Privacy Policy

1. Information We Collect

1.1 Information you provide

• Account information: email address and authentication details when you create an account. If you sign in with Google, we receive your email address, name and Google account identifier from Google; we never see your Google password. If you sign in with Apple in the iOS app, we receive your Apple user identifier and, if you choose to share them, your name and email address — or, if you hide your email, the private relay address Apple creates for you; we never see your Apple password.
• Content you upload: images, start/end frames, and any inputs you submit to generate videos (“User Content”).
• Support communications: messages you send to our support team.

1.2 Information collected automatically

• Device and app data: device type, OS version, app version, language, and basic identifiers.
• Usage data: features used, screens viewed, and interaction events (e.g., taps, generation attempts).
• Diagnostics: crash logs and performance data.
• Abuse-prevention signals: when an account is created we record the request's IP address and network prefix, a hashed browser identifier and a normalised form of the sign-up email. They are used only to detect repeated or automated sign-ups, are kept for 180 days, and are not linked to your generations.
• Push notifications (iOS app): if you allow notifications, Apple's Push Notification service (APNs) issues a device token for the app on your device. We store it on your account and use it only to deliver notifications, such as that a video is ready; it is removed when you delete your account.

1.3 Payment information

Website card payments are processed by Stripe. Purchases in the iOS app are processed by Apple under Apple's terms and privacy policy. We do not receive or store full payment-card details in either case. We do receive purchase-related information — from Apple, the transaction identifier and the product identifier of what you bought; from Stripe, product identifiers, transaction identifiers and subscription status — which we store to credit your account and prevent the same purchase being redeemed twice.

1.4 Cookies

The website uses __Host-twoframe_refresh to keep you signed in. This session cookie is HttpOnly, Secure and SameSite=Lax, expires after 30 days, and is cleared when you sign out. The tf_locale cookie remembers your language preference for up to 365 days from its latest update. It stores automatic or manual mode and, for a manual choice, the language and a guest marker or account identifier so one account’s choice is not applied to another. It is readable by website scripts, uses Secure on HTTPS and SameSite=Lax, and is cleared when you sign out. You can also remove it by clearing cookies in your browser; this does not delete the language preference saved in your account. We do not use advertising cookies; analytics cookies are set only as described in section 1.5.

1.5 Analytics

The website uses Google Analytics to see how it is used — which pages are visited, from which country and on what kind of device — with IP addresses anonymised. It runs only after you allow it in the cookie banner; until then it sets no cookies and stores no identifier, and choosing “Necessary only” keeps it off. You can change your choice at any time under Cookie settings in the footer of every page.

2. How We Use Information

We use information to:

• Provide and operate the Service (including video generation).
• Maintain account security and prevent fraud/abuse.
• Improve performance, reliability, and user experience.
• Provide customer support.
• Comply with legal obligations.

3. How We Share Information

We may share information with:

• Our hosting provider, OVH, which runs the servers and database the Service uses.
• Google or Apple, when you choose to sign in with Google or with Apple (see 1.1).
• Resend, which delivers the transactional emails we send you (verification, password reset and account notices).
• Backblaze, which holds encrypted backup copies of our database and of uploaded frames and generated videos (see section 5 for how long).
• Payment processors — Apple for in-app purchases and Stripe for card payments on the website — which handle billing on our behalf.
• Kling AI, which generates the video from the two frames you upload — the frames are sent to Kling's API, operated outside the European Economic Area — and Bunny.net, which stores and delivers the generated video.
• OpenAI, only when you use Ask AI on the Create page to get a suggested camera move. The two frames you chose, reduced to at most 1024 pixels on their long side, and the name of your interface language are sent to OpenAI's API, which describes what the photographs show; the suggested move is then worked out on our side. Nothing that identifies your account — no email address, name or identifier — is sent, and under OpenAI's API terms the images are not used to train its models.
• Sentry, which receives crash and error diagnostics from the website so we can find and fix faults. Reports are stripped of request bodies, cookies, IP addresses and any token contained in a link before they leave your browser, and never include your User Content.
• Legal and safety authorities if required by law or to protect rights, safety, and integrity of the Service.
• Business transfers in connection with a merger, acquisition, or sale of assets (with appropriate safeguards).

We do not sell your personal information.

4. User Content and AI Processing

• Your User Content is used to generate the outputs you request.
• We may temporarily store content to provide the Service, troubleshoot issues, and prevent abuse.
• We do not use your User Content to train generalized AI models.
• Uploaded frames and generated videos are stored at an unlisted, public web address — anyone with the exact link can view them, though it is never published or indexed — and are removed from storage within 24 hours of you deleting the video or your account. Encrypted backup copies can persist for up to about six months after that (see section 5) and are not reachable from any link.

5. Data Retention

We retain information only as long as necessary to provide the Service and for legitimate business purposes (e.g., security, compliance, dispute resolution). You may request deletion as described below.

• Uploaded frames and generated videos: until you delete the video or your account, then removed from storage within 24 hours.
• Backups: encrypted database and media backups are stored off-site under a 90-day write-protection (they cannot be altered or deleted earlier), and older copies are removed by lifecycle rules within about six months of being written. A local copy of the database is additionally kept for 14 days. Deleted content can therefore persist in a backup for up to about six months.
• Abuse-prevention signals (section 1.2): 180 days from sign-up.
• Purchase records: for as long as required by tax and accounting law after your account is closed.

6. Your Choices and Rights

Depending on your location, you may have rights to access, correct, or delete your information, and to object to or restrict certain processing.

You can delete your account yourself at any time from the Settings page in the app; this removes your account, frames and videos as described in section 5.

For any other request, or to delete your data without signing in, contact: support@twoframe.ai

7. Security

We use reasonable administrative, technical, and organizational measures to protect your information. No method of transmission or storage is 100% secure.

8. Children

The Service is not directed to persons under 18, and the Terms of Service require every account holder to be at least 18. We do not knowingly collect personal information from anyone under 18; if we learn that we have, we delete it.

9. International Data Transfers

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards for such transfers.

10. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version in the app and update the Effective date.

11. Contact Us

Email: support@twoframe.ai. Use the same address to report content on TwoFrame that you believe infringes your rights (see “Reporting content” in the Terms of Service).