ByeCut —

Privacy Policy for ByeCut

Effective date: 30 October 2026

Applies to: the ByeCut iPhone and iPad app, previously called AutoCut, TheoCut and TheoReel

Controller and developer: Thinkbyte SRL ("we", "us")

Contact: info@thinkbyte.tech

How ByeCut handles your content

Manual editing, on-device captions, effects and video exports run on your device. AI Edit is optional: after you agree in the app, audio-only copies go through our backend to Deepgram for transcription, and audio, transcripts, scripts and notes may go to OpenAI to plan and review your edit. Video frames are not sent to these AI providers. Text and editing results are saved on our backend so interrupted AI Edits can recover, and the audio of each AI Edit is kept for up to 30 days to complete it and fix problems with it. We do not sell or rent your personal data or display advertisements inside the app. We use product analytics and advertising measurement as explained below.

Projects, iCloud, permissions and sharing

Projects, imported videos and photos, recorded voiceovers, captions, edits and exports are stored locally. On-device face analysis, retouching, tracking and background removal process images locally; we do not send face images or face measurements to our AI or analytics providers.

If you enable project sync, Apple stores project files and media in your own iCloud Drive. Portable project backups are saved wherever you choose in Files. These copies are separate from our account backend. When you export or share, Photos, the share sheet or your selected social app receives the content you choose. Apple's and the receiving service's policies apply to those copies.

The app requests microphone access for voiceovers, permission to add exports to Photos, speech-recognition access for captions where needed, and notification permission when you enable alerts. You choose the media to import. You can change system permissions in iOS Settings; features that need them may then be unavailable.

Account and sign-in information

The current app requires an authenticated account. Sign in with Apple supplies a provider identifier and, if provided, an email address, which may be an Apple private relay address. We request email, not your name, from Apple. Google sign-in may also be offered when enabled; it uses Google's identity, email and profile scopes. Supabase processes sign-in information and authentication sessions. We use your account ID to maintain usage, recovery records, referrals and subscription access across devices. Older installations may have an anonymous session whose usage is merged when you sign in; fresh installs do not need a new anonymous account before sign-in.

To enforce the one-time free AI edit, we retain a salted, one-way hash of your sign-in identity and the free allowance already used. This is a pseudonymous abuse-prevention record: it has no email or name, but allows us to recognise a returning identity. Deleting and recreating an account does not reset eligibility.

AI processing and saved recovery data

What is sent and to whom

• Deepgram: audio-only copies of source ranges submitted to AI Edit, together with transcription settings such as the spoken language, to produce word-timed transcripts. Our requests opt out of Deepgram's Model Improvement Program. Deepgram says opted-out audio and transcripts are kept only while processing the request; request metadata and usage logs remain subject to its retention rules. See Deepgram's data handling.
• OpenAI: transcripts, any script, notes or editing instructions you supply, relevant timeline information, and audio excerpts when listening review is used, to propose and review cuts. The online editing assistant sends your request and a text description of the timeline rather than the media files. API requests disable response storage. OpenAI does not train on API content by default; abuse-monitoring logs may contain content and are normally retained for up to 30 days, unless a longer period is legally required. Turning off response storage does not remove this separate retention. See OpenAI's API data controls.
• Supabase: our backend authenticates and meters requests. It saves run and project IDs, settings, scripts, notes, transcripts, AI responses, progress, checkpoints and final editing results linked to your account, allowing interrupted runs to resume. Online assistant requests are not saved in the AI Edit recovery tables.
• AI Edit audio and Fly.io: to run an AI Edit, the app uploads one audio-only file of the edit's timeline to a private Supabase storage bucket, and our editing server, hosted by Fly.io in Frankfurt, Germany, processes it from there. Video is never uploaded. We keep this audio for up to 30 days, only to complete the edit, recover interrupted runs, and investigate and fix problems with your edits, for example by replaying an edit that failed or went wrong to test a correction. Only the ByeCut team can access it; it is not used for advertising or to train AI models. It is deleted automatically 30 days after upload, or earlier when you delete your account.

The public app uses Deepgram and OpenAI. Development builds can offer other processing choices, including on-device Apple transcription and Anthropic for text reasoning; their consent screen identifies the providers for those choices.

Your AI consent

Before the first AI Edit, the app asks permission to send audio and related text to the disclosed providers. You can decline and use manual editing. Withdraw this permission in Settings → AI Edit → Stop Sharing Audio with AI. A later AI Edit requires consent again. Withdrawal stops future consent-dependent sharing; it does not undo completed processing or delete saved recovery records. Use account deletion or contact us to request deletion of existing data.

Usage, purchases and onboarding

• AI usage: Supabase stores source duration, run status, clip counts, language, provider/model settings, progress, retries, dates and allowance reservations/settlements to deliver the service, recover runs, enforce limits and investigate failures.
• Purchases: Apple handles App Store billing. RevenueCat processes your ByeCut account ID, transaction and product identifiers, subscription status, trial/offer information and purchase history to provide, restore and verify access. RevenueCat sends entitlement updates to our backend. We do not receive your payment-card details from Apple.
• Onboarding answers: choices such as creator type, posting frequency and time spent editing, plus an estimated time-saving figure and app version, can be stored in Supabase against your account and included in product analytics to understand and improve the app.

Product analytics and advertising measurement

PostHog: we send feature and screen events, counts, durations, technical error codes, app/device information, onboarding choices and experiment/feature-flag assignments to PostHog's EU service. Events start with an installation identifier. After sign-in, PostHog identifies the profile with your Supabase account ID and can merge earlier anonymous events. The same account ID is used for RevenueCat, and run/project IDs can link analytics to backend records. These records are pseudonymous, not necessarily anonymous. They include how much of an AI Edit result you played, word counts and spoken duration of the footage you submitted to AI Edit, and your AI Edit ratings with the reasons you pick. Product analytics events do not include your video, audio, transcripts, captions, project names, scripts, prompts or feedback comments.

Apple Ads: Apple's AdServices attribution can identify the advertising campaign, ad group or keyword that led to an install. Attribution information is used in PostHog and RevenueCat to measure campaign and subscription performance.

Meta App Events: the app is configured to measure installs, sessions and selected conversions, including sign-in, onboarding, project creation, AI Edit completion, export, paywall views and usage-limit events. Subscription or trial events can include value and currency. We do not attach project content, transcripts, scripts, prompts, names or email addresses to these conversion events. Meta's SDK also processes technical device/network information needed to deliver its service. The current app does not request App Tracking Transparency permission, so it does not obtain access to the advertising identifier (IDFA) without that permission. Apple's SKAdNetwork can provide aggregated attribution. See Meta's privacy policy.

Turn off Settings → Privacy → Share Usage Data to opt out of PostHog product analytics and the app's Meta usage/conversion events, including automatic app-event logging. This does not delete earlier events, cancel purchases, disable essential operational diagnostics or turn off all Apple-provided attribution. Contact us about deletion of existing records.

Diagnostics and support

Release builds automatically upload available crash reports and AI Edit failure diagnostics to Supabase to investigate reliability problems. These can include crash/error text, report/run/project identifiers, failure stage, settings, source duration and clip counts, language, progress, app/build/OS version and device model. Crash or error text can contain incidental context. This operational reporting is separate from the optional product-analytics toggle; it does not upload your source video or audio.

When you submit feedback or report a problem, we process your subject, description, reproduction steps, optional contact email, app/device details, and any crash text or AI Edit diagnostic context attached to the report. Avoid including information you do not want us to receive. We use it to investigate and reply when you provide contact details.

Rating an AI Edit and sharing its audio

After an AI Edit, you can rate the result with a thumbs up or down, pick reasons and add an optional comment. Supabase stores the rating, reasons, comment, run and project IDs, the source and result durations, the spoken language and the app version against your account, so we can improve AI Edit.

Sharing a recording is a separate, optional choice that is off by default. Only if you turn on "Share this recording's audio" do we upload an audio-only, reduced-quality copy (mono, about 48 kbps) of the recordings that AI Edit used, together with the AI's edit plan and transcript for that run, to a private Supabase storage bucket. Video frames are never uploaded. Only the ByeCut team can access these files, only to reproduce and fix AI Edit problems; they are not sent to other AI providers, used for advertising or used to train AI models. Shared audio is deleted 30 days after upload, or earlier when you delete your account. Ask us at info@thinkbyte.tech to delete it sooner.

Referrals and notifications

If you use Invite Friends, Supabase records invite codes, the relationship between inviter and invitee, eligibility checks, bonus allowance, qualifying subscription/renewal status and reward/offer-code issuance or redemption. The inviter sees numbered entries such as "Friend 1", rather than your name or email. Entering an invite code can reveal your joining, trial, paid subscription, cancellation, payment issue, lapse, refund or account-departure status to the inviter through that entry and friend updates. A person who gave you a code may still infer which entry is yours. No address-book access is needed.

Referral identity hashes and reward records can survive account deletion to prevent repeated invitations or reuse of rewards; deleted account references are removed. These are distinct from the free-edit allowance ledger described below.

If you enable remote project or friend updates, we store your installation ID, Apple push-notification token, delivery environment and notification preferences in Supabase and use Apple's Push Notification service to deliver alerts. Friend-notification history and read state are also stored. Local reminders and completion alerts are scheduled on your device. Manage Project Updates, Reminders and Friend Updates in the app's notification settings, and system permission in iOS Settings. Turning off push alerts does not erase the referral relationship or in-app history.

Purposes and legal bases (EEA/UK)

• Providing the service and performing our contract: accounts, AI requests/recovery, usage metering, subscription access, requested referrals, notifications and support.
• Consent where required: sharing audio and text with AI providers, optional device permissions, and analytics or advertising measurement where the applicable rules require consent. You can withdraw the relevant permission or choice.
• Legitimate interests where permitted: service reliability, proportionate product measurement and fraud prevention, including identity hashes that prevent repeated free edits or referral abuse. You may object to processing based on legitimate interests.
• Legal obligations: records or disclosures required by applicable law.

Retention and account deletion

• Local projects remain until you remove them. Deleting the app can remove local app data; files saved to Photos, Files, iCloud or other apps must be managed separately.
• AI Edit audio is deleted 30 days after upload, or when you delete your account if that is sooner.
• Audio you share with an AI Edit rating, and the plan and transcript sent with it, are deleted 30 days after upload, or when you delete your account if that is sooner. The rating, reasons and comment stay with the account like other feedback.
• Account-linked AI recovery content, usage, onboarding answers, feedback and diagnostic records are retained to provide the service and investigate issues while the account remains in use, and are removed from our active account tables when the account is deleted. The scheduled 24-month inactivity cleanup applies to legacy anonymous accounts, not all signed-in accounts.
• The free-edit identity hash and used-allowance record survive account deletion and are scheduled for removal after 24 months without an update. Referral identity hashes and reward/anti-abuse records are retained as needed to enforce one-time referral eligibility and prevent reward reuse; they do not have that same 24-month automatic purge.
• Analytics and advertising providers retain events according to their configured retention and applicable policies; we use them for performance measurement and improvement and handle requests to delete identifiable records. AI-provider content retention is described above.
• Purchase, reward and legal records may be retained where needed for accounting, fraud prevention or legal obligations. Deleting a ByeCut account does not automatically erase records Apple or other providers must maintain independently. Backup copies, where applicable, expire through the relevant provider's backup cycle.

Use Settings → Account → Delete Account to delete your ByeCut account, remaining allowance and account-linked server content. Device and iCloud projects are not deleted by this action. Sign-out ends the app session but does not delete server records. Account deletion or uninstalling the app does not cancel an Apple subscription: manage it separately in iOS Settings → your name → Subscriptions. If Apple sign-in authorization cannot be revoked automatically during deletion, the app provides instructions to revoke it with Apple.

Service providers, transfers and security

We use Supabase, Fly.io, Deepgram, OpenAI, RevenueCat, PostHog, Meta and Apple for the purposes above, and Google when you select available Google sign-in. They may process data outside your country, including in the United States. The app's PostHog endpoint is in the EU; this does not mean all app data stays in the EU. Where legally required, international transfers need an adequacy decision or appropriate safeguards such as Standard Contractual Clauses. Contact us for information about safeguards relevant to your data.

We may disclose information when legally required or to protect users and the service. We use authenticated connections and access controls to protect backend records; no storage or transmission system is completely secure.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion or a portable copy of your personal data, restrict or object to processing, and withdraw consent. Contact info@thinkbyte.tech; include your Support ID from Settings → About if available so we can locate relevant records. We may need to verify the request. You may complain to your local data protection authority. Exercising these rights does not remove mandatory consumer rights.

Children, websites and policy changes

ByeCut is not directed at children under 13, or under 16 in the EEA, and we do not knowingly collect their personal data. Contact us if you believe a child has provided it.

This policy describes the mobile app. Website cookies and browser measurement are separate; see the ByeCut website Cookie Policy for browser controls. Visiting a policy page does not grant the app permission to upload your media.

We will update this policy when our processing changes and show the effective date above. If the scope of AI sharing changes, the app can ask for renewed consent before that sharing.