Privacy Policy
In effect from 22 September 2026. Every factual claim below was re-checked against the source code
on that date, by listing the application's own routes rather than by searching the source — the routes
this policy promises are the routes the server actually serves. Where the code changes, this document is
wrong until somebody changes it too. The claims most likely to go stale are marked ⚠️.
This is written by the people who built the product, not by a lawyer. It is accurate about what the
software does; it is not legal advice.
Picture Lock is video editing software. You give it footage; it measures the footage, cuts and grades it to
match a measured style, and gives you a finished video.
---
1. What we collect, and why
Your account. Your email address and a password *hash* — we never store the password itself. We store
which plan you are on and what you have been charged. Passwords are hashed with PBKDF2-HMAC-SHA256 and a
per-account salt, and the salt is replaced every time the password changes.
Your footage. The video files you upload, for as long as we need them to do the work you asked for. See
RETENTION.md for exactly how long that is.
What we measure from your footage. Numbers: how often it cuts, how long the shots are, how big the
speaker is in frame, where their eyes sit, the colour statistics, how steady the camera is, how loud it is.
These are measurements, not copies.
Speech. If you ask for captions, we transcribe the speech in your video. ⚠️ **The transcription runs on
our own machines** using a local model (whisper.cpp) — the audio is not sent anywhere for this.
Before you have an account. Two things collect an email from someone who is not a customer, and
saying "we collect your account email" would not have covered either:
- The waiting list. If you reserve a place, we store your email address, the date, your position, a
referral code of your own, the code of whoever referred you, and — only if you type them — a free-text
note about what you want to make and who your audience is. Nothing is sent to you automatically; the
list is exported for a person to write to. Ask us and we will remove you from it.
- The referral programme. If you join it, we store a referral code against your account and a count of
who signed up through your link. ⚠️ **A referrer is never shown the email address of anyone they
referred** — the statement they can see has the addresses stripped out of it before it leaves the server.
How you use the product. Which pages you opened, which styles you chose, whether a render succeeded. We
use this to find out what is broken.
We do not collect your location, your contacts, your browsing outside our product, or anything from a
third-party tracker. There is no advertising network in this product.
---
2. Where your data goes — every third party, named
This is the section most privacy policies are vague about. Here is the complete list, taken from the code.
Google (Gemini / Vertex AI) — receives your video
⚠️ A 360p proxy of your finished video is sent to Google's Gemini API so a model can watch it and tell us
whether it came out badly — dead air, a frozen first second, captions that ran off the frame. This is how we
catch a bad render before you see it.
- What is sent: a downscaled copy of the *finished* video, with its audio — 360 pixels wide, 15
frames a second, and ⚠️ only the first 90 seconds of it, whatever the length of your video.
- What is not sent: your original upload, your email, your account id, or your payment details.
- Why: quality checking. It is the one thing in the pipeline a machine cannot measure from pixels alone.
- Google's terms govern what they do with it. Under the paid Gemini API, Google states that it does not
use submitted content to train its models. ⚠️ **A lawyer should confirm this against the agreement we are
actually on**, and it should be re-checked whenever Google changes those terms.
Text also goes to the same API: the brief you type, generated scripts and narration, and short descriptions
of your video. Not your footage.
Upload-Post — only if you turn on auto-posting
If, and only if, you connect a social account and ask us to post for you, the finished video and its caption
are sent to api.upload-post.com, which delivers it to the platform you chose. If you never turn this on,
nothing is ever sent there.
Nobody else
There is no analytics SDK, no advertising pixel, no session recorder, no CRM sync, no data broker. Fonts are
served from Google Fonts on our web pages, which means Google sees the IP address of anyone loading a page —
the ordinary consequence of a web font, and worth saying rather than hiding.
---
3. What runs on our own machines and never leaves
Stated explicitly because it is unusual and it is the better half of the story:
- All the video editing. Cutting, grading, reframing, stabilising, captions, sound — ffmpeg, locally.
- All the measurement. Cut detection, face detection (YuNet), colour, camera shake, text-on-screen.
- Speech-to-text. whisper.cpp, locally.
- Text-to-speech and voice cloning. Kokoro and the cloning pipeline, locally.
---
4. Your rights, and the buttons that honour them
We do not just say you have these; each one is a route in the product.
| right | how |
|---|---|
| See what we hold | GET /v1/account/export returns your account, plan, balance, settings and every job |
| Delete one video | DELETE /v1/jobs/<id> removes the upload, the working files and the exports |
| Delete your whole account | POST /v1/account/delete — needs your password and a typed confirmation |
| Correct your details | change them in settings, or ask us |
| Get your videos out | every export has a download link; we do not hold them hostage |
⚠️ Account deletion is real deletion, not a hidden flag. Two things deliberately survive it, and we say
so at the moment you delete rather than in the small print: the charge ledger (account id, amount, date —
kept because tax law requires records of what we charged, currently five years in Australia) and the
security audit trail (account id, action, date — kept so a later dispute about access can be answered).
Neither contains your footage, your email or anything you made.
---
5. Security
- Passwords: PBKDF2-HMAC-SHA256, per-account salt, never stored or logged in the clear.
- Sessions and API keys are stored as hashes; the plain token exists only in your browser.
- API keys carry scopes and an expiry, and both are checked on every request.
- A password reset signs you out of every session. ⚠️ It deliberately does not revoke your API keys,
because that would break your integrations without warning — if a key may be compromised, revoke it.
- Reset links work once, expire in an hour, and the request is rate limited per address.
- We never tell an unauthenticated caller whether an email has an account. A "forgot password" form that says
"no account with that email" is a way to test a list of addresses against our customer base.
⚠️ We are a small operation. We do not claim a SOC 2 report or a penetration test we have not had.
---
6. Children
The product is not for under-16s and we do not knowingly hold their data.
---
7. Changes
If this policy changes in a way that affects what happens to your data, we will tell you before it takes
effect, not after.
---
8. Who we are, and how to complain
Picture Lock is operated from Australia and this policy is written to the Australian Privacy Principles.
- Operator:
Dheeraj Mahtani - Privacy contact: privacy@picturelockhq.com
Write to that address for anything in this policy: a copy of what we hold, a correction, a deletion, or a
complaint. We will acknowledge within 5 business days and answer within 30 days, which is the period the
Privacy Act allows.
If we do not resolve it, you can take the complaint to the Office of the Australian Information
Commissioner — oaic.gov.au, 1300 363 992. You do not need our permission to do that, and we would rather say
so here than leave you to find it out.
---
How this policy is kept honest
Everything above describes what the code does, so it can be checked rather than believed. The routes it
promises — GET /v1/account/export, POST /v1/account/delete, DELETE /v1/jobs/<id> — were confirmed on
22 September 2026 by listing the running application's own routes, not by searching the source for them.
⚠️ Three clauses still need a lawyer before they can be relied on, and they are marked ⚠️ where they appear:
whether the Gemini terms we are actually on match what §2 says, the retention periods in RETENTION.md against
Australian record-keeping law, and the limitation of liability in TERMS.md.