Privacy Policy

1. Information We Collect

1.1 Information you provide

• Account information: email address and authentication details when you create an account. If you sign in with Google, we receive your email address, name and Google account identifier from Google; we never see your Google password.
• Content you upload: images, start/end frames, and any inputs you submit to generate videos (“User Content”).
• Support communications: messages you send to our support team.

1.2 Information collected automatically

• Device and app data: device type, OS version, app version, language, and basic identifiers.
• Usage data: features used, screens viewed, and interaction events (e.g., taps, generation attempts).
• Diagnostics: crash logs and performance data.
• Abuse-prevention signals: when an account is created we record the request's IP address and network prefix, a hashed browser identifier and a normalised form of the sign-up email. They are used only to detect repeated or automated sign-ups, are kept for 180 days, and are not linked to your generations.

1.3 Payment information

Website card payments are processed by Stripe. If payments become available through a future iOS app, Apple will process those purchases. We do not receive or store full payment-card details in either case. We do receive purchase-related information such as product identifiers, transaction identifiers and subscription status, which we store to credit your account and prevent the same purchase being redeemed twice.

1.4 Cookies

The website sets one strictly necessary cookie, __Host-twoframe_refresh, which holds your sign-in session. It is HttpOnly, Secure and SameSite=Lax, expires after 30 days, and is cleared when you sign out. We do not use advertising or third-party tracking cookies, so no cookie consent banner is required.

2. How We Use Information

We use information to:

• Provide and operate the Service (including video generation).
• Maintain account security and prevent fraud/abuse.
• Improve performance, reliability, and user experience.
• Provide customer support.
• Comply with legal obligations.

3. How We Share Information

We may share information with:

• Our hosting provider, OVH, which runs the servers and database the Service uses.
• Google, when you choose to sign in with Google (see 1.1).
• Resend, which delivers the transactional emails we send you (verification, password reset and account notices).
• Backblaze, which holds encrypted backup copies of our database and of uploaded frames and generated videos (see section 5 for how long).
• Payment processors — Apple for in-app purchases and Stripe for card payments on the website — which handle billing on our behalf.
• Kling AI, which generates the video from the two frames you upload — the frames are sent to Kling's API, operated outside the European Economic Area — and Bunny.net, which stores and delivers the generated video.
• Sentry, which receives crash and error diagnostics from the website so we can find and fix faults. Reports are stripped of request bodies, cookies, IP addresses and any token contained in a link before they leave your browser, and never include your User Content.
• Legal and safety authorities if required by law or to protect rights, safety, and integrity of the Service.
• Business transfers in connection with a merger, acquisition, or sale of assets (with appropriate safeguards).

We do not sell your personal information.

4. User Content and AI Processing

• Your User Content is used to generate the outputs you request.
• We may temporarily store content to provide the Service, troubleshoot issues, and prevent abuse.
• We do not use your User Content to train generalized AI models.
• Uploaded frames and generated videos are stored at an unlisted, public web address — anyone with the exact link can view them, though it is never published or indexed — and are removed from storage within 24 hours of you deleting the video or your account. Encrypted backup copies can persist for up to about six months after that (see section 5) and are not reachable from any link.

5. Data Retention

We retain information only as long as necessary to provide the Service and for legitimate business purposes (e.g., security, compliance, dispute resolution). You may request deletion as described below.

• Uploaded frames and generated videos: until you delete the video or your account, then removed from storage within 24 hours.
• Backups: encrypted database and media backups are stored off-site under a 90-day write-protection (they cannot be altered or deleted earlier), and older copies are removed by lifecycle rules within about six months of being written. A local copy of the database is additionally kept for 14 days. Deleted content can therefore persist in a backup for up to about six months.
• Abuse-prevention signals (section 1.2): 180 days from sign-up.
• Purchase records: for as long as required by tax and accounting law after your account is closed.

6. Your Choices and Rights

Depending on your location, you may have rights to access, correct, or delete your information, and to object to or restrict certain processing.

You can delete your account yourself at any time from the Settings page in the app; this removes your account, frames and videos as described in section 5.

For any other request, or to delete your data without signing in, contact: [email protected]

7. Security

We use reasonable administrative, technical, and organizational measures to protect your information. No method of transmission or storage is 100% secure.

8. Children

TwoFrame is not intended for children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children.

9. International Data Transfers

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards for such transfers.

10. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version in the app and update the Effective date.

11. Contact Us

Email: [email protected]