Privacy Policy

This Privacy Policy explains what data [COMPANY LEGAL NAME], [ADDRESS] ("we", "us"), the operator of Scriptube, collects and how it is used, governed by the laws of [JURISDICTION].

1. Account Data

When you sign up we store your email address and a bcrypt-hashed version of your password — we never store or have access to your actual password. We also store your plan, credit balance, and admin-set flags on your account.

2. Usage, Batches & Transcripts

We store the batches you submit, the videos they reference, and the resulting transcripts, along with daily usage counters used to enforce your plan's limits. This data is what powers your dashboard, library, and exports.

3. Where Transcript Data Comes From

Transcripts are sourced from captions YouTube publishes for a video (manual or auto-generated), plus video metadata (title, channel, duration, etc.) from YouTube. Where AI transcription is available, caption-less videos may instead be transcribed from audio. We do not host or redistribute the original video or audio.

4. Payments

Subscriptions and credit purchases are processed by Stripe. We never see or store your full card number — Stripe handles that under its own PCI-compliant infrastructure. We retain only what Stripe tells us is needed to manage your subscription (e.g. a customer ID).

5. Analytics

We use Umami, a self-hosted, cookie-free analytics tool, to understand aggregate usage of our marketing pages. Umami does not use cookies and does not track you across other websites.

6. Email

Transactional email (verification, password reset, feedback notifications) is sent via SendGrid, with SMTP as a fallback. We do not sell or share your email address with third parties for marketing purposes.

7. Cookies

Scriptube uses a single essential, httpOnly session cookie to keep you signed in. CSRF-protection tokens are derived from that session rather than stored as a separate cookie. We do not use third-party advertising or cross-site tracking cookies.

8. API Keys

If you use our REST API, we store a hash of your API key, not the key itself. If you bring your own ElevenLabs or Google Translate keys (BYOK), those are encrypted at rest and used only to make requests on your behalf.

9. Data Retention & Deletion

We retain your account and transcript data for as long as your account is active. You can request deletion of your account and associated data at any time by emailing support@scriptube.me; we will process the request within a reasonable time.

10. Contact

Questions about this policy or your data? Email support@scriptube.me.