Privacy Policy
Effective October 23, 2026 · Version 2026-10-23
- We collect what we need to run your account and library: your name, email, a protected form of your password, your questions and your videos.
- Your questions and our research text are processed by Google’s AI services to research and plan each video. Your password never is.
- Everything in your library is stored in our database until you delete it. Deleting your account removes it.
- We use one essential sign-in cookie. No advertising or tracking cookies.
- We don’t sell your personal information or use it for advertising.
1. Who we are
This policy explains how the PolyChronicle team (“PolyChronicle”, “we”, “us”) handles personal information when you use the PolyChronicle website and services (the “Service”). We are the controller of the personal information described here. Contact details are at the end of this policy.
2. What we collect
| Information | Details |
|---|---|
| Account details | Your name, email address, the date you joined, and the version and time you accepted our Terms. |
| Password | Stored only as a salted, one-way scrypt hash. We cannot see or recover your password. |
| Sign-in sessions | A random session token kept in a secure cookie on your device; we store only a one-way hash of it and its expiry date. |
| Your questions | The text you type when you ask for a video, the length and format you choose, and when you asked. |
| Research and storyboards | The research notes, the list of source links, the storyboard and the 3D model designs created for your video. |
| Safety-check records | For each check of your question and of the finished storyboard: whether it was allowed or declined, a short reason, which check made the decision, and a one-way fingerprint and length of the checked text (not the text itself). |
| Saved videos | The animated video (or legacy GIF) and still image created in your browser and uploaded to your library, with their size and a checksum. |
| Abuse-prevention counters | Short-lived usage counters linked to your account ID or to a one-way hash of your IP address, used to enforce limits such as sign-in attempts and daily video counts. They reset automatically. |
| Technical data | Our hosting provider processes standard request information (such as IP address, browser type and time of request) to deliver the site and protect it from attacks. |
We don’t ask for sensitive information, and we ask that you don’t include personal details about yourself or others in your questions. Videos are animated on your own device; we do not access your camera, microphone or files. If you turn on “Read aloud”, your browser’s built-in speech feature reads captions on your device.
3. How we use it
- To provide the Service: create your account, sign you in, research and make your videos, and keep your library.
- To keep things safe: screen requests and storyboards against our Content & Safety Policy, enforce limits, investigate abuse and protect the Service.
- To improve the Service: diagnose errors and understand, in aggregate, how features perform.
- To communicate: respond to your messages and send important notices about your account or these policies.
- To meet legal obligations: and to establish or defend legal claims.
We do not sell personal information, share it for cross-context behavioural advertising, or use it to make decisions that have legal or similarly significant effects on you.
4. AI research and your questions
To make a video, we send your question — and, at later steps, the research text, the storyboard and draft frames of the film rendered in your browser for a quality review — to Google’s Gemini models on Google Cloud (Vertex AI), including Google Search grounding to find public sources. Google processes this content to return results to us under its cloud terms. We do not send your name, email or password. Please don’t put personal information in your questions.
We use the results to write captions and design the scenes, and we keep the list of sources with your video so you can check them. AI output can be inaccurate; see the accuracy section of our Terms.
5. Legal bases (where applicable, e.g. EEA/UK)
- Contract: to provide the account and videos you ask for.
- Legitimate interests: to keep the Service safe and secure, prevent abuse and improve features, balanced against your rights.
- Legal obligation: where we must keep or disclose information by law.
- Consent: where we ask for it; you can withdraw consent at any time.
6. Who we share it with
We share personal information only with service providers who help us run PolyChronicle, under contracts that limit their use of it:
| Provider | Purpose |
|---|---|
| Google Cloud (Vertex AI, Gemini, Google Search grounding) | Safety screening, research, storyboard and model design. |
| TigerData (managed PostgreSQL) | Stores accounts, session hashes, questions, research, storyboards, models, saved videos and usage counters. |
| Our web hosting provider (e.g. Vercel) | Serves the website and application code and processes request logs. |
We may also disclose information if required by law, to protect the rights, safety and property of our users or others, or as part of a merger or acquisition (with notice to you). We never share your videos publicly; your library is private to your account unless you download and share a video yourself.
Your library contains completed videos only. Failed or declined attempts are discarded. If you leave before a video finishes, we attempt to discard it immediately; abandoned temporary records are also removed on your next library visit once they are over 30 minutes old. Safety-check fingerprints remain until account deletion.
7. Cookies
We use a single essential cookie, polychronicle_session, to keep you signed in. It is HTTP-only, sent only over secure connections in production, restricted to our site, and expires after 30 days or when you sign out. We don’t use advertising, analytics or third-party tracking cookies, so there is nothing to opt out of.
8. How long we keep it
- Account details and library: until you delete the video or your account.
- Safety-check records: kept while your account exists so we can investigate misuse, and deleted together with your account.
- Unfinished uploads: removed automatically after about 24 hours.
- Sessions: until they expire (30 days) or you sign out.
- Usage counters: overwritten when their time window resets.
- Backups: our database provider keeps encrypted operational backups for a limited period; deleted data can persist in backups until they roll over.
We may keep limited information longer where the law requires it or to resolve disputes and enforce our policies.
9. Security
We protect your information with salted password hashing, hashed session tokens, secure HTTP-only cookies, same-origin checks on account actions, encrypted connections to our database with certificate verification, private-by-default storage of videos, and rate limits. No system is perfectly secure; please use a unique password and tell us if you notice anything unusual.
10. Your choices and rights
- Access and copies: your library shows your questions, sources and videos, and you can download each saved video.
- Delete: delete individual videos from your library, or delete your whole account from your account page. This removes your account, sessions, videos, saved files, questions, research and safety-check records from our live database.
- Correct: contact us to correct your account details.
- Other requests: depending on where you live (for example under the GDPR, UK GDPR or California law), you may have rights to access, portability, restriction, objection, and to not be discriminated against for exercising your rights. Email us and we will respond within the time required by law. You may also complain to your local data-protection authority.
11. International transfers
Our providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses offered by our providers.
12. Age requirement
You need to be at least 13 (or older where local law requires) to create an account. If you believe someone under that age has created an account, contact us and we will delete it.
13. Changes
We will update this policy as the Service changes. If changes are material, we will tell you in the Service or by email before they take effect. The effective date at the top shows the latest version.
14. Contact
Privacy questions or requests: privacy@polychronicle.app.