Privacy at shortshort.

Your account

Supabase manages sign-in and account verification. Email sign-up uses your email address and password. Google sign-in provides your account identifier, email address and basic profile information, such as your name and profile picture. shortshort uses this information to identify your account and associate saved projects with you. It does not request access to your Gmail, Drive or Google contacts.

Account emails, such as the confirmation link and the password reset link, are sent through Resend. Session cookies keep you signed in. Passwords and provider credentials are not included in public project pages.

Your videos and edits

A video file you choose opens on your device first. If you paste a YouTube link instead, our server downloads that video from YouTube, possibly through a network proxy provider, and stores it like an uploaded file; only paste links to videos you have the rights to use. When you generate shorts, the AI analysis runs and the selected provider receives the video, sampled frames, audio or transcript needed for that analysis. shortshort uses Google Gemini and OpenAI services for analysis and transcription. The studio guide explains which inputs each path uses.

Supabase stores uploaded source files, saved shorts, posters, editing plans and analysis progress. Your upload and your drafts stay private until you export. An exported short is published to the community gallery by default, with its full source video and the transcript of the short. Any account can withdraw a published short at any time, and every paid plan adds an account setting that keeps all your shorts out of the gallery. Service providers process the data needed to operate their respective features.

Where the data is stored

Uploaded source videos, rendered shorts, posters, edit plans and account records are stored by Supabase in the European Union, in the eu-central-1 region (Frankfurt). The server that generates and renders shorts for signed-in accounts runs in Europe. The website and its API run on Vercel, with server functions in the Paris region. shortshort is operated from France.

The AI analysis is the exception, and it is worth stating plainly: when you generate shorts, the video, sampled frames, audio or transcript are sent to Google Gemini or OpenAI, which process them on their own infrastructure outside that region. The Google file created for an analysis is deleted once the job finishes. Every generation of shorts in the studio includes this analysis, so do not generate shorts from a recording that may not leave the EU.

Free shorts audit

The free shorts audit at /shorts-audit works without an account. The YouTube link you paste is reduced to its video identifier. shortshort asks YouTube's public oEmbed service for the video's title and channel, then sends the video's public YouTube address to Google Gemini, which reads up to the first 90 minutes of the video from YouTube on Google's infrastructure, outside the European Union. Nothing is downloaded to shortshort's servers. The suggested passages, with the video's title and channel, are stored in Supabase and shown to anyone who opens the result page for that video, so the same video is not analyzed twice. Result pages are not indexed by search engines.

To allow two audits per visitor a day, the website computes a keyed hash of your IP address and the current date (for an IPv6 address, of its /64 prefix) and stores only that hash with a counter. The audit does not store your raw IP address, and the hashes of two different days cannot be linked. Counters older than two days are deleted as new audits come in. Result pages play each passage in YouTube's embedded player in privacy-enhanced mode (youtube-nocookie.com); when you play it, YouTube's own privacy policy applies.

Free vertical captions tool

The free tool at /free/vertical-captions works without an account and runs in your browser. Your video, its sound, the transcribed words and the exported MP4 stay on your device: they are not sent to shortshort or to anyone else.

To run, the page downloads code, models and images from four other hosts, which receive the ordinary details of any web request, such as your IP address and browser: remotion.media (the Whisper transcription model), cdn.jsdelivr.net (the ONNX and MediaPipe runtimes), media.theresanaiforthat.com (the There's An AI For That badge in the footer, shown on every page of the site) and, after each export, www.remotion.pro, which receives a usage record of about 120 bytes from Remotion's renderer (the event, this site's address and whether the export succeeded). Vercel Web Analytics counts page views and the name of each step of the tool (video loaded, transcribed, exported), without the file, its name, its sound or its words.

Community publishing and views

A published short makes its source video, short, transcript and display name available to community visitors. Public pages may be indexed by search engines. Keep sensitive information out of videos you publish.

A short records a view after three seconds of playback. A visitor cookie and a daily server-generated identifier help avoid repeatedly counting the same visitor. View records do not contain your raw IP address or email address. The displayed count is an aggregate.

Connected YouTube and TikTok accounts

Connecting an account is optional, and only needed to schedule shorts on YouTube; publishing to TikTok is in early access and not open to every account yet. If you connect a YouTube channel or a TikTok account on the Publish page, shortshort stores the account's identifier, name, handle and profile picture, and the access tokens that service grants, encrypted with AES-GCM under a key kept outside the database.

For YouTube, shortshort asks to upload videos and to view your YouTube account (the youtube.upload and youtube.readonly scopes). For TikTok, it asks for your basic profile and to post videos (user.info.basic, video.upload and video.publish). The access is used only to show which account is connected and to upload the shorts you schedule, as MP4 files with their title, description, tags and visibility. The title and description of a post can be written by Google Gemini from the short's title, summary and transcript, in the language you choose.

Removing an account on the Publish page deletes its stored access and the posts scheduled for it in shortshort, and asks Google or TikTok to revoke the access; videos already posted stay on YouTube or TikTok until you delete them there. You can also revoke it at any time from your Google account permissions or from the security settings of your TikTok account. shortshort uses YouTube API Services to connect channels and upload the shorts you schedule; by connecting a YouTube channel you agree to the YouTube Terms of Service. shortshort's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google's own handling of data is described in the Google Privacy Policy.

Who receives Google user data

Google user data means what shortshort receives through Google APIs when you connect a YouTube channel: the channel's identifier, name, handle and profile picture, read with the youtube.readonly scope, and the access tokens Google grants. shortshort keeps it until you remove the channel on the Publish page or delete your shortshort account; removing the channel deletes it and asks Google to revoke the tokens. While the channel stays connected, shortshort reads its name, handle and profile picture again from YouTube every 7 days, and erases them if they could not be read again for 30 days. shortshort checks the access at least every 7 days and each time it uploads a short. When it finds that Google no longer accepts the access, for example because you revoked it from your Google account permissions or deleted the channel, the Publish page asks you to reconnect the channel; if you do not reconnect it within 7 days, shortshort deletes the channel's identifier, name, handle, profile picture and tokens, and asks Google to revoke any token left. In any case this happens within 30 days of the revocation. Your record of shorts already posted stays in shortshort without their YouTube video links, and posts still scheduled for that channel are deleted.

shortshort does not sell Google user data, does not use it for advertising, does not use it to train or improve AI models, and does not transfer it to data brokers or information resellers. Staff access is limited to support you ask for, security or abuse investigations, and legal obligations.

Google user data is shared, transferred or disclosed only in these cases:

• To the service providers that store and process it for shortshort, only to operate the service: Supabase (database and file storage, in the European Union, eu-central-1, Frankfurt), Railway (the server that uploads the shorts you schedule to YouTube, in Europe) and Vercel (the website and its API, in the Paris region).
• To Google, when shortshort uploads a short you scheduled to your channel with the youtube.upload scope: the MP4 file with its title, description, tags and visibility.
• When the law requires it.

The title and description that Google Gemini may write for a post use only the short's own title, summary and transcript: no Google user data, neither channel details nor access tokens, is sent to Gemini or to OpenAI.

Managing your information

Use My projects to find saved work and manage its publication. Unpublishing removes the transformation from the community, but cannot remove copies already downloaded by others or immediately clear search-engine caches.

The controller of this information is THE VIBECODING AGENCY, 5 rue de la Moselle, 75019 Paris, France, which publishes shortshort. Its registration details are on the legal notice.

For account deletion, access to your stored information or a privacy question, contact arsene@shortshort.io. Include the email address associated with your shortshort account so the request can be verified.