K kutmo

legal · privacy

Privacy Policy

Last updated: 2026-07-23

This policy explains what data Kutmo collects, why, where it's stored, and what rights you have over it. Kutmo is operated by CryptSky LLC, a Delaware limited liability company ("Kutmo", "we", "us").

The TL;DR

  • We don't see your videos. All analysis runs in your browser. Source video files never leave your device.
  • We use Supabase to handle sign-in with your Google or Microsoft account. It stores your email, your name (if you grant it), and which sign-in provider you used.
  • We use Stripe for Pro billing. Stripe stores your payment information; we don't. Kutmo is the seller and merchant of record.
  • We use Vercel to host the site. Vercel collects standard request logs (IP, user agent, timestamp) for serving traffic.
  • We use Mailgun to send account emails (a welcome email and a Pro upgrade confirmation). Every non-essential email has an unsubscribe link.
  • We use Sentry for crash reports when the app hits an error. It's set up to collect no personal data — no IP address, no identity, no session recording.
  • We don't run advertising or behavioral-analytics trackers, or fingerprinting.

1. Data we collect

From you, when you sign in:

  • Email address
  • Display name (only if your OAuth provider releases it)
  • Which sign-in provider you used (Google or Microsoft) and the account ID it issues

From you, when you subscribe to Pro:

  • Subscription status (active / cancelled / past-due) — issued by Stripe, stored against your account
  • Billing country (for tax purposes) — handled by Stripe, not stored on our servers

Automatically, when you load the site:

  • Standard server logs (IP address, user agent, request path, timestamp) collected by our hosting provider Vercel for traffic and abuse-prevention purposes. Logs are retained per Vercel's defaults.
  • Email delivery events (delivered, bounced, complained, unsubscribed) from Mailgun for the account emails we send, so we can stop emailing addresses that bounce or opt out.
  • Crash reports, only when the app hits an error, sent to our error-monitoring provider Sentry: the error message and stack trace, your browser and operating system version, and the page URL. Sentry is configured not to collect your IP address, your identity, or a recording of your session, and sets no cookies.

What we do not collect:

  • Your video files. They are processed entirely in your browser. There is nowhere to upload them — our servers cannot receive video.
  • Detected cuts, segment lists, or exported XML/MP4. These never leave your machine unless you choose to download them.
  • Browsing analytics, fingerprints, advertising IDs, or third-party trackers.

2. Why we collect it

  • Sign-in — to associate your subscription with your account so Pro entitlement follows you across browsers.
  • Subscription record — to know whether to grant Pro features.
  • Server logs — to keep the site running, debug errors, and detect abuse.
  • Email address — to send the account emails described below and to respond to support requests.

3. Emails we send

We send a small number of account emails through Mailgun, our email delivery provider: a welcome email when you create an account, and a confirmation when you upgrade to Pro. We do not send marketing newsletters. Non-essential emails include a one-click unsubscribe link.

Mailgun processes delivery events (delivered, bounced, complained, unsubscribed) so we stop emailing addresses that bounce or opt out. These events contain your email address and message metadata, not message-independent tracking of you.

4. Lawful basis (GDPR)

For users in the EEA, UK, and Switzerland: we process the data above under the lawful basis of contract (to provide the Service you requested) and legitimate interest (to operate the site and prevent abuse). We do not process special-category data and do not rely on consent except for any optional cookies described below.

5. Cookies and local storage

We use a small set of strictly-necessary cookies and local-storage entries:

  • Sign-in session — keeps you signed in between visits. Stored in your browser.
  • Sign-in security token — single-use, protects the sign-in step against forgery, cleared once you're signed in.
  • Detection runs — your detection results, settings, and project queue are saved by your browser on your device so you can resume work. We never receive this data. Clearing your browser's site data removes it.

We do not use analytics or advertising cookies. No third-party trackers are loaded.

6. Sharing

We share data only with these processors, each contractually bound to confidentiality and data-protection obligations:

  • Supabase — sign-in, account record. Privacy: supabase.com/privacy.
  • Stripe, Inc. — Pro billing, payment processing, tax calculation, receipts. Stripe acts as a data processor for payment data. Privacy: stripe.com/privacy.
  • Vercel — site hosting and edge delivery. Privacy: vercel.com/legal/privacy-policy.
  • Mailgun (Sinch) — delivery of account emails and processing of bounce/complaint/unsubscribe events. Privacy: mailgun.com/legal/privacy-policy.
  • Sentry (Functional Software, Inc.) — crash reporting and error monitoring, configured to exclude personal data. Privacy: sentry.io/privacy.

We may also disclose personal data if required by law or valid legal process, or to protect the rights, safety, or property of Kutmo or others. We do not sell or rent your data. We do not share it for advertising or marketing.

7. International transfers

Our processors operate in the United States and the European Union. Where data is transferred outside your region, the processors rely on Standard Contractual Clauses or equivalent safeguards. See each processor's privacy policy for specifics.

8. Retention

  • Account record — for as long as your account exists. Deleted within 30 days of account-deletion request.
  • Subscription history — retained for 7 years for tax and accounting compliance.
  • Server logs — per Vercel defaults (typically 30 days).
  • Email delivery events — suppression entries (bounces, unsubscribes) are kept for as long as needed to honor the opt-out; other delivery events per Mailgun's defaults.

9. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to processing. To exercise any right, email support@kutmo.com. We will respond within 30 days.

EEA, UK, and Swiss users have the right to lodge a complaint with their local data protection authority. California users have rights under the CCPA/CPRA, including a right to know, delete, and opt out of "sale" or "sharing" — Kutmo does not sell or share personal data for cross-context behavioral advertising.

10. Security

Everything sent between your browser and our services is encrypted in transit. Sign-in is handled by Supabase using industry-standard safeguards. Payment information is handled exclusively by Stripe; we never receive card numbers.

11. Children

Kutmo is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has signed up, contact us at support@kutmo.com and we will delete the account.

12. Changes

Material changes to this policy will be announced on this page with an updated "Last updated" date, and where required, by email. Continued use after the effective date constitutes acceptance.

13. Contact

Privacy questions or data-rights requests: support@kutmo.com. Postal address in the Terms of Service.

14. Data controller

The data controller for personal data described in this policy is CryptSky LLC, a limited liability company organized under the laws of the State of Delaware, United States (Delaware File No. 6906810), formed May 29, 2018. Contact: support@kutmo.com; postal address in the Terms of Service.