Privacy Policy

1. What we collect

• Account data — your email, optional name, and a salted password hash (email sign-up) or your Google account's ID and email (Google sign-in). We never see your Google password. Signing up with an email address sends a one-time code to it, through Cloudflare, before the account exists. An unfinished sign-up is deleted once it is more than a day old, by the next sign-up or the next restart of our service.
• Content — prompts, storyboards, cast descriptions, media you upload, and media generated for you.
• Billing records — your credit balance and ledger (purchases, charges, refunds). For the First film pack we also keep three things Stripe reports about the card used: its fingerprint, a code that shows whether two payments used the same card but cannot be used to pay; its brand; and the wallet it was paid through, if any. Card details go directly to Stripe; we never receive or store them.
• Operational logs — standard server logs and storage event notifications used to run the service.

We use no advertising trackers and no third-party analytics. The only things we store in your browser are a session token (strictly necessary for sign-in), which announcements you have closed, the editor settings you choose (one-click mode, panel widths), a cookie used while you connect an AI app to your account (gone within ten minutes), and — while an email sign-up waits for its code — the address the code went to and when it was sent, kept in that tab only, until you sign in there or close the tab, and no longer used after a day. On the sign-in page, Google's sign-in button also sets a cookie of its own (g_state), which Google uses to remember the state of its sign-in prompt.

2. Media is stored at public URLs

This matters, so we say it plainly: generated media, uploaded media, and provenance manifests are stored as objects on Backblaze B2 and served through a CDN at durable, unlisted, but publicly accessible URLs. Anyone who has a link can open it — that is what makes films shareable and verifiable by third parties. Don't upload material that must remain confidential. Deleting an upload, scene, or project deletes its objects from storage.

3. Who processes your data

To generate content, your prompts and any reference media are sent to the AI providers a given run uses: OpenAI (script, images, voices, subtitle timing), Google (script, images, music, video), ByteDance's Volcano Engine (Volcengine Ark, servers in Beijing, China: keyframes, video clips with speech, images, a fallback script model), Alibaba Cloud (video, voices), and Replicate as a marketplace for further models (ByteDance Seedance, Kuaishou Kling, Black Forest Labs FLUX, MiniMax). These providers may process your data outside your country, including in the United States and China. Infrastructure: Railway (hosting), Backblaze (storage), Cloudflare (CDN, sign-up emails), Stripe (payments), Google (sign-in). Each processes data under its own terms. We don't sell your data to anyone.

4. Retention and deletion

Content stays until you delete it (per project, scene, upload, or via account deletion). To delete your account and everything in it, email us from the account address — we'll remove your account data, content, and stored objects, keeping only what payment law requires (Stripe transaction records).

5. Your rights

Depending on where you live (GDPR, CCPA, and similar), you may have rights to access, correct, export, or delete your personal data, and to object to processing. Write to markqiu@luqlabs.com and we'll handle it. The service is not directed at children under 13 and we don't knowingly collect their data.

6. Changes

We'll post any changes here with a new effective date. See also the Terms of Service and Refund Policy.