Privacy Policy

This Privacy Policy explains what ComposIT collects, why, and the choices you have.

1. Scope

This policy covers composit.app and the ComposIT service (the "Service"), operated by Charles Curtis Hays ("ComposIT", "we", "us").

2. What We Collect

• Account data: your name, email address, and sign-in identifiers, through our identity provider, Clerk. Clerk also processes sign-in security data, such as device and IP address information, to protect your account. When you set up your account, we also record the invite code you used, and each time you accept our Terms of Service we record the date, the versions of the Terms and this policy you accepted, and the statements you confirmed: that you are 18 or older and located in the United States.
• Your content: the video files you upload and the outputs we generate from them, plus project names, file names, and technical details such as resolution, frame rate, duration, and codec.
• Review link activity: comments left on a review link, the point in the video each comment refers to, and the display name the commenter enters, if any. When someone enters a wrong password on a review link, we store their IP address and a failure count to stop password guessing. That record is removed after a correct password is entered from the same address, or when the link is deleted.
• Waitlist: your email address and the kind of work you deliver.
• Email you send us: messages to support@composit.app or legal@composit.app, including reports about content.
• Content reports: what you enter in the report form on our Copyright and Content Reports page. Depending on the type of report, that is your name, email address, phone number, and postal address, where the content is, a description of the copyrighted work, your description, the statements you confirm, and your signature. We also store a keyed one-way hash of your IP address, not the address itself, to limit repeated submissions.
• Do-not-email list: if you ask us to stop emailing an address, we keep that address, the date, and the request ID of the related report, if any, so we can honor the request.
• Log data: our hosting providers record technical logs of requests to the Service, including IP addresses, times, and error details.
• Analytics: we do not use third-party analytics.
• Payments: we do not collect payment information. The Service is free during beta.

3. How We Use It

We use this information to operate the Service: to process uploads and exports, deliver files, show review links and comments, limit the beta to people we invite, and keep a record of the Terms you accepted. We also use it to keep the Service secure and prevent abuse, to fix problems, to answer your messages and reports about content, to tell you when ComposIT is ready if you joined the waitlist, and to meet legal obligations, including reports we must make to the National Center for Missing & Exploited Children.

When you send a copyright notice, we share it with the user whose content it concerns, including your name and email address, but not your phone number or postal address. When a user sends a counter-notice, we forward it in full, including their contact details, to the person who sent the original notice, as the law requires. We do not tell the user whose content is reported who sent an intimate image or child safety report.

We do not sell personal data. We do not use your uploaded content to train AI or machine learning models.

4. Service Providers

These companies process data for us, only to provide their service to ComposIT and under their data processing terms:

• Clerk: sign-in and account management
• Supabase: database hosting
• Cloudflare: file storage (R2) and forwarding of email sent to our composit.app addresses
• Railway: video processing
• Vercel: application hosting
• Resend: sending email from our composit.app addresses, such as report confirmations
• Google: the mailbox that receives email forwarded from our composit.app addresses

5. Retention and Deletion

When you delete a project, its files are removed from storage and its records are removed from our database. Uploaded files are not copied into backups. We keep only the four most recent database backups and replace them on a rolling basis, so deleted records leave the backups as they rotate out, normally within 35 days.

When you ask us to delete your account, we delete its account data and content the same way.

These timelines do not apply to records and content we must keep for legal reasons, including content we must preserve after a report to NCMEC or at the request of law enforcement.

We keep content reports, including the IP address hash, as long as we need them to handle the report, track repeat infringement, and meet legal preservation duties.

We keep an address on the do-not-email list until you ask us to remove it.

You can ask us to remove your waitlist entry at any time. Our hosting providers keep their logs for limited periods under their own retention settings.

6. Your Choices and Rights

Email legal@composit.app to access, correct, export, or delete your personal data, or to remove your waitlist entry.

To stop email from us, reply with the word stop to an email we sent, or email legal@composit.app. We add your address to our do-not-email list within 7 days. We may still send messages the law requires.

California residents: we do not sell or share personal information as those terms are defined by the California Consumer Privacy Act. You may exercise access and deletion rights at the same address.

7. Security

Data is encrypted in transit with TLS and encrypted at rest by our storage providers. Uploaded files are stored privately and can be reached only through short-lived signed links. Review links use unguessable tokens and support passwords and expiry. No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires.

8. Children

The Service is for adults. You must be 18 or older to create an account. We do not knowingly collect personal information from children under 13.

9. Changes

We will post updates on this page with a new effective date and will email account holders about material changes.

10. Contact

ComposIT is operated by Charles Curtis Hays. Email legal@composit.app.