Privacy Policy

OfflineContent · Last updated: 19 October 2026

Operated by Flames Media (CVR 44298686), Copenhagen, Denmark · hello@offlinecontent.app

OfflineContent ("we", "us", "the Service") is operated by Flames Media, a sole proprietorship based in Denmark. This policy explains what personal data we process when you use OfflineContent, why, how we protect it, and the rights you have under the EU General Data Protection Regulation (GDPR). If you have any questions, contact us at hello@offlinecontent.app.

1. What OfflineContent does

OfflineContent is a web application that turns long-form video (for example a Twitch or YouTube VOD you own or have the right to use) into short vertical clips, generates subtitles, and — only when you explicitly connect an account and ask it to — schedules or publishes those clips to third-party platforms such as TikTok, YouTube and Instagram.

2. Data we collect

Account data — your email address and authentication details, handled by our authentication provider (Supabase).
Connected-platform tokens — when you connect TikTok, YouTube, Instagram, or Twitch, we store the OAuth access/refresh tokens those platforms issue, solely to perform the actions you request (e.g. publishing a clip you created). We do not post anything without your action.
Content you submit — the source video URLs/identifiers you provide and the artifacts we derive from them (transcripts, clip candidates, rendered clips, thumbnails, layout settings).
Usage & billing data — your processing credit balance and ledger, and, if you purchase credits, payment data handled by our payment processor. We do not store full card numbers.
Technical data — basic logs needed to run and secure the Service.

3. How we use it (and legal basis)

To provide the Service you request — clip generation, scheduling, publishing (performance of a contract).
To meter usage and bill credits (performance of a contract).
To secure the Service and prevent abuse (legitimate interest).
To comply with legal obligations (legal obligation).

4. Service providers / sub-processors

We use the following processors to run OfflineContent. We share only the data each one needs:

Cloudflare — hosting, request proxying, and object storage (R2) for your artifacts.
Supabase — authentication and the accounts/credits database.
Modal — on-demand GPU compute that transcribes audio and renders clips.
AI text providers (e.g. DeepSeek via OpenRouter) — we send transcript text to identify clip-worthy moments and generate titles/descriptions.
Platforms you connect (TikTok, Google/YouTube, Instagram/Meta, Twitch) — accessed through their official APIs under your authorization.
A payment processor — to handle purchases of processing credits.

Some of these providers are located outside the EU/EEA (e.g. in the United States). Where that is the case, transfers are made under appropriate safeguards such as the EU Standard Contractual Clauses.

5. Data retention

Full source audio is processed transiently and not retained after a job completes.
Intermediate download segments are deleted once a clip is rendered.
Rendered clips are retained for a limited period (around 30 days, depending on your plan) and may be deleted automatically afterwards.
Transcripts, clip metadata, and your settings are kept while your account is active.
Connected-platform tokens are kept until you disconnect that platform or delete your account, at which point they are deleted from our systems. To also remove OfflineContent's access on the platform side, revoke it in that platform's own settings (see sections 7 to 9).
Account and billing records are kept as long as required for the Service and for legal/accounting obligations (Danish accounting law: 5 years).

6. Data security

We apply technical and organisational measures to protect your personal data, including the sensitive credentials you entrust to us when you connect a platform:

Encryption in transit — all traffic between you, the Service, and the platform APIs runs over HTTPS/TLS.
Encryption at rest — your connected-platform OAuth access and refresh tokens are encrypted before they are written to our database, using authenticated encryption (AES-128-CBC with HMAC-SHA256, via Fernet). The encryption key is held server-side in our runtime environment, separate from the database, so a database leak or backup alone does not expose usable credentials. Tokens are decrypted only server-side, at the moment an API call you initiated needs them.
Per-user isolation — your media, transcripts, and artifacts are stored in object storage scoped to your account; tokens are never displayed to you or to any other user.
Access control — production credentials and the token-encryption key are restricted to the systems that run the Service. We do not access the content of your connected accounts except to perform an action you have requested, for security, or to comply with law.
No advertising or model training — we do not sell your personal data, and we do not use data obtained from your connected platforms for advertising or to train AI/machine-learning models.

No method of transmission or storage is completely secure, but these measures are designed to keep the risk to your data — particularly platform credentials — low. If we ever become aware of a breach affecting your personal data, we will act in line with our GDPR obligations, including notification where required.

7. Google / YouTube data — Limited Use

If you connect a YouTube channel, OfflineContent requests only the scopes it needs: youtube.readonly (to show which channel is connected and the status of videos you publish through the app) and youtube.upload (to upload videos you explicitly choose to publish to your own channel, with the title, description and visibility you set). No uploads or changes happen without your action, and we request no broader channel-management scopes.

OfflineContent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer YouTube/Google user data to third parties except as needed to provide or improve a feature you requested, for security, or to comply with applicable law; we do not use it for advertising; and we do not use it to train generalised AI/ML models. Use of YouTube data is also subject to the Google Privacy Policy. You can revoke the app's access at any time in OfflineContent (disconnect) and in your Google Account permissions; disconnecting deletes the stored tokens.

8. TikTok & connected accounts

When you connect TikTok we use TikTok's official Login Kit and Content Posting API. We request only the permissions needed to identify your account and upload/publish the content you create. We query creator_info only to show you which account you are posting to and the audience/interaction options your account allows. We do not read, store, or analyse your TikTok content, followers, or activity. We store the token only to act on your behalf, and you can disconnect at any time — in OfflineContent and in your TikTok account settings — which revokes our access. The same applies to YouTube/Google and Twitch.

9. Instagram (Meta) data

If you connect an Instagram professional account (Business or Creator), OfflineContent uses Meta's official Instagram API with Instagram Login and requests only two permissions: instagram_business_basic, to show which account is connected (your username, account ID and account type), and instagram_business_content_publish, to publish Reels that you explicitly choose to post now or schedule, with the caption and options you set. To publish, we give Instagram a temporary, signed link to the rendered video so Instagram can fetch it. We do not read, store or analyse your Instagram posts, followers, comments, messages or insights, and we do not post anything you did not ask us to post.

Your Instagram access token is stored encrypted (see section 6) and refreshed automatically while you stay connected, so scheduled posts keep working. We do not sell Instagram data, share it with third parties except as needed to provide the feature you requested, use it for advertising, or use it to train AI/machine-learning models. Use of Instagram is also subject to Meta's Instagram Terms of Use and Privacy Policy.

10. How to delete your data

You can delete the data OfflineContent holds about you, including data received from Instagram, TikTok, YouTube and Twitch, at any time:

Disconnect one platform — in OfflineContent go to Settings and click Disconnect next to the platform. The stored tokens and account details for that platform are deleted immediately, and any posts still scheduled for it will not be published.
Delete your whole account — on the Account page choose Delete account. This permanently deletes your account, platform connections, media, transcripts and settings. Billing records are kept only as Danish accounting law requires (5 years).
Revoke access on Instagram — in Instagram go to Settings → Apps and websites and remove OfflineContent. (TikTok and Google offer the same in their account settings.)
By email — write to hello@offlinecontent.app from your account email and we will delete your data within one month.

Videos you already published to Instagram or another platform live on that platform; delete them there.

11. Your rights

Under the GDPR you can request access to, correction of, deletion of, or a portable copy of your personal data, and you can object to or restrict certain processing. Email hello@offlinecontent.app and we will respond within the legal time limits. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

12. Cookies

We use only the cookies/local storage necessary to keep you signed in and run the Service. We do not use third-party advertising cookies.

13. Children

OfflineContent is not directed to children under 16, and we do not knowingly collect their data.

14. Changes

We may update this policy; the "last updated" date above reflects the latest version. Material changes will be communicated through the Service.

15. Contact

Flames Media (OfflineContent), CVR 44298686, Copenhagen, Denmark — hello@offlinecontent.app.