Legal

/

Privacy Policy

Privacy Policy

last updated: 04.08.2026

  1. About this policy

This policy applies to the Evercut website at https://www.evercut.app, the Evercut macOS app, Evercut Share at https://share.evercut.app, and messages sent to us through the website (together, the “Services”).

It does not apply to third-party services you choose to use, or to content you choose to export, publish, send, upload, or share outside Evercut. Those services have their own privacy policies.

  1. General information

Tolv.Studio Damian Jankowski, a sole trader registered in Poland, NIP 7831912730, is the controller of the personal data described in this policy. In this policy, “Evercut”, “we”, “us”, and “our” mean Tolv.Studio Damian Jankowski.

You can contact us about privacy at support@evercut.app

  1. Privacy overview

  • Screenshots, recordings, microphone and camera media, project files, OCR text, transcripts, imported media, and edits stay on your device unless you choose to publish a video through Evercut Share or otherwise export or upload them yourself.

  • If you publish through Evercut Share, we host the video and thumbnail you select, together with share settings and related information, so people with access to the link can view it. Public shares can be viewed by anyone with the link. Private shares are limited to the email addresses you allow.

  • We use Supabase for accounts, sign-in, synchronised presets, and billing access records; PostHog for optional, account-linked product analytics and redacted error diagnostics; Stripe for checkout and payment processing; and Cloudflare for Evercut Share, media storage, security, and delivery.

  • We use Framer’s built-in, cookie-free analytics on the website, Resend to deliver sign-in emails, Google when you choose Google sign-in, and GitHub to deliver the optional local transcription model download.

  • We do not sell personal information or share it for cross-context behavioural advertising.

  1. Data we process

4.1 Your Creative Work

Evercut processes recordings, screenshots, microphone and camera media, cursor activity, OCR text, transcripts, project files, imported media, exports, local preferences, selected device names, and clipboard actions on your device. Transcription also runs locally. When you first use transcription, the app may download the Parakeet speech-recognition model from a GitHub release. GitHub receives the technical information needed to deliver that download, such as an IP address and request data. Your audio and generated transcript are not sent to GitHub or Evercut for transcription.

We do not upload your creative work to Evercut as part of ordinary local capture, editing, or export. If you choose to publish a video through Evercut Share, the app uploads the rendered video and its thumbnail to our service. If you copy, export, or upload content to another service, that service handles the information you choose to send it.

4.2 Website Visits

When you visit the website, Framer and its infrastructure providers may process technical information such as your IP address, browser and device information, pages requested, timestamps, referrer, and security logs to deliver and secure the site, investigate faults, and prevent abuse.

We also use Framer’s built-in analytics to understand aggregated website use. Framer describes this analytics as cookie-free and says it uses a daily rotating hash derived from a visitor’s IP address and user agent to count daily unique visitors. The dashboard provides aggregate trends such as pages viewed, referrers, country, and device type. We do not keep a separate IP-address analytics database. See our Cookie Policy for more about website cookies and similar technologies.

4.3 Contact Messages

If you contact us through the website, we receive the name, email address, and message you provide. We use this information only to read, assess, and reply to your enquiry. We do not add you to a marketing list or newsletter unless you separately ask us to do so.

Please avoid sending sensitive, confidential, or unnecessary personal information through the contact form.

4.4 Account Information

If you create an account, we process your email address, Supabase user ID, sign-in provider and provider account identifier, account status and timestamps, and authentication-session data. You can sign in using an email magic link or, if you choose, Google. Google may provide the basic profile information available through the sign-in scopes, such as your email address, name, profile image, and Google account identifier. We use this information to provide sign-in and identify your account, not for advertising. Resend processes the recipient email address and email content needed to deliver magic-link messages.

The app stores your authentication session on your device using macOS-secured storage where available. Supabase and Google may also process network, security, and authentication information such as IP address, device or app information, request timestamps, and sign-in audit data when you use their services.

4.5 Preset Sync

If you use synchronised presets, we process preset names, settings and configuration, selected-preset preferences, technical record identifiers, and timestamps so those presets are available to your account. Preset names may contain personal data if you put it there, so please avoid including unnecessary or sensitive information.

4.6 Product Insights

If you are signed in and leave “Share usage analytics” enabled in the app settings, Evercut sends product events to PostHog using your Supabase user ID as the event identifier. This means analytics are linked to your account; they are not anonymous. You can turn this off at any time in app settings. Changing the setting may send one final event recording that preference change; analytics events stop after the setting is turned off.

Events describe product use, such as launching or quitting the app, completing a capture or recording, exporting, using editing features, generating a transcript, changing settings, creating or managing a share, and app update stages. Event details can include the action type, capture mode, selected output format or resolution, whether a microphone or camera was used, duration, and success or failure status. We may also send a shortcut-style preference as an account property. We do not send your recordings, screenshots, project contents or names, transcript or OCR text, clipboard contents, keystrokes, cursor paths, or file paths as product-analytics event data.

When an app error occurs and analytics are enabled, we may send a diagnostic containing the error class and a redacted error message and stack trace, along with app version, operating system, processor architecture, and Electron version. Before transmission, the app filters credentials, URLs and query strings, local file paths, and email addresses from diagnostic text. Error reports can still contain technical details about the failure. We do not use PostHog session replay, website autocapture, or advertising features in the app.

PostHog may receive network and security information, such as IP address and request metadata, when it receives events. PostHog processes event data under its own service terms and our project configuration.

4.7 Connection Data

When the app connects to Supabase to sign in, refresh a session, synchronise presets, or send product-insight totals, Supabase may process network and security data such as IP address, user-agent or app/device information, request timestamps, request path and status, and authentication audit information. Google processes the technical and authentication information needed when you choose Google sign-in.

We do not currently use a separate crash-reporting service or third-party app-analytics SDK.

4.8 Where It Comes From

Most of this data comes directly from you or your device when you visit the website, use the app, create an account, submit a message, or choose a feature. Google provides the account information made available when you choose Google sign-in. Framer, Supabase, GitHub, and our business-inbox provider generate the technical and service information described above while providing their services. We do not buy personal data or obtain it from data brokers.

4.9 Evercut Share

When you publish a video, we process and store the rendered video and thumbnail, share title, share and version identifiers, source project identifier, visibility and expiry settings, timestamps, and upload status. We do not upload your original editable project bundle as part of publishing.

For private shares, we store the email addresses you allow to view each share. A viewer must verify an allowed address through Supabase sign-in before viewing. Supabase and Resend process the viewer’s sign-in information and deliver any magic-link email. We store the verified viewer identity and a hashed viewer-session token to enforce access.

Evercut Share uses essential first-party browser storage, including cookies, to keep verified viewer sessions and anonymous commenter identities working. These technologies are needed for access and comment features and are not used for advertising.

If comments are enabled, we store comment text, display name, video timestamp, reply information, and related timestamps. A person who comments without signing in is represented by a browser token; we store a hash of that token so the browser can manage its comments. Signed-in viewers may have their verified account identity associated with their comments. We use Cloudflare Turnstile to help prevent automated abuse of comments. For security and rate limiting, our Share service may use the requesting IP address; when Turnstile verification is required, the IP address is sent to Cloudflare for verification.

Anyone with a public share link can view that share. You can change visibility, revoke, or delete shares in the app. People who can view a share may copy or record its content, so revoking a link cannot remove copies they already made.

4.10 Billing and Payments

If you choose a paid plan, checkout is provided by Stripe using Stripe Managed Payments. Stripe processes the payment and billing information you provide, such as your name, email address, billing address, payment details, transaction, subscription, tax, refund, and invoice information. Stripe acts as the merchant of record for these transactions and may process information under its own privacy policy and legal obligations. Evercut does not receive or store your full payment card number or security code.

We receive and store account-linked billing records needed to provide and administer your plan, including Stripe customer, subscription and invoice identifiers, chosen plan and billing interval, subscription and payment status, paid-through or entitlement dates, and billing-operation records. We use these records to grant or remove app access, manage subscription changes, prevent duplicate processing, respond to billing issues, and support account deletion. Stripe may process IP address, browser or device details, and checkout activity as part of its hosted payment service.

  1. How we use data

We use personal data only to:

  • provide and operate the website and app;

  • create, secure, and administer accounts;

  • synchronise presets and provide account-linked features;

  • understand aggregate website use and account-linked feature adoption;

  • respond to genuine enquiries;

  • protect the Services, prevent abuse, troubleshoot problems, and defend or establish legal claims; and

  • comply with applicable legal obligations.

For people in the EEA and UK, our legal bases are:

  • Contract: where processing is needed to provide an account, sign-in, synchronised presets, or another account-linked feature you request.

  • Legitimate interests: where needed to run and secure the website and app, reply to enquiries, understand feature adoption, improve the Services, prevent abuse, and protect or defend our rights. We consider the impact on your privacy and use only the data reasonably needed for these purposes.

  • Legal obligation: where we must keep or disclose information to comply with applicable law.

  • Consent: if we introduce a processing activity that relies on consent, we will ask for it at the relevant time and explain how to withdraw it.

You do not need an account to browse the website or use local-only app features. An email address and account-authentication information are needed for account-based features. Google sign-in is optional. Screen recording, microphone, camera, and accessibility permissions are optional, but the related feature will not work without the relevant macOS permission. Sharing, comments, and checkout are optional; the information requested for each is needed to provide that feature.

  1. Our providers

We use providers only where they help us run the Services. They receive only the information needed for their role.

  • Framer hosts the website, contact form, and built-in website analytics.

  • Cloudflare provides DNS, Evercut Share application hosting, database and media storage, content delivery, security services, and Turnstile bot verification.

  • Supabase provides account authentication and database services for account information, synchronised presets, billing access records, and private-share viewer verification.

  • PostHog receives product analytics events and redacted error diagnostics when app analytics are enabled.

  • Stripe provides hosted checkout and processes billing and payment transactions as merchant of record.

  • Google provides Google sign-in if you choose it.

  • Resend delivers transactional email such as account and viewer sign-in links.

  • GitHub delivers the optional transcription-model download.

Some providers may process information in countries outside your country of residence, including outside the EEA or UK. Where data-protection law requires it, we use an appropriate transfer mechanism and safeguards.

We may also disclose information if reasonably necessary to comply with law or valid legal process, protect the rights, safety, or security of Evercut or others, or handle a merger, sale, financing, or transfer of all or part of our business. We may use or share aggregate information that does not identify you.

We do not sell personal information or share it for cross-context behavioural advertising.

  1. Data retention

We keep personal data only for as long as reasonably needed for the purpose for which it was collected, unless a longer period is required or permitted by law. We do not keep personal data indefinitely, and we periodically review what we hold and delete or anonymise data we no longer need.

  • Account and synchronised-preset data: while your account is active, then deleted or anonymised after account deletion, subject to legal requirements and limited backup retention.

  • Published shares and comments: while needed to provide your share and its settings. When you delete your account, we remove your hosted shares and associated Share data. When you delete, revoke, or expire a share, media and operational records may remain for a limited recovery, security, or backup period before removal.

  • Analytics and diagnostics: retained in PostHog under the retention controls configured for our project. Turning analytics off stops future app events but does not itself delete events already sent. Account deletion also does not automatically erase events already sent to PostHog; you may contact us to request access or deletion where applicable.

  • Billing and transaction records: retained as needed to administer a plan, resolve billing issues, prevent fraud, and meet legal or accounting obligations. Stripe may retain its transaction records under its own policies and legal obligations.

  • Contact messages: for the time needed to handle your enquiry and a reasonable period afterward in case you follow up, unless a legal claim or obligation requires longer retention.

  • Provider logs: retained under the relevant provider’s service configuration for security, operations, troubleshooting, or delivery.

  • Privacy requests: retained for a reasonable period after completion to document how the request was handled.

Encrypted backups may retain some account or service data for a limited rotation period after deletion before being overwritten. Local projects, exports, and downloaded transcription models remain on your device and are controlled by you.

  1. Your privacy rights

If the GDPR or UK GDPR applies, you may have the right to:

  • ask for access to your personal data;

  • ask us to correct inaccurate or incomplete data;

  • ask us to delete personal data in certain circumstances;

  • ask us to restrict processing in certain circumstances;

  • receive a portable copy of data you provided where the right applies;

  • object to processing based on legitimate interests; and

  • withdraw consent where we rely on it. Withdrawal does not affect processing that took place before withdrawal.

We do not make decisions about you solely by automated means that produce legal or similarly significant effects.

To exercise a right, email support@evercut.app with the subject line “Privacy request” and tell us the right you wish to use. We may ask for information reasonably needed to verify your identity and authority before acting on a request. We normally respond within one month under the GDPR and UK GDPR, or explain any lawful extension or limitation.

You can delete your account in the app’s account settings. Account deletion cancels active subscriptions, removes your Evercut account and hosted shares, and deletes or de-identifies account data we control, subject to legal retention requirements and limited backup retention. Analytics already sent to PostHog and transaction records retained by Stripe may remain as described in section 7.

You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or to the authority where you live or work, or where you believe an infringement occurred. UK users may complain to the Information Commissioner’s Office.

  1. Cookies & analytics

Our website uses Framer’s built-in, cookie-free analytics and any essential technologies needed to deliver and secure the website. It does not use Google Analytics, advertising pixels, social-media pixels, or behavioural-advertising cookies.

Our Cookie Policy at cookies policy page provides more detail. Before we add a non-essential cookie, embedded service, or third-party script, we will review whether consent is required and update the Cookie Policy before it runs.

  1. Recording responsibly

The app asks macOS for Screen Recording, Microphone, Camera, or Accessibility permission only when a relevant feature needs it. You can decline, revoke, or change permissions in macOS settings; the corresponding feature may stop working.

You are responsible for obtaining any notice, permission, or consent required from people whose voices, images, communications, personal data, or confidential information are captured in your content. You are also responsible for choosing the visibility and audience for content you publish through Evercut Share.

  1. Children’s privacy

Evercut is not intended for anyone under 16. Please do not use the Services or send us personal data if you are under 16. If you believe a child has provided us personal data, contact us at support@evercut.app

  1. U.S. privacy rights

This section applies only where a U.S. state privacy law applies to Evercut and you. Under the current product design, the categories of personal information we may collect are:

  • identifiers, such as name, email address, account or provider identifiers, and IP address;

  • internet or electronic network activity, such as website technical information, Framer Analytics information, app connection data, and account-linked product-insight totals; and

  • contact-message content.

We collect this information from you, your device or browser, your selected sign-in provider, and our providers. We disclose it to the providers described in section 6 only as needed to run the Services.

We do not sell personal information or share it for cross-context behavioural advertising. We do not use or disclose sensitive personal information to infer characteristics about you.

Depending on applicable law, you may have rights to know or access, correct, delete, obtain a portable copy of, or opt out of certain processing of personal information. You may make a request using the contact details in section 9. An authorised agent may make a request where allowed by law; we will verify the agent’s authority and may ask you to verify your identity directly. We will not discriminate against you for exercising an applicable right.

Where an applicable state law gives you a right to appeal our decision, email support@evercut.app with the subject line Privacy appeal. We will explain the outcome and any available external appeal route.

  1. Keeping data secure

We use reasonable technical and organisational measures designed to protect personal data, including access controls and encrypted local storage for app authentication sessions where supported by macOS. No system or transmission is completely secure; please protect your devices, account access, and exported files.

On this page: