How we actually handle your data
Concrete facts about what's built, not marketing claims. Where something isn't true yet, we say so below instead of implying otherwise.
Passwords are never stored in plain text
Hashed with bcrypt, salted, one-way. We can't read your password and neither can anyone who breaches the database.
Connected platform tokens are encrypted at rest
TikTok/YouTube/Instagram access tokens are encrypted (AES-256-GCM) in the database, never logged or stored in plain text.
No ad tracking, no analytics scripts
We set a signed session cookie once you're logged in, plus short-lived cookies NextAuth itself uses for CSRF protection and post-login redirects. Nothing else runs on the site to track you — no ad pixels, no analytics scripts.
Generated media is private by default
Your videos live in a private bucket, never publicly listable, served only through short-lived signed URLs — not a public S3 path anyone can guess.
Voice samples are used only for your own render
A reference clip you upload for voice cloning is never used to train a shared model or touch any other user's generation.
Account deletion is real and self-service
Dashboard → Billing → Delete account removes your projects, generated media, connected tokens, and voice samples immediately — not a support ticket queue.
HTTPS everywhere, with real security headers
HSTS, X-Frame-Options, X-Content-Type-Options, and a restrictive Permissions-Policy are set on every response.
Where your data actually goes
Generating a video means sending relevant parts of your input to whichever provider powers that specific step. We only send each provider what that feature requires — never everything.
- •OpenAI / Groq — script writing, transcription, text-to-speech
- •Microsoft Edge TTS — free-tier text-to-speech fallback
- •Pexels — stock b-roll matching
- •Stripe — payment processing (we never see your card number)
- •Backblaze B2 — storage of generated media
- •Resend — transactional email delivery only
- •Google (YouTube Data API) — Trend Radar data, YouTube publishing
Where we're honest about not being there yet
We don't currently hold SOC 2 or any other third-party security certification, and you won't find that badge anywhere on this site until it's actually true. Clipforge is operated as a sole proprietorship today, not a larger organization with a dedicated compliance team. If a formal audit or certification is a real requirement for your team, email us directly — we'd rather have that conversation honestly than put up a badge that isn't earned.
Full details in the Privacy Policy and Terms of Service. Questions go to support@forgecut.app.