This page describes, plainly, how ClipAI protects your account and the videos you give us. It is meant for creators and for anyone reviewing ClipAI for a team or a company. For what we collect and why, read the Privacy Policy.
Report a vulnerability
Email hello@clipai.online with the steps to reproduce, the part of ClipAI affected (website, iOS app, API or MCP server) and what an attacker could do with it. Please do not post it publicly first. We will confirm we received it and tell you when we expect to fix it. We do not run a paid bug bounty.
Where ClipAI runs
- Vercel hosts the website and its API.
- Fly.io runs video processing: transcription, clip detection, rendering and captions.
- Supabase hosts the PostgreSQL database. It is backed up daily, and each backup is kept for 7 days.
- Tigris stores uploaded videos and rendered clips.
- Upstash provides the queue, cache and rate limits.
These providers are mainly in the United States. Every other company that receives your data, and what each one receives, is listed under Third-Party Processors in the Privacy Policy.
Your account
- You sign in with Google, Apple, or an email and password. Passwords are stored only as bcrypt hashes.
- The site is served over HTTPS only (HSTS), with a Content Security Policy, and it cannot be framed by other sites.
- Sign-in attempts, uploads and other sensitive actions are rate limited.
- Card details are handled by Stripe (web) or Apple (iOS) and never reach our servers.
Connected social accounts
When you connect TikTok, Instagram, YouTube or another platform, we store its access and refresh tokens encrypted with AES-256-GCM. The encryption key is kept in our server configuration, not in the database or the code. The tokens are used only to publish what you schedule and to read the public numbers of posts you published through ClipAI. Disconnecting an account deletes its tokens straight away.
API keys and agents
API keys for the ClipAI API and MCP server are shown once when you create them; we store only a SHA-256 hash. A key cannot delete your account, disconnect social accounts or change campaign spend: those need you signed in to the website. A key can schedule and publish clips, so treat it like a password and revoke it in Settings if it leaks.
Your videos and AI
- We do not use your videos, transcripts or clips to train AI models.
- To do the work you ask for, transcripts and video frames go to our AI providers (Groq for transcription, Anthropic for scoring and titles) and, only when you turn on dubbing, to ElevenLabs.
- Links you share (clip packs and tracked links) are unlisted, not secret: anyone with the link can open it. You can revoke a clip pack from Clips, under Packs; its page then says it is no longer available and its downloads stop working.
Delete or export your data
- Delete a single video, with its clips and files, from your library at any time.
- Delete your whole account in Settings on clipai.online or in the iOS app. This also deletes the records our analytics, support and in-app purchase providers hold about you. See Data Deletion for exactly what is removed and what billing law makes us keep.
- Download a copy of your data as a JSON file from Settings first, with Download my data.
How we build it
- Secrets live in our hosting providers’ environment settings, never in the code repository.
- Every pull request runs automated checks: secret scanning (TruffleHog and Gitleaks), static analysis (Semgrep) and dependency audits for the web and processing code.
- Error reports are scrubbed of passwords, tokens, keys and cookies before they are sent to Sentry.
What we do not have
ClipAI is a small company. We do not hold a SOC 2 report or an ISO 27001 certification. If your team needs a security questionnaire answered, email hello@clipai.online and we will answer it honestly.