Privacy.

Your recording never leaves your machine

The video you drop into the studio is not uploaded. Frames are pulled out of it by code running in your own browser. Only the frames you tick in the review step are sent to our server, and only as still images. Close the tab before that step and nothing has left your machine.

You can add screenshots instead of a recording. They are read and resized in your browser too, and nothing is sent until you press Generate. Then the screenshots you selected are sent, as the frames are.

What we hold

Your email address

So you can sign in and so credits belong to someone. Signing in with Google or GitHub passes us your email address, and nothing else from that account.

A device cookie

A random identifier with a signature, set as an HttpOnly cookie. It counts free runs so that one browser cannot take an unlimited number of them. It says nothing about you.

A daily hash of your IP address

Your IP address is never stored. It is combined with a secret and the current date, hashed, and only the hash is kept. The same address produces a different hash tomorrow. It counts free runs per address and cannot be turned back into an address. When you ask for a sign-in link, a hash of your IP address and one of your email address are kept for a day, so that no one can send hundreds of links.

The frames or screenshots you approve

With the app name and the one-line description, if you typed them. These go to Anthropic’s API, which scores the frames and writes the headlines. Screenshots you added are scored too, but every one you selected is in the set. Anthropic does not train its models on data sent through the API.

The screenshots we render

Held in private storage so you can come back to a set. With them we keep the frames or screenshots in the set, full size, the headlines, with any you edited, and a mascot you added, so the set can be drawn again in another style or on another device. Your recording itself is never uploaded. Seven days for a free run, ninety days for a set you spent a credit on, then deleted. You can delete any set yourself at any time.

Your credit balance

As a list of purchases and spends, with amounts and dates. It never contains card details.

How the site is used

Counted by PostHog, without cookies. It records the pages you open, the site that sent you, how long you stay, how far you scroll and how fast the page loads. It also records your browser, system, language, time zone and screen size, the country your connection comes from, where you click and move the mouse, the buttons and links you press, and errors in the page or on our server. In the studio it records the steps of a run: the length and size of the video, how many frames it gave and at which seconds, which frames made the set, or how many screenshots you added and how many could not be used, the styles and sizes you picked, which screen’s text you edited and how many words it has (never the words), how long each step took, what the model calls cost us, your credit balance when you open the packs, unlock a set or add to one, and which pack you bought. A step you take signed in carries your account’s random id, never your email address. A run carries its id, which starts with the date and a short form of the app’s name. Your recording, frames, screenshots, email address and one-line description are never sent. Kept for one year.

Payment

Stripe takes the payment. Card numbers go to Stripe and never reach us. We receive confirmation that a payment succeeded, its Stripe identifier, and which pack was bought.

Who else processes it

These companies handle parts of the service on our behalf.

Supabase

Sign-in, the credit ledger, and storage for rendered screenshots.

Resend

Sends the sign-in email, so it receives your email address. It keeps its records in the United States.

Vercel

Hosting and the servers that render your screenshots.

Anthropic

The models that choose the screens and write the copy.

Stripe

Payments.

PostHog

Usage analytics, stored in the EU.

Google and GitHub

Only if you choose to sign in with one of them.

Some of them process data outside the European Economic Area. Where that happens it is covered by the European Commission’s standard contractual clauses. We do not sell your data, and we do not share it for advertising.

Cookies

Only the ones the site cannot work without: the sign-in session, a cookie that tells the page you are signed in, the device cookie described above, and a short-lived cookie that remembers which page you were on when you started signing in. The usage analytics set no cookie and store nothing in your browser. PostHog counts visitors with a hash of your IP address and browser, salted with a value it replaces every day, and does not keep the address. There is no advertising and nothing that follows you to other sites, which is why there is no cookie banner asking you to accept any.

The studio keeps your last run in your own browser’s storage: the frames, the screenshots and the choices you made. A reload or a closed tab then does not lose your work. It never leaves your device, your next run replaces it, and the studio drops it once it is seven days old. Signing out deletes it.

Why we are allowed to hold it

• To give you the service you asked for. Your email address, your frames, your screenshots and your credit balance.
• Our legitimate interest in keeping the free tier usable. The device cookie and the IP hash, both built to count without identifying.
• Our legitimate interest in knowing how the service is used. The usage records, so we can fix what breaks and improve what people use. They carry no email address, no recording and no screenshots.
• A legal obligation. Records of what was sold, kept as long as tax law requires.

Your rights

If you are in the UK or the European Economic Area you can ask for a copy of what we hold, ask us to correct or delete it, ask for it in a portable form, or object to a particular use. Most of it you can do yourself: sets are deletable from Your sets, and asking us to close your account removes the rest, including the usage records tied to it.

Write to vik.ceb.dev@gmail.com and we will answer within one month. If you are not satisfied you can complain to your national data protection authority.

Children

appstills is a tool for people who publish apps. It is not intended for anyone under 16.

Changes

If this notice changes in a way that affects you, the date at the top changes and we say so in the studio before your next run.

Contact us

appstills is built and run by one person. Write to vik.ceb.dev@gmail.com about anything on this page: a copy of what we hold, a correction, a deletion, or a complaint. It is read by the person who wrote the code.