data sits on servers in the United Kingdom and the European Union. Processing by Anthropic may also take place in the United States. For that we rely on the contractual safeguards recognized in law.
03
Who sees any of it
A few tasks need outside providers. We have a data-processing agreement with each, and each only receives what its own job requires.
Your browserwhere you type what you type
An encrypted connectionHTTPS · TLS 1.2+
Cloudflaresees: IP address, time of the request
Our serveraccount and film plans; the password only as a hash
from your browserStripeat checkout your card details go straight here and never reach us
from our serverAnthropiconly the text you typed, and the image if you ask for it to be described
Stripe Payments Europe
Payments and invoicing. Receives your name, email address and billing details. Your card details are held only by them.
Anthropic
Produces the text for the AI steps. Receives only what you typed for that step. If you specifically ask for a description of an uploaded image, it receives that image too. We never send an image of yours on our own. Nothing is used to train the model.
Cloudflare
Serves and protects the site against attacks. Sees technical data: IP address, time of request.
Our hosting provider
The server where the database and files physically live.
Write to [email protected] and tell us where and how you came across it. We'd be grateful if you kept it private until it is fixed. Our address is also in the standard place for security researchers: /.well-known/security.txt.
A question about your data?
We answer every data protection request within a month, and you don't have to give a reason.