Privacy Policy

This Privacy Policy explains how OneStudio ("we", "our", or "us") collects, uses, shares, and protects information when you use our website and product (the "Service"). By using the Service, you agree to this Policy.

1. Information We Collect

1.1 Account information

When you create an account we collect your email address, display name, password hash, and authentication tokens. If you sign in via a third party (e.g. Google), we receive your basic profile (name, email, avatar) from that provider.

1.2 Content you create

Prompts, uploaded images, uploaded videos, generated images, generated videos, scripts, storyboards, project settings, brand kits (such as your logo, colors, descriptions, and offerings), and marketing posts you draft or schedule are stored on our infrastructure so we can deliver the Service to you and your teammates.

1.2a Connected accounts and contacts

When you connect a third-party account so the Service can publish or send on your behalf, we store the connection details needed to do that (see section 3.6 for YouTube and Google specifically). For messaging features, we process the contact details you provide or import (such as names and phone numbers) solely to send the messages you compose, and we do not use them for our own marketing.

1.3 Usage data

We collect server logs (IP, user-agent, request path, response status) and product analytics (page views, feature usage, model selections) via PostHog. We do not sell this data.

1.4 Payment data

Payments are processed by Stripe. We store the Stripe customer / subscription identifiers and your billing tier, never your card number.

2. How We Use Information

• To provide, maintain, and improve the Service.
• To process payments, send receipts, and enforce subscription limits.
• To send transactional email (password resets, important account notices).
• To detect, prevent, and respond to abuse, fraud, and security incidents.
• To comply with legal obligations.

3. Third-Party Model Providers

To generate images and videos, we forward your prompts and reference uploads to the third-party model provider you select (e.g. ByteDance Seedance, Kling AI, OpenAI, Google). Each provider operates under its own privacy policy. We don't control how providers retain or train on prompts; review their policies if this matters to you.

3.5 Cookies & Similar Technologies

OneStudio uses three categories of cookies. You choose which are set when you first visit the site, and you can change your choice at any time from the "Cookie preferences" link in the footer.

• Necessary: always on. Auth session, CSRF protection, checkout security (Stripe fraud detection). The Service will not work without these.
• Analytics: off by default. Product usage and page-view analytics through PostHog and Google Analytics (GA4). Helps us learn what to improve.
• Advertising: off by default. Google Ads conversion tracking and remarketing, delivered through Google Tag Manager. Measures our ad performance and lets us reach similar audiences.

When you accept or reject a category we also record a consent audit entry (timestamp, action taken, a salted hash of your IP address, browser user-agent, and country) so we can prove which choice you made if asked. We do NOT store your raw IP address.

3.6 Connecting Social Accounts (Google & YouTube API Services)

OneStudio lets you connect your own social accounts so you can publish and schedule the content you create directly to them. When you connect a YouTube or Google account, the Service uses YouTube API Services. By connecting a YouTube account you also agree to the YouTube Terms of Service, and your use of Google data is subject to the Google Privacy Policy.

What we access

When you authorize the connection through Google, you grant OneStudio permission to:

• Read your channel's basic public details (channel ID, channel title, and thumbnail) so we can show you which channel is connected.
• Upload and schedule videos to your own channel on your behalf (the youtube.upload scope). We only ever publish content you explicitly create and schedule in OneStudio.

We request the minimum scopes needed for this feature. We do not read your private videos, viewing history, subscriptions, comments, or analytics, and we never post to channels other than the one you connect.

What we store, and why

To perform a scheduled upload at the time you choose, we store an OAuth refresh token (kept encrypted and access-restricted) together with the connected channel's ID, title, and thumbnail. The refresh token lets us obtain a short-lived access token to carry out the uploads you schedule. We use this access solely to deliver the publishing and scheduling features you requested.

How to revoke access, and deletion

You can disconnect a connected account at any time from within OneStudio, which deletes the stored tokens for that account. You can also review and revoke OneStudio's access directly from your Google Account at myaccount.google.com/permissions. When access is revoked or the account is disconnected, we delete the associated tokens and stop accessing your Google data.

Limited Use

OneStudio's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties except as needed to provide or improve this feature (or as required by law), and we do not use it to train generalized artificial intelligence or machine learning models.

4. Storage & Retention

Account data and project content are stored as long as your account exists. Generated assets are kept until you delete them or close your account. Server logs are retained for up to 90 days, analytics events for up to 12 months.

5. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal information, and to object to processing. To exercise any of these, contact us at privacy@onestudio.video.

6. Children

The Service is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has used the Service, contact us and we will remove the account.

7. Security

We use industry-standard practices (TLS in transit, encrypted-at-rest storage, scoped API tokens, audit logging). No system is 100% secure, so please use a strong password and notify us immediately if you suspect unauthorized access.

8. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced via email or an in-product banner before they take effect. Continued use of the Service after the effective date constitutes acceptance.

9. Contact

Questions about this Policy: privacy@onestudio.video · or via our support page.