Privacy Policy

This explains what ThreeCut, run by Vaaya, Inc., collects, why, who processes it for us, and what you can ask us to do with it.

What we collect

• Account: your name, email address, profile picture and Google account ID, from Google sign-in, and the IP address and browser your account was created from.
• Your projects: topics, audiences, tones, screenplays and settings, saved as you type.
• Recordings and videos: the camera takes you keep and the videos we render, in private storage.
• Photos and videos you add: the files you add to a project, their file names and the notes you write about them, kept in private storage with your recordings.
• Pages you link: when a topic contains a link, our server reads that page's title, description and text to draft your script.
• Payments: which credit pack you bought, the amount and the Stripe session. Card details go to Stripe and never reach us.
• Usage: when drafts and renders run and whether they succeeded, and the IP address and browser of each script request and upload, to operate limits, refunds and support.
• Analytics: the pages you visit and the steps you take (for example starting a script, a render or a checkout), errors the page hits, your browser and device type, the page that sent you, and an approximate location worked out from your IP address. When you are signed in, PostHog links this to your account (your name and email) so we can see where people get stuck. Google Analytics gets visit statistics only, never your name or email.

Abuse prevention

We use the IP address and browser your account was created from, and those of script requests and uploads, to stop automated sign-ups and other abuse of the free credits. When we refuse a sign-in, we record the email address, IP address and browser it came from. For accounts that look automated, we also keep the topic and direction of their script requests for 7 days, then delete them.

Voice typing

The microphone button by a text box uses your browser's own speech recognition. Your browser's maker handles the audio under its own terms (in Chrome, Google processes it). ThreeCut never receives the audio, only the words that end up in the box, like anything you type.

Cookies

One sign-in cookie that keeps you signed in, a short-lived cookie used during Google sign-in, and analytics cookies and browser storage from PostHog and Google Analytics that recognise a returning browser. None are used for advertising. Blocking the analytics ones (for example with your browser's tracking protection or a content blocker) does not change how the service works.

Who processes it for us

• Google: sign-in, and Google Analytics for visit statistics.
• PostHog: product analytics (which pages and steps are used, and errors).
• Vercel: hosting and private file storage for recordings, the photos and videos you add, and finished videos.
• Supabase: the database.
• Fly.io: the render worker that assembles videos.
• Stripe: payments.
• Resend: the email that tells you a video finished or didn't (your email address and the video's title).
• Slack: our internal alerts about suspected abuse, which can include an account's email address and IP address.
• Vaaya: routes AI requests to model providers. Your topic and script, and the file names and notes of the photos and videos you add (not the files), go to the screenplay model (Anthropic Claude), scene narration text to ElevenLabs, and scene image descriptions to ByteDance (Seedream). When you render, the sound of your takes (voice only, no picture) goes to Deepgram for a word-by-word transcript, which we use to cut the pauses and time the captions. The sound file is handed over through fal's file storage under a random name.

We do not sell your data and do not use your recordings, photos or videos to train AI models.

How long we keep it

Until you delete it. Deleting a project deletes its recordings, the photos and videos you added to it, and its finished videos from storage. Deleting your account removes your projects, recordings, photos, videos and profile; payment records are kept as long as tax law requires. Provider backups expire on their own schedule.

Your choices

You can ask for a copy of your data, a correction, or deletion of your account at support@vaaya.ai. Depending on where you live you may also have the right to object or complain to a data protection authority.

Children

The service is not for anyone under 16.

Changes and contact

We will post changes here and update the date above. Questions: support@vaaya.ai.