Privacy Policy

This Privacy Policy explains how IncitingIncident ("we", "us") collects, uses, and shares information when you use our website, web application, and desktop application (together, the "Service"). It should be read alongside our Terms of Service.

Account information. When you register we collect your email address, username, optional display name, and a password. Passwords are stored only as salted bcrypt hashes — we cannot read them.

Your content. The scripts, characters, story documents, storyboards, media files, edits, and other project material you create or upload are stored so we can provide the Service.

Provider API keys. If you connect your own third-party AI provider keys, they are encrypted at rest and used only to make requests you initiate.

Subscription and billing information. We keep records of your plan, trial status, billing cycle, and AI credit balance and transactions. When payments launch they will be handled by a payment processor; we will not store full card numbers ourselves.

Generation records. When you run an AI generation, we store the request payload (such as the prompt and settings) and the result so you can review and reuse your work and so credits can be settled correctly.

Diagnostics. We use Sentry for error reporting. When something breaks, an error report may include technical details such as your browser or OS version, the page involved, and an IP address. We do not run third-party advertising or behavioral analytics trackers.

• to provide, operate, and maintain the Service, including storing and syncing your projects;
• to authenticate you and keep your account secure;
• to run the AI generations you request and meter them against your credits and plan;
• to process subscriptions, trials, and purchases;
• to diagnose and fix errors and improve reliability;
• to communicate with you about your account, such as billing or material changes to terms; and
• to comply with legal obligations.

We do not sell your personal information, and we do not use Your Content to train AI models.

AI features send the relevant parts of your project — for example a scene description you ask to previsualize, or script context for the Aria assistant — to the AI provider that performs the generation. That may be a provider we route to, or one you connected with your own API key. Providers process that data under their own terms and privacy policies, and we encourage you to review them. We send only what is needed to fulfill the request you made.

We share information only with:

• Service providers that help us run the Service — hosting and database infrastructure, error monitoring (Sentry), and, when connected, payment processing — under agreements limiting their use of your data;
• AI providers, as described in Section 4;
• legal authorities, if required by law or to protect the rights, safety, or property of users or the Service; and
• a successor entity in connection with a merger, acquisition, or sale of assets, with notice to you.

We keep your sign-in session in your browser's local storage rather than tracking cookies. The desktop application stores your projects and settings locally on your device. Our pages load fonts from Google Fonts, which may log your IP address when the font files are fetched.

We keep your account information and content for as long as your account exists. If your trial or subscription lapses, your projects remain stored so they are available again when you subscribe. If you delete your account, we delete or de-identify your personal information within a reasonable period, except where we must retain records (for example, transaction records for tax and accounting purposes).

We protect your information with measures including TLS encryption in transit, salted bcrypt password hashing, and encryption at rest for connected provider API keys. No method of transmission or storage is completely secure, so we cannot guarantee absolute security — keep your password unique and notify us of any suspected compromise.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. You can exercise these rights by contacting us at the address below; we will respond within the time required by applicable law. We do not discriminate against you for exercising your rights.

The Service is not directed to children under 13 (or the minimum age of digital consent in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

We may process and store information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for cross-border transfers, such as standard contractual clauses.

We may update this Privacy Policy from time to time. For material changes we will give notice (for example, by email or in-app) before the changes take effect. The "Last updated" date above reflects the current version.

Privacy questions or requests can be sent to info@incitingincident.studio.