This describes what the service actually stores, where it goes, and how to get it back or have it deleted. It is written against the code rather than from a template, so it is specific — and if it ever stops matching what we do, the code is wrong, not this page.
You need an account to use Prosiv. There is no anonymous mode, which means everything we hold belongs to someone who can ask us for it or ask us to erase it. That is deliberate.
Prosiv is available in the United States only. We refuse requests from elsewhere rather than serve people under privacy regimes we are not yet set up to honour properly. We intend to open other countries, and will update this page before we do.
| What | Why |
|---|---|
| Your email address and display name, from Google | To identify your account. We never see or store a password — sign-in happens at Google, and we receive only the result. |
| The provider's user id for you | So that signing in again finds the same account. |
| A hashed session token, its expiry, and your browser's user-agent string | To keep you signed in. The token in your browser is not stored here; only a hash of it, so our database cannot be used to impersonate you. |
| Your credit balance, and the amount, date and Stripe reference of each purchase | To know what you have bought and what you have spent. We never receive or store card details. |
| Every prompt you render, and the filename and date of each clip and uploaded image | This is your library — what lets you come back and find what you made. |
| Your videos and the images you upload | So they exist. They are kept in object storage, not on a disposable server. |
| A timestamp per generation, for rate limiting | To stop one account pushing unlimited prompts through. Deleted when your account is. |
| A SHA-256 digest of each prompt, with the moderation verdict and the rule applied | So we can answer an abuse complaint. This holds a one-way digest and never the prompt text. |
We count visits with Cloudflare Web Analytics, which tells us how many people load each page, where they came from and how fast it loaded. It sets no cookies and stores nothing in your browser, it does not follow you to other sites, and it is not used for advertising. We run no advertising and no tracking pixels, and our fonts are served from our own domain rather than Google's. The only cookie is the one that keeps you signed in; it is strictly necessary, so there is no consent banner to click.
Running the service means handing parts of your data to other companies. All of them are processors acting on our instructions:
| Who | What they receive |
|---|---|
| Anthropic | Your messages and prompts, to write and revise shot descriptions. |
| RunPod | Your final prompt and any image you attach, to render on a GPU. |
| Stripe | Your payment. Stripe collects an email for receipts and disputes; we never hold your card. |
| Neon | The database described above. |
| Cloudflare | Every request to the site passes through Cloudflare, which protects it and routes it, and so sees your IP address and the pages you load. It also provides the visit counts described above. |
| Fly.io and Tigris | Hosting, and storage of your videos and uploads. |
| Only the sign-in exchange. They tell us who you are; we tell them nothing about what you make. |
These are United States companies and the service is offered only in the United States, so your data is processed here. If that changes when we open other countries, we will say so before it does.
Your library holds up to 50 videos. When it is full, a new render is not started until you delete one — the ✕ beside it in the Library — and nothing is charged for the attempt. We never delete a video for you to make room, and nothing expires on a timer: your clips, uploads and prompts stay until you delete them or close your account. Edited versions of a video (captions, voiceovers, trims, joins) do not count toward the 50. Download anything you want to keep before deleting it; a deleted video is removed from our storage and cannot be recovered.
Two things outlive a deleted account, both deliberately. Purchase records — the amount, the date and the Stripe reference — are kept because tax law requires it and because they are our only evidence if a payment is disputed; they contain no name, address or card. And the moderation log is kept with your account id removed, so it identifies nobody; deleting it entirely would let an account erase the record of what it was refused for simply by closing itself.
See and take everything. Download your data as a single JSON file — your account, your sign-in methods, your sessions, every prompt, every purchase, and every moderation verdict. Nothing is held back.
Delete everything. Deleting your account removes your email, name, sessions, sign-in methods, library records and rate-limit history, and deletes your videos and uploads from storage — not just the rows pointing at them. It cannot be undone, and any remaining credits are lost.
You may also ask us to correct anything that is wrong. Several US states — California, Virginia, Colorado, Connecticut and others — give residents rights to know, delete, correct and opt out of sale or sharing. We do not sell or share personal information with anyone for advertising, and we never have, so there is nothing to opt out of. We honour the rest of those rights for everyone rather than checking which state you are in, because the export and deletion buttons do not care.
If you think we have handled your data badly you can complain to your state Attorney General, and in California to the Privacy Protection Agency. We would rather you raised it with us first.
To exercise anything that is not a button on this site, write to [email protected]. We answer within 30 days, and faster where the law requires it.
Most of it is because we cannot provide the service otherwise: an account, a balance and a library are the product. Moderation and rate limiting rest on our legitimate interest in not running a service that is trivially abused, and on our obligations under the licence for the model we use. Purchase records rest on a legal obligation. We do not rely on consent for any of this, because consent you cannot refuse while still using the service is not consent.
Prosiv is for adults. You must be 18 or older to use it. We do not knowingly collect anything from a child, and if we learn that we have, we will delete the account and its contents.
Sign-in is delegated to Google, so there is no password here to leak. Session cookies are HTTP-only, same-site and sent only over HTTPS. Download links are signed and expire after an hour, so a link that escapes does not work indefinitely. Card details never reach our servers.
No service can promise it will not be breached. If one happens and it puts you at risk, we will tell you and the authorities required by the breach notification law of your state, without unreasonable delay.
If we change this in a way that matters, we will say so on the site before it takes effect rather than quietly moving the date at the top.