T6FV Privacy Policy

THE 6-FIGURE VIDEOGRAPHER LTD. Mississauga, Ontario, Canada

Last Updated: November 5, 2026

Effective: November 5, 2026. The previous version is available on request (Section 12).

This Privacy Policy explains what personal information THE 6-FIGURE VIDEOGRAPHER LTD. ("T6FV", "we", "us") collects through the T6FV ecosystem — the T6FV / T6FV.io video production planning app for iOS, Android, macOS, and Windows, the t6fv.io website and hosted share pages, and the community features inside the app (together, the "Services") — how we use it, who we share it with, and the rights you have. It forms part of our Terms of Use.

The short version: the app is built local-first. Your field audio, your device's own position and your AI conversations stay on your device on every plan, and so does your footage, unless you back it up or upload it to your T6FV Cloud Drive (a backup sends full-resolution takes only where you, or someone you let change a binder's settings, choose to, for each binder and, if you like, each production) or host it on a client link or your Portfolio. Where your plan includes a cloud library, a small still of each file you send to your T6FV Cloud Drive from the File Manager travels with it, so that your other devices can show the file (Section 3). From version 2.0.10, the in-app cameras keep what they shoot in the app and copy it to your device's photo library only if you turn that on; the Directors Viewfinder copies its pictures there unless you turn its own switch off (Section 2). Your mail stays on your device unless you file a message into a binder, which saves it whole, with its attachments, as part of that binder for your own devices — never for the people you share the binder with, though a picture among its attachments can appear on a client link (Section 3A). The password or sign-in that opens your mailbox never reaches us. On a plan without a cloud library, your projects, clients, finances and contacts stay on your device unless you back them up to your T6FV Cloud Drive. There are several ways you can send your work to an AI company from inside the app, and only you can open them. On every device except the web, an AI button can copy a prompt to your clipboard and open an AI website you choose, for you to paste and send. On a Mac or a Windows PC you can also connect an AI app you have installed, such as Claude, Cursor or Codex, so that it can read and change the work you choose. You can also chat in the app on an API key of your own from Anthropic, OpenAI or Google, or with a model server you run, at an address you give the app, and let the app's AI buttons work in T6FV through either. What that AI reads goes from your computer to the company behind the app or the key, under your agreement with that company, or to that server's address, and never through us. We cannot see or control what happens to it there (Section 5). Voice-overs the app makes in an AI voice are made on your device, and if you record your own voice for them, it never leaves that device (Section 5). Apart from what you back up or upload to your T6FV Cloud Drive, with its small still, or host on a client link or your Portfolio, the one exception for your footage, photos and field recordings is small editing copies — low-resolution proxies of your video and previews of your photos and recorded sound — that you choose to share for a production through your T6FV Cloud Drive, so your other devices can keep editing. When you join somebody's recording session from the app, though, what your device records for it goes over the local network straight to that session's main device — which may be theirs rather than yours — and never passes through us. While it is joined, it also sends that device how loud its microphone is. If it joined as a microphone and that device asks for it, it sends the sound itself as it is spoken, so that device can listen to it, record it and use it in a live show. A guest who records for a session from a recording link in a web browser is the exception: what they record is encrypted in their browser, with a key we never receive, and waits in our storage until the host's device collects it. A guest who joins a live show from a link in a web browser, which released versions of the app do not offer yet (Section 3), is not an exception: their camera and microphone go straight from their browser to the host's and never pass through us; we only pass along the first handshake, sealed so that we cannot read it. The pictures and video you put on the screens of a Virtual Studio show go over your Wi-Fi from your device to the screens that join it, and never to us. We only receive what you deliberately send to a cloud feature — your account details, your subscription status, content you choose to publish or share, files you put on T6FV Cloud Drive, and, where your plan includes one, the cloud library described in Section 3. If you join a company's workspace on T6FV, the binders in your account become the company's: its Owner and its Admin seats can open them, the company is paid the card payments on your invoices and its Owner sees their figures, and when your seat ends the binders stay with the company and the app clears your account from the devices that held the seat (Section 3, "Company workspaces"). If you log time on a task, the hours you record are seen by you, by the people who can edit the binder's brief, and, as a total for that task, by the others assigned to it; the app records time only when someone starts a timer or enters it, never by watching what you do. Note that a saved location, like a scouted site, is a planning record rather than a position: it travels with the rest of them. Two questions about a place you have saved are answered by our servers, and neither is kept: which time zone it is in, so that its sun times are the place's own, for which the app sends its coordinates rounded to about a kilometer; and, when someone opens a client link you have published, the forecast for its shoot days in the next ten days, for which the page sends each day's date and place rounded to about eleven kilometers, and our servers ask Apple Weather. The settings of a mailbox you connect travel with them too — its address, server details and any signature you add, never its password and never your mail — to your own devices only, so that each of them can list it. So do your app preferences — your favorite tools, your notification and backup choices, your theme and language, your desk background, and the brushes you save in the Graphics Editor — again to your own devices only, so that each of them is set up the way you left the last. So does what you record about the hard drives you add — each drive's name, notes, tags and photo, the folders on it you have linked to your productions, what identifies the volume, and a summary of its last scan that includes the names of the folders at the top of the drive, often a client's or a job's name — again to your own devices only, so that a drive you plug into another of them is recognized rather than added twice; the files on a drive, and the access the app holds to open one, never travel, though the record of a clip that plays from a file on one of your drives notes where that file is, and goes where the clip's record goes (Section 3). So, unless you switch it off for a drive, does the listing of each drive's last scan — the name, size and date of every folder and file the scan reached, which can name clients, jobs and people, and the name of the device that scanned it — so that your other devices can search and browse a drive that is not plugged in; the files themselves still never travel. We run no analytics, no advertising and no tracking of our own (two Google components the app uses send Google metrics about how they perform, Section 4), we run no AI service of our own that receives your content, and we never sell your personal information or use your content to train AI models.

1. Who We Are and How to Reach Us

The organization responsible for your personal information is:

THE 6-FIGURE VIDEOGRAPHER LTD. Mississauga, Ontario, Canada Privacy Officer: info@t6fv.com

Contact our Privacy Officer for any question, access request, correction request, complaint, or concern under this policy.

2. What Stays on Your Device (Most Things)

The app stores your working data locally, in the app's own storage on your device. We do not automatically sync, upload, mirror, or back up this data, and we cannot see or recover it — with two exceptions. The first is described in Section 3 under "Cloud library": some subscription plans include one, and while you hold such a plan your planning records — and the pictures, audio and files kept with them — are copied to our servers so your own devices can read the same work, and, on a plan that also includes sharing, so that people you invite to a binder can read the parts of it you grant them. The second is your T6FV Cloud Drive: a backup there that you start or schedule, which copies what Section 3 describes under "T6FV Cloud Drive" — your renders and paperwork, filed emails, a sealed copy of your whole library, and your footage at full resolution only if you choose to include it — and a file you send there yourself from the File Manager, with Save and upload when you add it or Back up to T6FV Cloud Drive on it or its folder, which also sends a small still of it with your library (Section 3). Locally stored data includes:

Your device's own backups. Your device's backup — iCloud, a backup to your computer, Time Machine — copies the app's data, including its database, your mail cache and its automatic backups, under your own account with Apple or your computer's settings; that backup belongs to you, not to us. On an iPhone, iPad or Mac, Keep T6FV data out of device backups, in the app's settings, keeps them out of it; it is off unless you turn it on, or your company's policy requires it. Your own voice (Section 5) is always kept out of them, whatever that setting says. On Android the app's data is never included in a device backup. Passwords and keys the app keeps in your device's secure storage — your mailbox sign-ins, your AI keys, your stream keys and the keys of Studio Link and your local-network sessions — stay on that device and are not carried by a device backup, except the passwords you set for backups on your hard drives, which a restored device carries so that it can still open them.

Device permissions (camera, microphone, photo library, contacts, location, calendar, Bluetooth, local network, speech recognition, notifications) are each requested only for the feature that needs them, with an explanation shown at the time. The app also includes a Permissions overview in Settings describing what each permission is used for. Local network features (teleprompter remotes, on-air signs, Studio Link on your Wi-Fi, lighting control, recording sessions, Virtual Studio screens) communicate between devices on the network you are on — your own, or those of the people you are working with, such as the other devices in a recording session — and do not route through our servers.

Local data is protected by your operating system — the app sandbox on iOS, Android and macOS (Windows desktop apps are not sandboxed) — and by the device protections you enable, such as a passcode and device encryption. The app shows whether your device has them, under Device security in its settings, without sending the answer anywhere, but it does not require them unless your company's policy does (Section 3, "Company workspaces"). Unless you turn on protected mode, the app's local database is not encrypted by the app. Protected mode, under Settings › Storage on an iPhone, an iPad, an Android device or a Mac (not on Windows yet, and not in a web browser), is off unless you turn it on, and each device has its own switch; a company's policy can require it, and then keeps the company's binders closed on a device until it is on (Section 3). It encrypts the app's library database, its automatic backups, the mail it keeps on the device and your drives' listings, using the encryption built into the device's own system, with a key made on that device that never leaves it: the key is not synced, not sent to us and not carried by a device backup. That is its cost. A backup of the device restored onto another one cannot open what protected mode encrypted, and neither can the device itself if it loses the key; the app then asks you before it sets the encrypted library aside, and a library your plan keeps in the cloud downloads again, but anything kept only on that device is lost. Automatic backups the app copies to your own iCloud Drive, Google Drive or hard drive while protected mode is on stay encrypted with that key, so they open only on that device, and nowhere once you turn it off; those it sends to your T6FV Cloud Drive are sealed to your account instead (Section 3). Backups encrypted with a key the device no longer has are kept until the backup schedule ages them out. Protected mode does not encrypt your recordings, footage, renders or binder files, and it does not stop someone using the device while it is unlocked. Protect screens with client content, also under Settings › Storage on an iPhone, an iPad, an Android device, a Mac or a Windows PC, is likewise off unless you turn it on for that device: while a deliverable's cut or photos, or a file in the app's viewer or media player (not a document open in its Maker, a pasted link's cut in your browser or a picture-in-picture window), is on screen, an Android device blocks screenshots and screen recordings of it; a Windows PC leaves the window's picture, though not its sound, out of screenshots, recordings and screen sharing; a Mac asks the system to do the same, a request that recording and sharing apps on recent versions of macOS may not honor, and its sound is never left out; and an iPhone or iPad, which cannot refuse a screenshot, hides it while the screen is recorded or mirrored and tells you when a screenshot was taken. On a Mac or a Windows PC, a display connected to it still shows it, and on any device a camera pointed at the screen does. The setting and that notice stay on the device and are sent to nobody. A .t6fv_vault file is protected according to how it was made: one you lock with a password is encrypted so that only someone with the password can open it; one made while you are signed in, without a password, is sealed with a key held for your account, which we hold too (Section 8); and one you save without a lock — offered when you export everything, and for a binder you share without a password — is not encrypted, so anyone with the file can open it. Older versions of the app also wrote vault files with a key built into the app; those are not private either, because anyone with the app can open them. Please use your device's security features, and see Section 8 for how Studio Link differs (it uses genuine end-to-end encryption).

Signing out. Signing out removes nothing from the device unless you choose to: signing out of the account you are using asks whether to keep your library on the device or remove it. A library you keep there is locked: until that same account signs in again, nothing of it shows or runs in the app, and the lock screen offers only to sign in, to use another account, or to remove it from the device — and, if that account has since been deleted, to keep the library with no account (never for a library that held a company seat). The lock hides the library in the app; it does not encrypt it on the device — that is what your device's own encryption, and protected mode where you turn it on, are for. Signing out also clears the sign-ins, cookies and website data of the web pages the app opens inside itself, except on Windows and the web.

3. What We Collect (Only When You Use Cloud Features)

We collect personal information only when you create an account or use a feature that is cloud-connected by design:

Account information. Email address (verified at sign-up), password (held by our authentication provider in hashed form — we never see or store it), unique username, display name, and your interface language (so account emails arrive in your language). Your subscription tier and a subscription event audit trail (event type, entitlement identifiers, timestamps) are recorded against your account.

Purchases. Subscriptions bought inside the mobile app are billed by Apple or Google. Subscriptions started on our website are billed through our billing partner's hosted checkout. In neither case do we receive or store your payment card details. Our subscription platform (RevenueCat) processes purchase and entitlement records linked to your account identifier so your subscription works across your devices. For a web purchase we also hold the billing records we need to answer refund and tax questions about that sale.

Agency plan invoices. The Agency plan is not sold through a store or our web checkout; we invoice the company for it. We email each invoice to the company's Owner as a link to a page that shows it. Where the page offers it, the invoice can be paid there by card through Stripe, into our own Stripe account; otherwise it can be paid by the means the invoice states. Card details are entered on Stripe's page and never reach us. For each card payment, refund or dispute, we hold the identifiers Stripe assigns, the amount and currency, the time, and the payer's name and email address if Stripe collected them at checkout. If someone uses the page to tell us they have paid by other means, we hold what they enter there — a name, an amount and a reference — until we have matched it to the money. Because the invoice is ours, we keep the key to its page with the invoice, so that the Owner can open it again from the app. We keep the invoices and their payment records for as long as tax law requires (Section 9).

Payments you take from your clients. If you connect a Stripe account to the app (available on some plans), your clients' card payments are processed by Stripe on your own Stripe account under Stripe's terms and privacy policy; T6FV is not a party to those payments, holds none of the money, and never receives card numbers — your clients enter them on Stripe's own payment page. So that the app can record a payment on the right invoice, we hold the connection record (your Stripe account identifier, its capability flags, country and settlement currency, and the public business name on the Stripe account) and, for each payment, refund or dispute, the identifiers Stripe assigns, the amount and currency, the invoice and link it was for, the time, and the payer's name and email address if Stripe collected them at checkout. A record that a payment event was processed is kept for idempotency (so a repeated notification is never recorded twice) and contains no card data. So that a payer can see whom the card money goes to, a client link with a card button shows that business name and the account's country to anyone who opens it; for a sole trader the business name may be your own name. Your clients' own details entered at Stripe's checkout are Stripe's to protect under their policy, and yours under Section 3A. In a company's workspace this is different: while you hold a seat there, your clients' card payments on your invoices are processed on the company's Stripe account rather than yours (Section 3, "Company workspaces").

Content you publish. Forum posts and replies, Connect listings (which may include a location and a rate you choose to state), your Directory profile, your public Portfolio page (tagline, bio, images, demo video links, rates, social links), a downloadable contact card if you publish one (name, organization, job title, phone number, email — published contact cards are downloadable by anyone who views your public page), Blueprints you upload to the community library (packaged project templates plus preview screenshots, associated with your account), and testimonials.

Messages to you through your Portfolio. If someone contacts you through your public Portfolio page, we hold their message (their name, email, phone number, and message text) so we can show it to you in your inbox.

Portfolio video you upload. If you upload a video to your Portfolio rather than pasting a link to one, we host that file so your public page can play it, and we hold it until you replace or delete it or delete your account, or, once your account no longer has storage, for the period Section 9 describes. A reel you replace can stay for up to about nine days before our weekly clean-up deletes it, and one replaced between October 18 and October 20, 2026 stays until you delete it in your Videos tab; a reel at an address from before version 2.0.10 is kept as Section 9 describes. A hosted video is served to whoever views the page.

Videos you embed on other websites. If your plan includes it, you can let a review cut or presentation film you host with us play inside other websites: any website that carries its embed code, the choice an embed starts with, or only the websites you name, such as your company's intranet. Opening Embed on a video that has never been embedded turns it on, for any website, so that its code is there to copy. We hold the websites you name, if you name any, and how many times each embedded video started in each month; we keep those counts for about 13 months, and they never say who played it. When a visitor to a website that carries the embed code comes to the video, their browser loads our player from our servers, and the video once they press play, so our servers see their IP address and browser, as any website they visit does: these sit in our server logs for thirty days. When a play is counted, the IP address is also held in the memory of the server that counted it so that a replay from that address within 10 minutes is not counted twice — it is never stored, and is forgotten when that server stops, or sooner as newer plays take its place. Cloudflare, which stores and delivers the video's pieces, sees the IP address that fetches each piece. The player sets no cookies, stores nothing in the visitor's browser and loads nothing from anyone but us. The websites you list can be read in the player's response by anyone who opens it. An embed that may play on any website names no website there, and plays wherever its code is pasted, including on websites you do not know of.

Push notifications. If you allow notifications, your device is issued a push token by Apple or Google, and we store it against your account so we can send the notification. Tokens are device identifiers for delivery, not tracking identifiers: we do not use them to profile you, and turning notifications off at the operating system level stops them. The content of a notification is generated for something you asked for — an invitation, a moderation notice, an inbox message. We hand each one to Google's Firebase Cloud Messaging, which delivers it and, for an Apple device, passes it to Apple's push notification service (APNs) to deliver; both see the token and the notification's title, which can name the client, person or file it is about. Section 6 lists them.

Team features. If you invite someone to a shared binder, we process the invitee's email address to deliver and gate the invitation, and team activity logs record who did what in the shared binder. The same is true of a company on the Agency plan and of an institution granting Educational access: an administrator adds people by email address, so we hold that address, and the seat or grant it is for, before the person has an account — and we email it to tell them access is waiting. If you are on that list and did not expect to be, the administrator who added you is the person who put it there; you can also ask us at the address in Section 1 to remove it. Where you hold a seat in a company, the company's Owner can see that your account holds it and what kind of seat it is, and the storage allowance may be pooled across the company. Holding a seat does not by itself give the company access to your projects. When a seat is removed from a company, its places on the binders the company's other people shared with it may end at the same moment, each of those binders' owners being told, and edits not yet sent to those binders are then lost; in a company's workspace they always do (below). Joining the company's workspace does, and only after you have agreed to it on a screen that says so, as "Company workspaces" below describes.

Feedback reports. If you choose to submit a feedback report about an AI feature, we receive the feature name, your notes, and basic device diagnostics (device model, OS version, app version, AI model used, token counts), together with your account's name, username and email address, so that we can follow up. The report includes your prompt and the AI's reply only if you tick the box to include them. Reports are visible only to administrators.

Feedback from AI apps you connect. An AI app you connect, or the chat on your own API key, can write feedback about using T6FV. It waits on your device, in the Agent feedback inbox, and nothing is sent until you tap Send. You can edit it or discard it first. If you send it, we receive: a label naming the T6FV tool it is about, or, if none, the name of the connection; the AI's message and any suggestion it made; what the AI says it was doing, only if you tick the box to include it, because that can quote your work; and the category, severity and tool name the AI gave it. We do not receive your device's model or operating system, or any token count. Before an item is stored, and again after you edit it, the app replaces text shaped like an API key, a T6FV connection key or a sign-in header with "[redacted]". It cannot recognize every secret, so read an item before you send it. As with the reports above, we receive it with your account's name, username and email address, and it is visible only to administrators.

Content reports. If you report a post, a profile or an AI answer, we receive the category you chose, any note you added, what you were looking at when you reported it, and which account it belongs to — together with your account name and email address, so a moderator can follow up. The person you reported is not told who reported them. What you saw is included so that a moderator can act on it even if it is edited or deleted afterwards, which means a report can contain another person's words. Reports are visible only to administrators, and we aim to look at every one within 24 hours.

Blocking. If you block someone, we store their account identifier and the time, under your account. It is not shared with them and it is not visible to anyone else.

Bug reports. If you send a bug report from inside the app, we receive what you typed, the area of the app you were in, basic device diagnostics (device model, OS version, app version), whether the app had ended abnormally, and — where the app caught one — the error and its stack trace together with a short trail of the actions immediately before it. That trail is a record of what you did, not of what your projects contain, but it can include names you have given things. Bug reports are sent only when you submit one; nothing is transmitted automatically. Reports are visible only to administrators.

Referrals. If you reach us through a referral link or QR code from someone in our affiliate programme, we record that your account arrived through that referral so the referrer can be credited. The commission ledger itself is kept without your identity: it holds the referral, the amounts and the rates, and not your name, email or account identifier.

Quota accounting. For metered features we keep counters: monthly Blueprint unlock counts, per-Blueprint view counts, Studio Link relay usage meters, the bytes your client links, hosted review video and guests' recordings waiting for you to collect occupy against your plan's storage allowance, the number of client links and pay links you hold, how many times your embedded videos started each month, and, for each link, the time its page was last opened — which is what decides whether it has gone unused under Section 9. These are billing/quota records, not behavioural analytics: the last-open time is a timestamp on the link, not a record of who opened it.

Who is viewing a client link. This is not available for now: version 2.0.13 of the app and later do not offer it, and no page marks anything or asks for a name, even on a link an earlier version set to mark; this part describes how it would work should a later version of the app turn it back on, with a policy that says so. It lets you mark a client link "with who is viewing". Its page then asks a visitor on an open or password link for their name the first time their browser opens it, and draws that name — or, for a member of your team who signed in to open it, their verified email address — faintly across the link's videos and pictures, with the time. The visitor's browser keeps the name for that link only, for as long as it keeps the link (Section 4), and sends it to us only with the link's access log, below, while we keep one; the page says which when it asks. The mark drawn on the screen is a deterrent, not a forensic mark.

Copies marked for each member of your team. Not available for now either (above). On a link for team members only that you mark this way, each member other than you may also be given their own copies of the link's script PDFs and the scenes the app printed from them, of its photo proofs not yet delivered, and of its review videos not yet delivered (each at most ten minutes long, on a link at most twelve members see), with their email address printed or burned faintly into them — the address alone, without a date. Where an address has characters the mark cannot print, the copy shows a question mark for each and a 16-character code made from the address, which anybody who can guess the address can check. Your app makes these copies when you publish the link; they are stored, sealed, with the link's other files and count against your storage (on a company seat, against the company's shared storage). Files you uploaded yourself, delivered items and hosted cuts are never marked this way, and where a member's copy cannot be made, they are given the shared one, which the page says is not marked with their address. These copies are made only once we have switched them on, for a link published from version 2.0.11 of the app or later; until then nothing of the mark is written into the files on a link.

A link's access log. Once we switch it on — it is off on the day this version of the policy is published — each client link keeps a log, for its owner, of its page being opened, a deliverable being downloaded from it and a hosted video on it being loaded. Each entry holds what was done, to which item and when; the verified email address of a team member who signed in to open the link, or otherwise the name a visitor typed on a link marked with who is viewing (up to 80 characters; not available for now, above); the visitor's country, where our hosting provider reports one; their browser's family, such as Safari or Chrome; and a code made from their IP address and a secret key of ours, which shows the owner that two visits came from the same address without the address itself being kept. Only the link's owner can read it, the owner's own visits while signed in to the link as its owner are not logged, and each entry is deleted ninety (90) days after it is made, or with the link. Until the log is on, we keep no record of who opened a link.

Comments on files you share. When a client link shares files, you can let the people who open it comment on them: it is off unless you turn on Allow comments for that link, a team link or a pay link never takes comments, and you can close comments again on any one file. A comment sends: the name the visitor types, which is required, up to 120 characters, and which nobody checks — the app and the link's page show it just as it was typed, and only your studio's own notes and replies are labeled as your studio's; the comment's text, up to 2,000 characters; the moment in a video or a sound it is pinned to, if any; on a picture, or on the first page of a PDF, the spot the visitor clicked to pin it there, if they did, as two fractions of the picture's width and height (each from 0 to 1); on a PDF, the page number the visitor types, if any (1 to 9,999); the time on the visitor's own browser; which file, and which version of it, the comment is about; and an identifier the page makes for the message. Nothing about the visitor's device or screen is sent with a pin, no file, picture or recording of the visitor's is collected, and your file is not copied. The visitor's browser remembers the name they typed, to fill it in next time. It also keeps what it sends on the link — its comments, and its notes on the link's deliverables — in its own storage, unsealed, until the link's page carries them back from your app, or for seven (7) days, and at most the newest 100 for each link, so that what a visitor sent stays on their screen while it waits for you; it forgets them when it forgets the link's key (Section 4). With each comment — as with anything else a visitor's page sends on a link — the page also stores, unsealed, a code made from the browser's anonymous sign-in and the link, the same for every comment that browser sends on that link — not the visitor's name, and not the sign-in itself — which lets anyone who can read the link's thread see that two comments came from the same browser, and lets our servers hold back for an hour a browser that sends far more than a link allows; and our servers store, beside it, the time they received the comment.

Your app files a comment as a note on a deliverable it adds to your Deliverables for that file, which no client link shows, and from then on it is part of your binder like any other note: on your devices, in your cloud library on a plan that has one, and with the people you share the binder with, as far as their access reaches. The visitor's page also keeps the comment and the typed name, sealed, in the link's live thread on our servers, where anyone who can open that link can read them (Section 8 says what opening one takes), whether or not your app ever files it. Once your app has filed it, every other link of yours with comments on that shows the same file shows it too, with the typed name, from that link's next publish by a device of yours on which this policy has been accepted, or at once when you tick the comment off or untick it on such a device (Section 3A). The device of yours that files a comment shows the typed name and the first 120 characters of the comment in its notification list, and in a banner where that device does not get our push notifications (on a Windows PC, for example), which a device may show on its locked screen; our push notification about a comment names no one and no file, because the comment is still sealed when we send it. Section 8 says how each copy is sealed, and Section 9 how long each stays. What you keep of comments, and about the people who send them, is yours to look after under Section 3A.

Files you share on a client link. A client link can share files and folders from your binder on a Files tab. A Files tab never shows on a link for team members only. A folder you share stays live: what is filed into it later goes on the page the next time the link is updated, from the device of yours that holds the files. Our servers can put a file on the link from its copy on your own T6FV Cloud Drive, copying it from there onto the link, so that the device publishing the link need not send it, or even hold it (a file you keep only on T6FV Cloud Drive, for example). A file of more than 4 GiB is not copied this way: the device sends it if it holds it, and otherwise it is left off, and the app says so. To make the copy, our servers pass over the file's bytes once to compute its checksums, without looking at or keeping its contents. They keep beside your account those checksums, its size and when they were taken, so that they need not do it again. Those are deleted with your account. A link remembers up to 500 files and folders you pick, and its page carries up to 2,048 files and previews; past that, the page lists the rest as not included. On a password link, a file over 32 MiB is not locked by the password (Section 8). A smaller one that the device publishing the link does not hold, and that is on your T6FV Cloud Drive, is downloaded to that device, because our servers never hold the link's password, and only a device can lock a file with it. The downloaded copy, its locked copy and the previews made from it are deleted when the publish ends, whether it succeeded, failed or was canceled, or, if the app was stopped first, the next time it starts (a publish that fails while moving a link from its address from before version 2.0.10 to its new one can keep such a copy on the device until the link has moved). Files on your links use the same storage allowance as your T6FV Cloud Drive and your hosted video (Terms §3.5 and §5.10(a)). Allow downloads, on by default, can be turned off for a link: its page then hides its download buttons and the download option in its own video and audio players. It keeps an invoice's PDF, the "Print or save" of a script or a scene, and calendar and contact files. That does not stop anyone who can open the page from saving what it shows, so it is not protection. Keep every device that edits your links up to date: an older version of the app that changes a link drops its Files tab, turns its downloads back on and forgets its starting layout.

Footage on a link. A link that shares all of a binder's Footage shows your sorted clips in folders named after their scenes and shots, each under the name its camera gave the file, or the name you gave the clip, with the files kept beside them. Clips you have not sorted yet, and the files that came with them, are left off unless you pick them, or their Unsorted, Day, Camera or Card folder. Those folders are named after the link's own shoot days, or the recording date, and after the camera and the card. A link for some of your productions carries only their scenes and shots, and the files beside their clips. A link that shares Footage or Exports carries the files kept there as they are: a camera's SRT file can hold the GPS positions it recorded, and its XML file can name the camera's serial number. A device on an older version of the app that publishes such a link again shows its footage without folders, and may also put on it the files that came with clips you have not sorted yet, until it is updated.

A link's address before it is published. While your device is online, you can copy a link's address as soon as the link is made, before its page is published. So that nobody else can publish a page at that address, our servers keep a note of the link's id and of the account that made it until a week after your app last checked on the link — when you make it, publish it, copy its address, or open the app while it is still unpublished — and then delete it, usually within a day. While one of your devices that holds the link opens T6FV at least once a week, the note stays. When a link is revoked, deleted by our weekly clean-up (a link unopened for a year, or one whose paid plan ended sixty days before), or its account is deleted, we keep a record of the link's id and the time, naming no account, for a year, so that no page can be published at that address again.

What a chat shows of a link. When a link is pasted into a chat app, the app can show a card for it. A new link starts with this card on, whoever can open it (unless your company's policy says otherwise), and you can turn it off for each link. The card shows the binder's name and a picture from the binder, with a "Shared by" line and a site name that name your company, or you if you have not given a company name. On a password or team link, the card is the part the password does not cover: anyone who has the address, and every chat app and preview service it passes through, can see it before the password is typed. With the card off, a chat shows a plain T6FV.io card that names neither the binder nor you. A link that has expired, or whose account has lapsed, always shows the plain card. Links you made before this change keep the setting they had.

T6FV Cloud Drive. Some plans include an amount of storage, presented in the app as T6FV Cloud Drive. Files you put there — footage, exports, documents, anything you choose, whether you send them from the File Manager with Save and upload or Back up to T6FV Cloud Drive, from the web app, or in a backup — are held for you on Cloudflare R2 under your account, a file of up to 100 GB at a time, named so that only our servers can sign a link to them (Section 8 says where that stops). The app sends a large file in parts and resumes it if the connection drops. An upload from the web app goes from your browser straight to our storage, and is lost if its tab closes before it finishes. We hold them to give them back to you: we do not read them, index their contents, use them, or train models on them. The one exception is a file our servers copy from your T6FV Cloud Drive onto a client link you publish: they pass over its bytes once to compute its checksums, and keep those and nothing of its contents ("Files you share on a client link", above). What you put there is entirely your choice, and the app shows what your allowance is and how much is used. A backup to your T6FV Cloud Drive — Back Up Now, sending a single item, or a backup you schedule — copies, as you choose in its settings: your footage, with full-resolution takes only where you choose to include them — which the app asks the first time you back up, and which you can set for each binder in its Details and for each production on its card; a take goes when its binder or any production covering its scene says so — and, with them, the originals kept beside photo takes ("Photos you put in a shot", below) and the renders your motion graphics filed as takes; your renders and exports; your paperwork; the emails you filed; and the app's automatic backups of your library, which are sealed with your account's key before they leave the device (we hold that key too, Section 8) and are not sent at all if they cannot be sealed. That choice about full-resolution takes is a backup's. How the files you add are kept is a choice of its own: Save to this device, Save and upload, or T6FV Cloud Drive only. Unless you have chosen one in Settings, under When adding files, the app asks each time you add files, and if you tick Don't ask again this session it keeps that answer until it closes or you switch accounts. The line that appears while files arrive lets you change the answer for those files and, if you ticked Don't ask again this session, for the rest of the session; it does not offer that for files you add with T6FV Cloud Drive only. The clips of a camera card you add with Save and upload or T6FV Cloud Drive only go to your T6FV Cloud Drive whole, whatever the backup's setting says. A vault file goes only if it is locked with a password or sealed to your account. Everything else is stored as it is, without encryption by the app, so on a plan whose storage we serve we could read it as the operator, although we do not. A file you send there from the File Manager is stored as it is too. T6FV Cloud Drive only. When you add files with T6FV Cloud Drive only, or choose Keep on T6FV Cloud Drive only for files already on a device, the app makes sure each file has a whole copy on your T6FV Cloud Drive: it sends the file there first if there is no copy it can check, a clip at full resolution whatever a backup's setting says, and checks the copy before it lets its own go. After that it keeps no copy of the file on that device, except as "Files you share on a client link" says above, and that device reaches the file only through the T6FV Cloud Drive copy its record names (the record notes the rest as for any file, below). A file you add this way is read from where you added it from, and the app does not delete or change it there; where the system hands the app a temporary copy to read instead, as a phone's file picker can, the app deletes that copy once the file has gone or failed. If the upload of a file you are adding fails or you cancel it, the app keeps nothing of that file and says how many did not go; a file you chose to keep there stays on the device until its copy has been checked. The device remembers, for itself only, which files it keeps only on T6FV Cloud Drive, so that its own Cloud Sync does not download them by itself; a file you download to it comes off that list. Your other devices keep following their own settings, so one that downloads your T6FV Cloud Drive files may still download such a file. A file kept this way plays and previews from your T6FV Cloud Drive where the app can show it, streamed rather than saved; a Windows PC does not stream video or sound, and downloading a file brings any of them onto the device. Retention is in Section 9.

Editing copies. Footage, photos and field recordings stay on the device that captured them, but you can choose, per production and per device, to share small editing copies of a production's media through your T6FV Cloud Drive, so that your other devices can keep editing it. A device with sharing on uploads, to a folder for that production on your T6FV Cloud Drive, low-resolution copies of the production's media: video at about 640 pixels and 1 Mbit/s, photos at 2048 pixels as JPEG, and recorded sound compressed as AAC. Your other signed-in devices download them only when they do not have the originals, and only as your "pictures on Wi-Fi" data setting allows. The copies carry no location, camera or other embedded metadata. They count against your T6FV Cloud Drive storage. They are deleted when you clear them in Proxies & previews (for a production, a binder, or everything), when the production or binder is deleted, with your account, or, for a clip, when it leaves the Trash for good (Section 9). A full-quality export always uses the originals; a device that holds only the copies can make a low-resolution draft, which is labeled as one. Transcripts travel with them. When a device that shares a production's editing copies transcribes that production's recordings, the words it heard — each word, when it was said and, where the app told voices apart, which voice said it, with the language — are uploaded to that production's folder on your T6FV Cloud Drive, so your other devices can edit by the words without transcribing again. Your other signed-in devices pick them up when they open the production; a transcript is small, so it is downloaded whatever your data setting says. Transcripts are deleted with the production's other editing copies: when you clear them in Proxies & previews, when the production or binder is deleted, with your account, or when their clip leaves the Trash for good (Section 9).

Photos you put in a shot. When you file a photo into a shot, the app makes it a take of that shot: a JPEG of at most 4,096 pixels the timeline can play, or the photo itself when it already is one. For a RAW, HEIC, TIFF or PSD photo, and for any photo you grade in the Photo Editor before filing it, it keeps the untouched original beside the take, on the device that filed it, so you can grade from it at full quality. An original keeps what your camera wrote into it — where and when it was taken and the camera's serial number — and so does a take that is the photo itself. An original goes where your full-resolution footage goes: to your T6FV Cloud Drive when a backup includes full-resolution footage for its binder (or one of its productions) or when you send the take there yourself; into a .t6fv_vault backup that includes footage; onto a hard drive you sync; and, like the rest of the app's data, into your device's own backups unless you keep T6FV out of them (Section 2). It goes nowhere else. A picture already in the binder becomes a take that uses the same file, and no copy is made. Deleting the take deletes its original.

Motion graphics projects. A project you make in the Motion Graphics Editor stays on the device that made it, unless you link it to a production. When you link one of its compositions to a shot, the link travels with your library ("Cloud library", below), so your other devices can say where the project is; to open it on a device that does not have it you can package it ("Package for another device"), which saves it as a file in the binder that goes where your binder's files go. A project linked to a production syncs with your library to your own devices and to the people you give that binder's scenes, with the footage it uses reconnected on each device from the shots' takes rather than copied; footage it uses that is not a shot's take stays on the device that added it. While a device is editing a project, the others see that it is open elsewhere, by a code for that device, never its name.

Studio Link relay. If you link devices over the internet (rather than your own network), our relay carries only end-to-end encrypted message content between your devices (Section 8) — we cannot read that. To route it, the relay's own records hold the things routing needs: the accounts and devices taking part and the names you gave them, the studio's name and its address on your local network, which share pages were asked for and, while you have the job list open to your devices, the names of your productions. Those are visible to us; the content passing between the devices is not.

Recording links for guests. If you run a recording session, you can invite a guest to record their microphone from a link in a web browser, with no app and no account. Their browser encrypts what they record before it leaves, with a key made from the part of the link after the "#" — which a browser does not send to a server — and our servers keep only a fingerprint of a proof made from the link, never the key, so we cannot open the recording: a copy of our database, our code and our storage together opens no recording we hold. Section 8 says what that rests on and where it stops. The recording is uploaded in pieces while they record, to Cloudflare R2 under the host's account and counted against the host's storage allowance, and the host's device downloads it and opens it there; Section 9 says how long it stays. What the host's app tells the guest's page — such as the host's name, the production's, the guest's name as the host entered it, and when to start and stop — is sealed with a key made from the same link, so we cannot read that either.

What we can see is what running the link needs:

Before the guest agrees to be recorded, the page already does part of this: it requests an App Check token (below), signs in anonymously, claims the link, measures its clock against ours, and reports to the host's app every fifteen seconds that it is waiting, with the browser label, the round trip to us and how much it has left to send. The microphone stays off, and nothing is recorded, until they agree; a recording from an earlier visit to the same link that had not finished uploading carries on uploading as soon as the page opens.

The page requests a Firebase App Check token, which our servers do not yet require, and to get one it loads Google's reCAPTCHA to judge whether a script is driving the browser: Google receives the browser's IP address, signals about the browser and device, and its own cookies, and handles them under Google's own Privacy Policy and Terms, not as our service provider; we receive only its verdict. In the guest's browser the page keeps the recording at least until the host's device has collected it (Section 9 says when it can stay longer), which microphone was picked for the link, the anonymous sign-in and App Check's token; reCAPTCHA keeps its own.

Once the host's device has collected a recording it is the host's: a take in their project, like one recorded by a device in their session (Section 2), whose record — which carries the name the host gave the guest — travels in the host's cloud library if their plan has one. The browser label and the microphone's name stay beside the recording on the host's device.

Emails we send. We send transactional email only — verification, password reset and security notices, welcome messages, team and company invitations, notices about a company seat (an invitation declined, a seat ending, client links handed over or closed, an account deletion waiting for, refused or canceled because of a company), our invoices for the Agency plan, notices of changes to our terms and this policy, moderation notices, and service digests relevant to content you published. We do not send third-party marketing.

Website and share pages. Our hosted share pages (for call sheets, scripts, and timers you deliberately share) serve the shared content to whoever holds the link, with referrer information suppressed and caching disabled. Our web pages contain no analytics or advertising scripts.

Guests in a live show. This is not available yet: released versions of the app cannot make a guest link for a live show, and this part describes how it works in the builds we test and how it will work once a version turns it on. If you run a live show in Virtual Broadcast, you will be able to invite a guest to join it from a link in a web browser, with no app and no account. Their camera and microphone go straight from their browser to the browser running the show, and never pass through us: we do not carry, see, record or store a guest's picture or sound. To find a direct path, both browsers ask public STUN servers run by Google and Cloudflare for their own internet address, so those servers see each browser's IP address, and the two browsers learn each other's addresses as they connect. What the host's app tells the guest's page — the show's name and the guest's name as the host entered it — and the handshake the two browsers exchange through our database to open the call — including the name the guest types and the network addresses each browser offers — are sealed with a key made from the part of the link after the "#", which a browser does not send to a server, so we cannot read them.

The host decides what goes on air. Every guest sees the show back and hears everyone but themselves, so other guests see and hear a guest while they are on air; and the host can record the show on their own device and stream it to destinations they choose. Messages typed into the show's chat go between the two browsers too, never through us. Once a guest's picture or voice is in the host's recording or stream, it is the host's to look after, under Section 3A.

What we can see is what running the link needs: the host's account, when the link was made and when it expires; that a browser claimed the guest's place, with the anonymous sign-in it used — an identifier with the times it was created and last used, and no name or email address, which the browser shares with the other pages we host that sign in the same way — and when; a fingerprint of a proof made from the link, never the link's key; and, while the call is being set up, when the guest's browser sent its offer, whether the guest left and whether the host ended the call. As with any request to our servers, each request's IP address and the browser's full user-agent string are in our server logs, kept for thirty days, and our servers use the IP address as the key of counters that stop a link being misused, which expire two hours after they start and which our database then deletes automatically, usually within a day. Before the guest presses Join, the page has already requested an App Check token, which loads Google's reCAPTCHA as Section 4 describes, signed in anonymously, claimed the guest's place, and asked the STUN servers whether a direct call is possible from this network; the camera and microphone stay off until the guest presses Join. Guests must be at least 18 (Section 11). Section 9 says how long all of this is kept.

Contact sales. If you write to us through the Contact sales form on our page for in-house video teams, what you enter — your name, your work email address, your phone number if you give it, your organization, your role if you give it, and your message — is sent to our team by email at info@t6fv.com, through the Gmail account we send email from (Section 6), with your email address set as the address to reply to. We do not store it in our database. To keep the form from being misused, once you start filling it in the page requests an App Check token, which loads Google's reCAPTCHA as Section 4 describes, and signs in anonymously; and our servers count submissions per email address and per IP address, in counters that expire within two hours and which our database then deletes automatically, usually within a day. As with any request to our servers, the IP address and user-agent string are in our server logs, kept for thirty days. We use what you send only to answer you and follow up on your inquiry.

Talk to a person. If you write to us through the contact form on our homepage, what you enter — your name, your email address, your phone number if you give it, and your message — is sent to our team by email at info@t6fv.com in the same way, with your email address set as the address to reply to. We do not store it in our database. The same protections apply as for Contact sales: once you start filling it in, the page requests an App Check token, which loads Google's reCAPTCHA as Section 4 describes, and signs in anonymously; our servers count submissions per email address and per IP address, in counters that expire within two hours and which our database then deletes automatically, usually within a day; and the IP address and user-agent string are in our server logs, kept for thirty days. We use what you send only to answer you.

Asking about T6FV. Our homepage and our page for in-house video teams each have an assistant that answers questions about what the app does, beside the contact form on that page. What you type there is sent, with the earlier questions and answers from the same visit, to our server on Cloudflare, which picks the relevant parts of our public user manual and has an open-weight AI model that Cloudflare runs for us (Workers AI) write the answer from them. It never receives an account or anything in one. Neither we nor Cloudflare keep what you ask or what it answers, or use either to train a model: our logs record how much computing each answer took and how long, never its words. As with any request, Cloudflare sees the IP address of the browser asking. To keep the assistant from being misused, the page loads Cloudflare Turnstile once you start using it, to tell a person from a script (Section 4); and our server counts each visitor's questions for the day under a short code made from their IP address with a secret it makes for that day — a pseudonym that cannot be worked back to the address without the secret — and deletes the counts and the secret at midnight (UTC). The conversation is kept only on the page, and is gone when you leave or reload it. Ask our team copies your questions into the contact form on the same page for you to edit; nothing reaches our team until you send that form.

Time zones and weather for a place you saved. To show a shoot day's sun times in the place's own time zone, the app asks our servers which zone a saved place is in, sending its coordinates rounded to two decimal places (about a kilometer); it asks only after you have accepted this version of the policy, and on Windows only after you have accepted the version of October 10, 2026, the first to say that the app asks there. When someone opens a client link you have published, its page asks our servers for the forecast of any shoot day in the next ten days, sending the day's date and its place rounded to one decimal place (about eleven kilometers), and our servers ask Apple Weather and pass the answer back. Neither question is stored, and the place in it is not logged; the only record either leaves is the per-account and per-connection counter that stops the service being misused. The forecast is never written into the published link: the page fetches it each time it is opened.

Cloud library (plans that include one). While you hold a plan that includes it, the app copies your work to our servers so that every device you sign in on shows the same work. Every plan that includes T6FV Cloud Drive storage includes it. What travels is:

What does not travel is what the capture tools record: the library never carries footage or field audio takes, on any plan — only the record of each take, which is a planning record like the rest, and the small still of a take you send to your T6FV Cloud Drive from the File Manager. For a take one of the app's editors made, that record also notes which editor made it, from which document and part, which version it follows, and a code for the device that made it; and, for a photo filed into a shot, the format, size and name of the original kept beside it ("Photos you put in a shot", below). A recording made for somebody's recording session does leave your device — to that session's main device, over your local network, as Section 2 describes — but the recording itself never comes to us. The take it becomes there is theirs, and its record travels in their library if they have one.

On any of your devices you can choose instead to carry the library through a folder in your own iCloud Drive or Google Drive (Terms §5.8(e)). Some devices were already carrying it through such a folder when their plan came to include our library. Each of those moved to our servers once, by itself, and goes on copying the records it sends us, but not the pictures, documents or audio, into that folder as a backup until you stop the backup in Cloud Sync's settings. On a device that more than one T6FV account uses, that move was made only for the account that had synced through the folder, and the others kept the choice they had. The folder itself is the device's, though, not each account's: an account signing in there for the first time syncs through the folder the device already uses until it chooses our library there, a folder one account chooses there can become the folder of the device's other accounts too, and stopping a folder there stops it for every account on the device, so an account that had chosen it may then sync through our servers the next time it signs in there.

Stills of files you send to your T6FV Cloud Drive. When you send a file to your T6FV Cloud Drive from the File Manager — with Save and upload or T6FV Cloud Drive only when you add it, with New version…, with Back up to T6FV Cloud Drive on that file or its folder, or by uploading it from the web app — your library also carries a small still of it, about 320 pixels across, so that your other devices can show the file where it is not: a frame of a video or a take, the first page of a PDF, or a smaller copy of a picture. A sound file gets none. The web app never makes one: a file you upload from it gets its still later, from a device of yours that downloads it. The still is made by the device of yours that holds the file, or, for a file you add with T6FV Cloud Drive only, by the device that adds it, from where you added it, without location, camera or other embedded data, and only by a device on which this version of this policy has been accepted. Such a device also makes stills, once this version is accepted on it, for the files you had already sent there from the File Manager. A Windows PC makes stills of pictures and PDFs only; a video sent from one gets its still from another of your devices that holds it. A file you keep only in the app, or that reaches your T6FV Cloud Drive only through a backup you schedule, Back Up Now or Sync All, gets none. Only your own devices receive a still: a take's record, which names its still, reaches the people you give the binder's scenes to, but the still itself does not. A still leaves your library when its file is deleted for good or its T6FV Cloud Drive copy is removed, and the weekly clean-up in Section 9 then deletes it from our servers. On a plan whose cloud library we serve, we hold your stills, in your library, under the same access controls as the rest of it; if your devices carry the library through your own iCloud Drive or Google Drive folder instead (Terms §5.8(e)), they travel there and we receive nothing. A plan without a cloud library carries no stills.

Records are stored in Google Cloud Firestore under your account. The pictures, documents and audio — and any record too large to be a database document, which is stored as an object rather than a row — are stored in Cloudflare R2 under names only our servers can sign a download link for (Section 8 says where that stops). Both are encrypted in transit and at rest. We use the library to serve your own devices, and the people you invite to a binder, and for nothing else: not for training, not for analytics, not shared with anyone else.

The library also notes which of your devices saved each record: the name that device goes by on the sync screen and, on a Mac, a Windows PC or a Linux computer, a one-way hash of the identifier its operating system gives that computer, mixed with your account so that it means nothing outside it. The app uses them only to tell your own devices apart, so that two copies of T6FV on one computer never ask you which version of your work to keep, while two computers that happen to share a name still do. Neither is used to profile or track you, and neither is shared.

What a file's record notes. The record of a file you add to a binder, and the record of a take, also note: its size and, for video and sound, its length; a code for the device of yours that added it, made from an identifier the app keeps for that device and mixed with your account so that it means nothing outside it — never the device's name or the identifier itself (each of your devices works out the name for itself, from what the library notes about which device saved each record); once it is on your T6FV Cloud Drive, where its copy is there — a path that includes the names of its folders and of the file — with that copy's size and checksum, when it was last checked, a code made from the identifier of the account whose drive holds it, and whether you sent it there yourself from the File Manager; the status you set on it, if you set one (Needs review, In progress or Approved); what you write about it — its notes, and the notes you pin to moments in a video or a sound; and, for a file you open in one of the app's own tools that works on a copy of it (the Graphics Editor, the Document Maker, the Tables Maker or Presentations), which tool it was opened in and which copy there is yours to reopen. That copy is a drawing, document, workbook or deck of the binder, filed with it, and goes wherever the binder's paperwork goes, including to the people you give the binder's paperwork to. For a file kept as a working file of one of the app's editors, the record also notes the scene, and shot, it serves; which part of which document it was exported from, and in what state; and, for a packaged motion graphics project, which project it packs and a code for the device that packed it. The record of a clip that plays from its file on one of your drives, rather than from a copy in the app — the clips an offload adds to a binder's footage among them — also notes where that file is: its path, which names the drive as your computer shows it, the folders on it, which are often a client's or a job's name, and the file; a code the app made for the drive; the file's size and when it was last changed; and, on a Mac, a bookmark with which that Mac opens the file again without asking you. The file itself never travels. These go wherever the record goes: a take's record goes to the people you give the binder's scenes to, so its facts reach them too; the record of a file you add to a binder is not sent to the people you share the binder with; both reach a device you link to your studio over Studio Link and give access to the binder's projects or productions; and in a company workspace these records stay with the company (Section 3, "Company workspaces"). No client link shows any of them, except the notes that "Your notes on a file you share", below, describes. The notes you write on a render are kept only on the device that made it, with the render.

Your notes on a file you share. The notes you write on a file and the comments your client leaves on it through a client link are one conversation. A note you write on a file, on a device of yours on which this version of this policy has been accepted, shows on every client link that shows the file, as your studio's, beside your client's comments: a note you pin to a moment in a video or a sound at that moment, and each paragraph of the notes that are not pinned to a moment as you wrote it. So does an older note once you change it on such a device. It shows on a link whether or not the link takes comments; on one that does not, your notes are the only ones it shows on the file, and nobody can add to them. A note written or last changed on a device of yours before this version was accepted there stays private: no client link shows it until you change it on a device that has accepted this version. A take's own notes that are not pinned to a moment stay private; its notes pinned to a moment follow the rule above. The notes on a render show only on the client links published from the device that holds the render, because no other device has them. Deleting a note takes it off the links: off a link's live thread as soon as the link can be reached, and off its page the next time the link is updated. Your notes go into a link's published copy and, on a link that takes comments, into its live thread too, protected and kept as the rest of what the link shows is (Sections 8 and 9): anyone who can open the link can read them.

Camera cards you drop on Footage. When you add a camera card, or a folder of clips, to a binder's Footage, the app files each card as a shot of the binder's Imported scene, named after the camera and the card ("FX3 · Card 1"), and its clips as that shot's takes. The camera's name is read from the clips themselves, or is the name of the folder you added. The card's is your folder's name, or the camera's reel number, or Card 1, Card 2 and so on when nothing names it, and you can rename both. Each clip keeps the name its camera gave the file and the time the camera says it was recorded. The app does not record the camera's serial number. What came with the clips and is not a clip the app plays stays beside them as files in your binder: camera RAW, MXF and similar files, the XML and SRT files cameras write beside their clips, and other files from the card. Each of those notes the card it came off, the clip it belongs beside, when it was recorded and the production you added it in. They are kept as they are, so an XML file can name the camera's serial number and an SRT file can hold the GPS positions the camera recorded. A card's shot is a planning record like your other shots, so it goes wherever the binder's scenes go, including to the people you give them to. The files beside the clips are files in your binder, and their records are not sent to the people you share the binder with.

The library also carries the addresses and the keys of the client links you publish, so that any device you sign in on can republish a link, collect what your clients have sent to it, or revoke it — rather than only the one device that created it. On a plan whose cloud library we serve, that means we hold those keys, in your library, under the same access controls as the rest of it. Our Security Overview sets out what that changes and what it does not. Retention when a plan ends is in Section 9.

The library also carries the settings of each mailbox you connect in the mail feature — the email address, the name your mail is sent under, the incoming and outgoing server settings, and, if you add one, the signature you add to your messages (one for your business, and any you set for a particular mailbox), as listed in Section 2 — so that a mailbox you connect on one device appears on your others and asks you only to sign in there. They go to your own devices only: a binder you share never carries them. On a plan whose cloud library we serve, that means we hold your mailbox addresses and their server settings, in your library, under the same access controls as the rest of it; if your devices carry the library through your own iCloud Drive or Google Drive folder instead (Terms §5.8(e)), they travel there and not through us. We never receive the password or sign-in that opens a mailbox, or any of its mail, so holding its settings does not let us read it. Disconnecting a mailbox removes its settings from the library and from every one of your devices.

The library also carries your app preferences, so that a device you sign in on is set up the way you left your others: which tools you keep as favorites and the order they sit in; whether notifications are on, which kinds you get and how many days ahead they warn you; your off-site backup, automatic backup and mobile-data choices; your theme, the app's language, whether helper icons are shown and whether the bottom bar is mirrored; your desk background for light and dark mode, including a photo you choose for it; how you have arranged the Projects Tracker — the order and widths of its columns and which are shown, its filters including the values you filter by, its sort, its date range and which binders it shows, never what you type in its search box; the order of the Blueprint Maker's edit tabs and which you have hidden; the folders you file your tools in — their names, how they nest and which tools each holds; and the brushes you save in the Graphics Editor — each one's name, its settings (size, hardness, spacing, flow, opacity, how pen pressure drives it, jitter, scatter, steadying and pressure curve) and when it was saved, never anything you draw with it. While you are signed out, the brushes you save stay on that device. Some stay on each device and do not travel: your quiet hours, how many notifications that device keeps in its inbox and for how long, where the windows and icons on that device's desk sit, and which way it syncs. Your preferences go to your own devices only: a binder you share never carries them. On a plan whose cloud library we serve, that means we hold them, in your library, under the same access controls as the rest of it, and a desk background photo is stored with your other pictures; if your devices carry the library through your own iCloud Drive or Google Drive folder instead (Terms §5.8(e)), they travel there and we receive nothing.

The library also carries what you record about the hard drives you add in the Hard Drives tool, so that a drive you plug into another of your computers is recognized there, with the name and notes you gave it, instead of being added a second time. For each drive that is: the name you give it, your notes and tags, and a photo of it if you add one; the folder on the drive where Add production builds a job's folders; which of your productions are linked to which folders on it, each as the folder's path on the drive, which can itself carry a job's name, with the identifiers of the project and the production, not their names; what identifies the volume — its own identifier, its label, its file system and its capacity; and a summary of its last scan — when it ran, how many files and folders the drive held, how many bytes they came to, how much space was free, whether the scan stopped before it finished, and the names of the folders at the top level of the drive, which are often the names of clients or jobs. The files on a drive are never carried, and neither is the search index the app builds of them, the record of files the app has copied there, its transfers, the access your device has given the app to open a drive, or any password you set for the backups it keeps on one: those stay on the device. Your drives go to your own devices only: a binder you share never carries them. On a plan whose cloud library we serve, that means we hold them, in your library, under the same access controls as the rest of it, and a drive's photo is stored with your other pictures; if your devices carry the library through your own iCloud Drive or Google Drive folder instead (Terms §5.8(e)), they travel there and we receive nothing. While you are signed out, what you record about a drive stays on that device. Remove from my account, in a drive's Edit drive sheet, removes the drive's details — and the listing of its folders, below — from the library and from your other devices, leaving each device its own card for the drive; Forget this drive affects only the device you use it on; and neither touches the files on the drive.

The library also carries the listing of each drive's last scan, unless you switch it off for that drive, so that you can search and browse a drive from another of your devices while it is in a drawer. For each drive that is: the name, size and date of every folder and file the scan reached, which can name clients, jobs and people; which folders the scan could not read or recorded only in part; the scan's totals and when it ran; and the name of the device that ran it — the name that device goes by on the sync screen, or, if it has none, what kind of device it is. It never includes where the drive was connected on that device, and the files themselves are never carried. It travels as a few compressed files stored with your pictures, from which each of your other devices builds its own search index; those devices only ever read it. A listing is sent by the device that scanned the drive, for a drive your account has named or linked — on a computer two accounts share, only by the account that ran the scan — on a plan whose cloud library is running; it is replaced by the drive's next scan, at most once an hour, and a listing too large to carry is not sent at all. On a plan whose cloud library we serve, that means we hold it, in your library, under the same access controls as the rest of it; if your devices carry the library through your own iCloud Drive or Google Drive folder instead (Terms §5.8(e)), it travels there and we receive nothing. Turning off Search and browse this drive from my other devices in a drive's Edit drive sheet removes its listing from the library and from your other devices and keeps it on the device that scanned it until you turn it back on; Remove from my account removes it too; Forget this drive does not, because it affects only the device you use it on.

Binders you share (plans that include sharing). On a plan that includes sharing binders with other people, which not every plan with a cloud library does, you can invite named people to a project binder and give each of them an access level. On a company binder, the company's Owner and Admin seats also receive it, at the Manager level, without being invited ("Company workspaces", below). Only the sections that level grants are sent to them — the rest is withheld by our servers and never reaches their device, so a person who may see the schedule but not the money does not receive the money. We hold that copy solely to serve it to the people you named, on the same terms as the rest of your cloud library. When you remove somebody, when they leave, or when you stop sharing a binder, we delete the copy we held for them and the app deletes the copy on their device; what they exported or copied while they had access is outside our reach, and yours. If you move to a plan that keeps your cloud library but does not include sharing, your shared binders stop reaching those people, and Section 9 says what happens next. You are the one deciding to share, and about whom: see "You are the one who decides" below.

Takes and originals in a binder you share. A member you give a binder's scenes can see the takes the app's editors made — photo takes and the renders of your motion graphics — and, on the owner's plan with T6FV Cloud Drive, download them, and the originals kept beside photo takes, from the owner's drive through a link our servers sign only after checking that you gave them the binder's scenes. Only what is already on the owner's drive can be fetched, and what they fetched is deleted from their device when they lose access, as the rest of the binder is.

Company workspaces. A company on the Agency plan can keep its binders in a shared workspace for its seats, which we switch on for each company. This is what it changes.

Time you log on tasks. A binder's tasks can carry a record of the time people spent on them. Each person has one record per binder. It holds the task, the date and the start and stop times of each stretch of work, how the stretch was recorded (a timer someone started, a calendar booking they chose to include, or times typed in), any note, a total set by hand, and which bookings the person included or set aside. The app records time only when somebody does one of those things. It does not watch what you do: no activity, keystrokes, screens, location or idle time are recorded, and a timer runs only between the moments someone starts and stops it. Anyone who can change a binder's brief (its owner, a Manager or Admin seat, or a Producer) can correct another person's times. Everyone else can change only their own.

On a plan with a cloud library, these records go to your own devices. On a shared binder, your record goes to you and to the people who can change the binder's brief (its owner, Managers and Producers, and on a company binder its Owner and Admin seats), who can see who logged how much time, on which task, and when, across the whole binder even where their access is limited to some of its productions. The other people assigned to a task you logged time on see only how much time each person has on that task, whether their timer is running, and which of its bookings each person included, not the times of day or any note. Anyone who can edit a binder's tasks can assign themselves to one, and that change shows on the task. Everyone else on the binder sees none of your hours. This is enforced by our servers' access rules, not only by what the app chooses to show. They are never sent to a Studio Link Viewer. A device that has not accepted this version of the policy keeps them on that device and sends none until it does. They are included in a whole-library .t6fv_vault backup and in the app's automatic backups, but not in a single binder's export, a duplicate, or a Blueprint. The app can offer logged time to the pricing calculator on your own device, as a suggestion you can take or leave.

Fields a studio or company defines. An account's owner can add their own fields to every binder: a date, a number, a choice from a list, a formula. The definitions are kept in the owner's library. On a company workspace, the company's Owner defines them for the whole company, and our servers hold those definitions so that every seat's app can show them, in place of any the seat defined for themselves. A field's value on a binder travels with the binder to the people who can see its brief. What a field is for, and whether it records anything about a person, is the decision of whoever defines it, under Section 3A.

3A. Information About Other People That You Enter

Most of what you keep in the app is about somebody else — crew, cast, talent, clients and their contacts. Names, phone numbers and emails (including anything you import from your device's address book), rates, call times, images and footage of identifiable people, and free-text notes. Some fields invite genuinely sensitive information: a crew member's dietary requirement or allergy, a performer's measurements, an accessibility need. In some places, notably productions involving children, it will be information about a minor.

Two things follow from that, and they matter.

You are the one who decides. For the information you enter about other people, you decide what to collect and why, and you are the one responsible to them for it — under the GDPR you would be the controller and, for the copy the cloud library holds, we would be your processor. In a company workspace, the company is the one deciding, through its Owner: about the binders its seats keep, about the data fields it defines, and about what it holds on its own seats, including the hours they log. It is the company that is responsible to those people, including for any notice its employment law requires it to give its staff, and we act for the company. Inviting somebody to a binder is a disclosure you are making, not one we are making: choose who to invite, and what to grant them, with that in mind. Letting an AI read it is the same. If you connect an AI app, chat on your own API key or with a model server, or let an AI button work through one of them, and let it read binders, contacts, documents or footage that are about other people, that is a disclosure you are making to the company behind that AI, or to whoever runs that server, not one we are making. It is for you to have a lawful basis for it, to give any notice your law requires, and to honor any confidentiality you owe. Contact details, money, documents and tables are off for every connection, and for AI Chat and the AI buttons, until you turn them on, and stay off for a model server reached without encryption on another computer. While contact details are off, the app strips phone numbers, email and postal addresses, dietary, allergy, medical and measurement notes, information about minors, emergency contacts, agents' details and billing addresses from what the AI reads, and gives it only the name and role of the people on a roster or booked onto a shoot day; rates and other money sit behind the money switch. Turn them on only where the job needs it. That means having a lawful basis, giving whatever notice or getting whatever consent your law requires, keeping it accurate, answering the requests those people can make of you, and not collecting more than the job needs. Recording somebody is the same. If you invite a guest to record from a recording link, telling them that they will be recorded, by whom and for what, and having their agreement — which the law of some places requires of everyone on a recording — is yours to do; the page asks the guest to agree before it turns on their microphone, and notes when they did, but that does not do it for you. Dietary, medical, accessibility and similar notes are treated as sensitive or special-category information in many places, and information about children more strictly again. Record it only where you actually need it. Our Terms of Use §7.9 says the same thing as an obligation.

We do not look at it. Where a plan includes the cloud library, we hold this information solely to serve it back to your own devices and to the people you have invited to your binders, and on a company binder to the company's Owner and Admin seats. It is encrypted in transit and at rest, and reachable by no account other than those. We do not read it, mine it, share it, sell it, or train models on it. If you need a written data processing agreement, ask us at the address in Section 1.

What our sharing tools do with it. Share links, export links, call sheets and published pages disclose whatever you put in them to whoever holds the link. The app is deliberately careful with the most sensitive of it: you choose which sections a link carries when you create it, and a section you leave out is absent from the published file rather than hidden inside it; and where a link goes to someone working on the job rather than to your client, the catering order detail is withheld regardless of what you chose, because a crew member reading a binder is not owed the room's dietary requirements. A client link that carries a binder's Creative section shows the pictures filed to the productions it covers, and the pictures filed to the entire project. From version 2.0.13, that includes pictures that reached the entire project without naming its productions: pictures saved from the Web Viewer or moved there with an earlier version, pictures brought in with a drive's or a restore's files for the whole binder, and pictures attached to a message filed against the whole job. They appear at each link's next publish, as far as the page has room: when they would take it past the number of files a page can hold, the oldest of them are left off, and the app says how many. Stills you import from your device for a screen in a Lighting Diagram or a Virtual Studio show are that tool's own, and are not shown. A device on an older version of the app that publishes such a link again leaves those pictures off, and can put such stills on it, until it is updated. If you let a link's visitors comment on the files it shares, a file's comments are shared by every link of yours with comments on that shows it, with the names typed beside them. Two links to one file often go to two different clients, and each reads what the other wrote; the app says so when you turn comments on, and when a link would show files that already have comments. Versions 2.0.9 and 2.0.10 of the app show the deliverable a commented file gets as an ordinary one, and turning on "Visible on export" for it there shows it, with its comments and the names typed, on every link of yours that shows deliverables, team links included. The name beside a comment is whatever the visitor typed, so anyone who can open a link with comments on can comment under any name. What visitors send you this way is yours to look after like the rest of this section; they cannot change or delete a comment once it is sent, so a request to correct or remove one comes to you (Section 10). Beyond that, which link goes to whom is your decision, and the safest habit is to send the least the recipient needs.

4. What We Do NOT Do

5. AI Features and Your Content

The app's AI features are designed so that you control where your content goes:

On-device AI. Optional AI models run entirely on your device. Prompts, project context, and outputs stay local. A model file reaches you one way and one way only: the app downloads it from our own content delivery network at models.t6fv.io, which runs on Cloudflare R2. That download reveals your IP address to us and to Cloudflare, as any download does, and carries none of your content. The app does not fetch model files from anywhere else and does not send you to any other site to get one. Each model file comes from the model's own developer: it is either a file the developer published, or one we made from the developer's own published weights by converting and quantizing them, without other changes, by steps we publish. Its licence card names, as text, the developer, the repository and revision its file or weights came from and, for a file we made, the steps that made it, so you can check where the bytes came from.

External AI hand-off. For some tasks the app prepares a prompt (which may include project details you've selected — scene lists, script text, gear lists, and similar) and copies it to your clipboard or opens the website of an AI service you have an account with (ChatGPT, Claude, Gemini, Copilot, Perplexity, Grok, DeepSeek, or Le Chat). Copying works on every device; opening the provider's website works everywhere except the web, where you paste it yourself. On an iPhone, iPad or Mac the copied prompt stays on that device rather than passing to your other Apple devices, is hidden from clipboard-history apps and is set to expire after an hour; on Android, Windows and the web it is ordinary clipboard text that other apps can read. You decide whether to submit it. What you submit is processed by that provider under its privacy policy, not ours — we are not a party to that exchange and receive nothing from it. Be careful not to paste content you owe confidentiality for.

AI apps you connect (Mac and Windows). You can let an AI app installed on your computer, such as Claude Desktop, Claude Code, Cursor, Visual Studio Code, Codex in the ChatGPT app, Antigravity, Gemini CLI, or another app that supports the Model Context Protocol, read and, if you allow, change your work in T6FV: project binders, scripts, documents, workbooks, presentations, drawings, photo catalogs, video cuts with their footage details, captions, transcripts, the words spoken in them and still frames, and motion graphics projects. To make that possible, the app listens for that AI app on your own computer only. It cannot be reached from your network or the internet. Each connection has its own key, and the app keeps only a fingerprint of it, on your device, for the account that made it. It also keeps the name and version the AI app gives for itself, on your device, to show you which app is connected and when it last worked. When you connect one, you choose whether it may only read or must ask you before each change, and which binders it may reach — all of yours, including binders you make later, or only those you pick; nothing is set up until you have chosen. Afterwards you can let it make changes as it goes, choose which tools it may use, and change its binders. A connection made with an earlier version of the app keeps what it was given then until you change it: changes as it goes, in all the binders you own. It can never reach binders other people have shared with you, and its searches never return them. Each connection's key works for six months, after which the connection pauses until you set it up again. On a company workspace it can reach company binders only as far as your own seat can, and its changes there show as yours, with the connection's name, in the company's activity. Four areas are off until you turn them on for a connection: money (rates, budgets, quotes and invoices), contact details, documents (agreements and other paperwork) and tables (workbooks). Deleting, sending, sharing, replacing a file and any change to money always ask you first. A connected AI can never sign or approve anything, change your account, your settings or what a connection may do, or touch invoices or signed agreements. Every change it makes shows in the app as it happens, and you can undo it for seven days. If a change would alter what a client sees on a client link you have published, that page is not updated until you tap Release.

We do not send any of this to an AI company. The AI app does. What it reads goes to the company that makes it, or to the AI service you have set it up to use, under your agreement with that company and its privacy policy, not ours. Depending on your plan and settings with that company, it may keep what it receives, or use it to improve its models. We cannot see or control what a connected AI app, or the company behind it, does with what it reads. Text that the AI reads, including text written by your clients or by other people, can try to mislead it, so check what it changed, and remove a connection you no longer use.

What a connected AI can ask the app to do. Within what you let it reach, a connected AI app can also ask the app to do work on your computer for it: transcribe a cut's footage, describe what is in its frames, translate its captions into a copy of the cut, or make a voice-over (below, "AI voices"). That work runs on your computer, with the app's own on-device engines, and the AI app then reads what it produced like the rest of your work. When the work needs something the app does not have yet, such as a model to download, permission to use speech recognition or a language, the app asks you on a card and downloads or changes nothing until you agree; the AI app learns only whether you set it up. Making a voice-over in your own voice always asks you first, and an AI app can never record your voice (below, "Your own voice").

Sending a request to an AI app. In AI Chat, or on an AI button, you can pick an AI app you have connected instead of a key. The app then leaves the task for that AI app in T6FV and opens the AI app with a short note pointing to it, or, for some apps, copies the note for you to paste. The note carries none of your work, and nothing is sent until you press Send in the AI app. Only the session that opens the request with its one-time code can take it. The AI app then works under its own connection's choices, which can reach more than the window you asked from.

Sending to Claude Code as you type (experimental). If you turn this on for Claude Code, the app passes what you type in its chat, and short notices of its own, to Claude Code on your computer as you send them, over the same connection and without your pasting anything. Nothing else from your work is pushed this way; Claude Code reads your work only as above. Claude Code then handles what it receives like anything you type into it, under its maker's terms. It is not offered while Claude Code runs with its permission prompts turned off, and the app never answers Claude Code's own permission prompts. So that it can tell you why, the app reads one setting from Claude Code's own settings files on your computer, whether Claude Code starts without its permission prompts, and reads nothing else there and changes nothing. On a Mac, it can read them only after you pick Claude Code's settings file for it once.

Chat on your own API key (Mac and Windows). You can paste an API key of your own from Anthropic, OpenAI or Google into the app. It is kept in your computer's own secure storage (the keychain), for your account only, and is sent only to the company that issued it, with each request. Before your first message, the app asks whether the chat may only read or must ask you before each change, and which of your binders it may reach; you can later let it make changes as it goes. Money, contact details, documents and tables stay off for the chat until you turn them on, on the same sheet. They are the same four areas as for a connected AI app, with the same effect: while contact details are off, the app strips the details Section 3A lists from what the AI reads. The chat and the app's AI buttons share these choices. When you chat, the app sends, from your computer directly to that company: your messages; the app's own instructions and the descriptions of its tools; and what those tools read from your work for the answer, within those choices. We are not involved, and nothing passes through our servers. That company bills you under your agreement with it. The app keeps only an estimate of what you have spent each month, on your device, and stops at a monthly limit if you set one. When you chat through OpenAI, the app asks OpenAI not to store the conversation for later retrieval. Google's terms for a key on Gemini's free tier let Google use what is sent to improve its products, so the app asks you whether your key is on a paid Google Cloud project, and, if it is not, warns you wherever that key is used and does not let you turn those four areas on for it. Each company's own terms say how long it keeps what it receives.

Model servers you run (Mac and Windows). You can add the address of a model server, meaning software that runs AI models, such as Ollama, LM Studio, vLLM or llama.cpp's server. It can run on this computer, on another computer on your network, or anywhere on the internet you choose. You can then chat with its models in AI Chat, or pick it for Connected AI. When you do, the app sends to that address, from your computer: your messages; the app's own instructions and the descriptions of its tools; and what those tools read from your work for the answer, within the same choices and the same four switches as AI Chat. We receive none of it, and nothing passes through our servers. T6FV does not supply, check or license the models you run there, and does not know what they are; their licences, and what they do with what they receive, are between you and the people who make and run them. The server's own software decides what it keeps of what it receives, and for how long. If the address is a service someone else runs, what you send goes to them, under your arrangement with them. What reaches the server is encrypted on the way only if its address begins with https. The app sends to a plain http address only if it is on this computer or on a private network, such as your home or office network. It checks that on every connection, refuses plain http to any other address, and does not follow a server's redirects. Over plain http on a network, other devices on that network could read what is sent. So for a plain http server that is not on this computer, money, contact details, documents and tables stay off whatever you have chosen, and the app shows that the connection is not encrypted. A key you give the app for a server is kept in your computer's secure storage (the keychain), for your account only, and is never sent over plain http beyond this computer. If a server proves who it is with a certificate it made for itself, the app remembers that certificate the first time you test the server and refuses a different one afterwards. The app can also find a server already running on this computer, by asking the usual addresses on this computer only. On a Mac, the first time you use a server on another computer, macOS asks you to let the app use your local network.

"Connected AI" on the app's AI buttons. Once you have added your own key or a model server, the app's AI buttons offer Connected AI alongside your own AI and the on-device one. Where the AI you pick can work in T6FV, the option reads "Connected AI · MCP". Choosing it opens a panel beside your work and gives that AI the button's task, in T6FV's own words, together with anything you type. The AI then uses T6FV's tools to read what the task needs and, where the button changes something, to make that change in the window you are working in. It reaches only that window's binder, the kind of work the button does and what it creates for the task, such as a translated copy of a cut. It works under the same choices and the same four switches as AI Chat, and what it reads goes to the company that issued the key, or to the model server, as AI Chat's does. Its changes show as they happen and can be undone. Deleting, sending, sharing, replacing a file and any change to money ask you first. Closing the panel stops it. A button whose task needs current facts from the web, such as firmware versions, offers Connected AI · MCP only through a provider that searches the web for that request, and never through a model server or the on-device AI. A button that has no window to work in, such as a social post, gear or pricing, still sends its prompt, which can include the project details it works from, and the AI can also read with T6FV's tools within the same choices. The four switches decide what tools may read, so they do not change what such a prompt contains: it is the same prompt the button would otherwise copy for you to paste. If you pick an AI app you have connected, the button sends nothing itself; it leaves a request for that app, as described above.

Voice dictation and voice-follow. These use your device operating system's speech recognition. Depending on the device and OS settings, audio may be sent to Apple's or Google's speech recognition servers and handled under their policies. If you do not want dictation audio processed off-device, turn on Keep speech on this device in the app's Permissions settings: on an iPhone, iPad, Mac or an Android device with on-device recognition (Android 12 or later), dictation and the Prompter's voice scroll then run on the device or not at all; in a web browser they are turned off; and on Windows speech is already recognized on the PC. It applies to that device only and is off unless you turn it on, or your company's policy requires it.

On-device machine learning. Text recognition (reading camera-body labels), face/pose detection (photo editing aids, and finding the faces in your footage for you to name, below), and translation run on-device via Apple's and Google's on-device ML frameworks. On a Mac running macOS 26 or later, translating a cut's captions can use Apple's own on-device translation. macOS downloads a language from Apple the first time you need it, after asking you, and that download carries none of your content. Photos processed by these features are not uploaded; where Google's ML Kit runs them, it sends Google usage and performance metrics about the feature itself (Section 4). The photo editor's measurements of a face — the outline of the face and the positions of the eyes, brows and lips that its portrait tools work from — are kept on your device with the photo, so that it need not measure them again, and are never uploaded. If you live in Colorado, Illinois, Texas or Washington, which have laws of their own about face data, they are held in your device's memory only while you edit and never written to its storage; what it keeps then is only whether a photo had a face, and the subject mask and depth it uses for backgrounds. The photo editor asks where you live the first time it measures a face, shares the answer with Find faces (below), checks an already-allowed location on your device in the same way, and asks again if your device's time zone changes and at least every six months. Until you answer, its tools that work from faces are off, and it asks again when you use one. The app's interface translations come from catalogs shipped inside the app itself, so in ordinary use nothing is fetched to translate it. On Android and iOS, where a phrase has no shipped translation the app can fall back to Google's on-device translator, and that fall-back downloads a language model from Google the first time it is used for a language — the download tells Google your device is asking for it, as any download does, and carries none of your content; the translation itself then runs on your device.

Faces in your footage. When you ask it to, the app finds the faces in a clip of your footage, on your device, using Apple's or Google's on-device face detection, which reports only where each face is, so that you can say who appears in it. It looks at a few frames of that clip and shows a small picture of each face while that clip is on your screen. The pictures and where the faces were are held in your device's memory only: they are never written to its storage, uploaded, synced, shared or backed up, and they are gone when you leave the clip. The app does not recognize anyone. It measures no facial features, does not compare the faces in one clip with those in another, does not make a face template, faceprint or any other biometric identifier, and never suggests who someone is. What is kept is only the name you give, which becomes part of the clip's record like a note you type and travels as one: to your own devices, to our servers where your plan has a cloud library, and to the people you share the binder with (Section 3). Before you first use it, the app tells you this, asks you to confirm that you have the right to do it for the people in your footage, and records on your device when you agreed. It also asks where you live: Colorado, Illinois, Texas and Washington have laws of their own about face data, so the feature is not offered to someone who says they live in one of them. If you have already allowed the app to use your device's location, it also checks, on your device, whether the device is in one of those states, and does not offer the feature there; your position is not stored or sent for this, and the app never asks for location only to make this check. It asks you again if your device's time zone changes, and at least every six months. The people in your footage are often family, friends or children; whom you name, and telling them, is yours to decide (Section 3A).

Speech recognition on your device. The app can transcribe audio and video you already hold, for example in the Social Clips tool or to make captions from a production's recordings, with a Whisper speech model that runs entirely on your device. The audio stays there, and so does the transcript, unless it is a transcript of a production's recordings that travels as Section 3 describes under "Editing copies". This is separate from dictation, which uses your operating system's own service and is described above.

AI voices. On a Mac, the app can make a voice-over from text, in one of T6FV's own voices or in your own voice (below), using a speech model that runs on your device: Qwen3-TTS 1.7B, made by Qwen and converted by us from Qwen's own published weights by steps we publish ("On-device AI", above). T6FV's voices are not anyone's voice: the model made each of them itself, from no recording of any person. They come with the app, so nothing is downloaded for them, and for now they speak English. The model downloads like any other model, from models.t6fv.io, after you accept its licence: about 1.5 GB. While it speaks it needs about 3.4 GB of your Mac's memory, so on a Mac with 8 GB the app first closes the on-device chat model. The download reveals your IP address, as any download does, and carries none of your content. Making a voice-over sends nothing anywhere. The script and the sound stay on your device until you put them in a binder, an export or a link, where they go as that binder's, export's or link's files do (Section 3). Each voice-over is filed in its binder's audio and labeled "AI voice", and its record notes that it is AI-generated, which voice and model made it, its language and when; that record travels with the binder like any file's (Section 3). Every voice-over file carries a machine-readable mark saying that it was made by AI, and every file the app exports with one in it carries a mark saying that it was made partly by AI. The marks never name you, your account or the voice. They stay even on a review copy from which the app removes other details. If the app cannot mark a file that should carry the mark, it does not let that file out: the export stops instead. When you export a cut with an AI voice in it, the app reminds you, in one line, to say so where the law asks you to; telling your audience is yours to do (Terms §4.12). The app never uses your device's built-in system voices, or Apple's Personal Voice, for voice-overs. An AI app or AI Chat can make a voice-over in one of T6FV's voices as it makes other changes for you: it shows as it happens and can be undone. Using your own voice always asks you first (below).

Your own voice. On a Mac, you can make a voice of your own in the app's AI settings, under Voices, and use it for voice-overs. It can be started only there, by you, and never by an AI app or AI Chat. It is made only from what you record there and then: the app takes no file, no clip and nothing recorded earlier. Before it records, the app tells you what it will do and asks you to agree. It then asks you to read aloud a sentence saying that the voice is your own and that you agree, in French when the app is in French and otherwise in English. Recording it is a statement you make: record only your own voice. You then read three short sentences. On your Mac, the app's Whisper speech model checks that the consent sentence and the three sentences were read as written; that is what the app checks. It does not keep the recording of the consent sentence. It keeps a dated record that you agreed, and to which wording, with no audio in it. From what you read, the app keeps on that Mac, for the account you made it in, a recording of your voice that the voice model speaks from. We treat your own voice as biometric data: the app asks for your explicit agreement before it records, keeps your voice only as Section 9 says, and deletes it as described here and there. It is never sent to us or anyone else, never synced, never put on your T6FV Cloud Drive, in a .t6fv_vault backup or in your device's own backups, never given to an AI app, and never used to recognize or identify anyone. Using it for a voice-over always asks you first, whoever asks. You can delete it at any time, under Voices; deleting it withdraws your agreement and deletes the record of your agreement too. The app also deletes it, and that record with it, when you remove the account from the device, when a company seat's data is cleared from the device, and once it has gone unused for 365 days. If signing out would remove the account, and with it a voice kept only on that Mac, the app warns you first, and you can cancel. Voice-overs you already made with it stay in your work, and stay marked as AI-generated. Colorado, Illinois, Texas and Washington have laws of their own about biometric data such as voices. So, as Find faces does, the app asks where you live and does not offer your own voice to someone who says they live in one of them, or, if you have already allowed the app to use your device's location, on a device in one of them. One answer serves Find faces, the photo editor's portrait tools and your own voice. The app asks again if your device's time zone changes, and at least every six months. If your answer is one of those states, or the device is found in one of them, the app deletes every own voice kept on that device, and the records of agreement with them.

Optional AI web search. On desktop, larger on-device models can be allowed to search the web before answering. Off by default. When enabled, search queries composed from your prompt are sent to a third-party search service (DuckDuckGo), and result pages may be fetched. Leave it off if no part of your prompt should leave the device.

The assistant on our website. Separate from the app, our homepage and our page for in-house video teams have an assistant that answers questions about the app from our public user manual, using an open-weight model that Cloudflare runs for us. It receives only what a visitor types into it, never your account or your content, and nothing it is asked is kept or used for training; Section 3 says what happens to a question.

We can switch AI connections off. We can turn these features off for everyone, from our servers. The app checks a setting when it starts and from time to time, and sends nothing about you or your connections when it does.

6. Service Providers and Other Recipients

We use a small number of service providers to operate the cloud features, each processing personal information on our behalf under their own security commitments:

Provider What it does What it processes Where
Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, App Check) Accounts, database, file storage, server logic, abuse protection Account data, published content, uploaded files, encrypted relay data; a saved place's rounded coordinates while a time-zone or forecast question is answered, not stored; for a recording link, the guest's anonymous sign-in and what Section 3 lists that we can see about their recordings — not the recordings United States
Firebase Cloud Messaging (Google) Delivers the notifications you allow to your devices, and hands those for Apple devices to APNs The device push token stored against your account, and each notification's title — which can name the client, person or file it is about — with the identifiers the app needs to open the right screen United States
Apple Push Notification service (APNs) Delivers the notifications you allow to Apple devices The device push token stored against your account, and each notification's title, as Firebase Cloud Messaging passes it on United States
RevenueCat Subscription management, and the hosted checkout for subscriptions bought on our website Account identifier, purchase/entitlement records; for a web purchase, the payment details you enter at their checkout United States
Stripe (Stripe Connect) Processes card payments your clients make to you on client links, on your own Stripe account if you connect one, or, while you hold a seat in a company's workspace, on the company's; and card payments of our invoices for the Agency plan, on our own Stripe account Your Stripe account identifier, its status, country and public business name; for each payment, the identifiers Stripe assigns, amount, currency, the invoice and link it was for, and the payer's name and email if collected at checkout. Card details are entered on Stripe's page and never reach us United States / Ireland (Stripe's regions)
Apple App Store / Google Play Billing; app distribution Your payment details (held by them, not us); purchase records Per your store account
Google (Gmail) Sending transactional email, and delivering the messages sent through our website's contact forms to our inbox Recipient email address and message content; for a message from one of those forms, what you entered on it United States
A2 Hosting Hosts our mailbox, info@t6fv.com, where privacy requests and vulnerability reports arrive, and where both of our website's contact forms and a client page's "Report this page" deliver What is sent to that address: the sender's name and email address, any phone number given, and the message United States
Cloudflare (R2) Serves the AI model files you choose to download, from models.t6fv.io, and the pieces of videos you embed on other websites, to the visitors of those websites; stores the published copy of your client links — the encrypted payload and the media attached to it — the review video those links host; the files you put on T6FV Cloud Drive, including the editing copies you share for a production; and, on a plan with a cloud library, the pictures, documents and recorded audio your records refer to and the listings of your hard drives' folders, together with any record too large to be a database document; and what a guest records from a recording link, on its way to the host's device The AI model download reveals the IP address of the request and carries no account content. Everything else on this row is account content: what you publish to a client link, in the form Section 8 describes (an encrypted payload, and media protected by unguessable URLs rather than encryption), and the files of your cloud library, stored under names only our servers can sign a download link for (Section 8 says where that stops); and a guest's recording — encrypted in their browser with a key neither we nor Cloudflare receive — until the host's device collects it, with the IP address of the browser that uploads it; and a video you embed on other websites, with the IP address of each visitor's browser that fetches its pieces Global CDN
Cloudflare (Workers AI, Turnstile) Answers questions asked on our homepage and our page for in-house video teams, with an open-weight AI model it runs for us, and checks that a person rather than a script is asking The questions typed in one visit and the answers to them, neither kept nor used for training; the IP address of the browser asking Global network
OpenStreetMap Foundation Map tiles in the location tools, and address lookup (geocoding) when you ask the app to find a place Map viewport requests and IP address (standard for any map); the address or place name you type into a location search EU
Apple (WeatherKit) The weather forecast for shoot days on a client link page you have published The shoot day's date and its place rounded to one decimal place (about 11 km), sent from our servers — never an account, a name, or the page reader's IP address United States
Google Fonts Delivers a display font you pick for a slate, a presentation or a social post, a typeface you choose by name for a drawing in the Graphics Editor (fetched only after you tap it, and remembered on that device), and document faces for PDF export in some writing systems. The app's own interface font is built in and is never fetched. IP address of font requests Global CDN
YouTube / Vimeo Plays embedded course and portfolio videos Standard embedded-player data under their policies, when you play a video United States
DuckDuckGo Optional AI web search (off by default) Search query text, IP address United States

Google's reCAPTCHA, which the pages we host that request Firebase App Check tokens load, is not in this table: Google runs it under its own Privacy Policy and Terms rather than as our service provider, as Sections 3 and 4 describe. Nor are the public STUN servers that a live show's browsers ask for their own internet address (Section 3), run by Google (stun.l.google.com) and Cloudflare (stun.cloudflare.com): a browser contacts them directly, they see its IP address, and they run under their operators' own terms.

AI apps you connect, the companies whose API key you enter in the app (Anthropic, OpenAI and Google), and model servers whose address you enter, are not in this table either, because they are not our service providers. We do not engage them, pay them or send them anything. They receive what you let them read, from your own computer, under your agreement with them and their privacy policies (Section 5). The same is true of where they process it.

Beyond service providers, we disclose personal information only: (a) to other users and the public, at your direction — content you publish is public by design (Section 3), and what a visitor writes on a client link with comments on is shown to the visitors of your other links with comments on that show the same file (Section 3A); (b) for legal reasons — where required by law, regulation, subpoena, or court order, or to protect the rights, safety, or property of users, the public, or T6FV; (c) in a business transaction — if T6FV is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy's commitments; and (d) with your consent in any other case.

We do not disclose personal information to data brokers, advertisers, or AI training aggregators.

7. International Transfers

We are a Canadian company. Our database, accounts, server logic and transactional email run on Google Cloud in the United States, and your account information and published content are stored and processed there, where they are subject to lawful access under U.S. law. What you send to our mailbox, info@t6fv.com, is held by A2 Hosting, also in the United States.

Files are different, and this is the part to read if you are in the EEA, the UK or Quebec. The files described in Section 3 — what you put on T6FV Cloud Drive, the media and review video on your client links, the videos you embed on other websites, the pictures, documents and audio your cloud library refers to, and a guest's recording on its way to the host — are stored by Cloudflare (R2) on its global network rather than in a single named region, and Cloudflare may hold or serve them from outside Canada and outside the United States. Cloudflare is a processor acting on our instructions, and the transfer safeguards below cover it as they cover the others. We do not currently offer a choice of storage region; our Security Overview says so too.

8. Security

Proportionate to what we actually hold:

No system is perfectly secure. If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the appropriate authorities (including the Office of the Privacy Commissioner of Canada and, where applicable, provincial and foreign authorities) as required by law.

9. Retention and Deletion

You control local data. It lives on your device, and we hold no copy of it unless your plan has a cloud library or you back it up to your T6FV Cloud Drive. Deleting it takes effect in stages. A binder or project you delete stays in Recently deleted for thirty (30) days, so that you can bring it back, and leaves the app's automatic backups thirty-one (31) days after you deleted it; Delete all backups removes those backups at once, and they are kept no longer than a year in any case. A production you delete stays in Recently deleted for thirty (30) days too, with each of its cuts. Deleting a clip — footage or a recording in a binder, a Frame Flow card's recording, or the clips of a scene or shot you delete — moves it to the Trash, where it stays for thirty (30) days on each of your devices that holds it and can be put back from any of them; a binder's Timelapse or Stop Motion shoot goes there as a file, with its frames. Discarding a recording right after you make it, and deleting a recording in Recordings, or a Timelapse or Stop Motion shoot, that you have not filed to a binder, delete it at once. A scene's or shot's claps and drawings are deleted with it, and a deleted shot does not come back, so its clips return to Unsorted if you put them back. When a clip leaves the Trash for good — when you empty the Trash, when you delete it from the Trash, or thirty (30) days after you moved it there — each of your devices deletes it, with its poster, stills, transcript and editing copies; a device of yours on an older version of the app keeps its copy until it is updated. It does not reach the file in your photo library or on a drive that a clip plays from or was imported from, such as the copy an offload made, copies on your own hard drives, or a recording a crew member made for your binder on their own device. Editing copies of a production nobody has opened on a device for ninety (90) days are cleared from that device, unless you chose to keep them for that binder or changed the period. Removing an account from a device removes, with its library, its downloaded mail and mailbox sign-ins, its stream keys, its hard-drive backup passwords, its AI connections, its AI Chat conversations, its model servers and their keys, its own voice and its automatic backups on that device. What your device's own backups (iCloud, a computer backup, Time Machine) already hold stays there unless T6FV's data was kept out of them (Section 2), and on a Mac or a Windows PC uninstalling the app leaves its data folder until you delete it. A recording you sent to somebody's recording session is also in their project, and deleting yours does not remove theirs.

AI connections keep everything on the device, and we hold none of it. A conversation with a connected AI app, or in AI Chat or on an AI button through your own key or a model server, stays until you delete it or, unless you pin it, until ninety (90) days after its last activity. What each change replaced, kept so that you can undo it, stays for seven (7) days. An item of Agent feedback stays until you send or discard it. A connection's key fingerprint, the name its app gave for itself, and its settings stay until you remove the connection; a removed connection, or one that was never used within seven days of being set up, stays listed for seven (7) days more. Your own API keys stay until you remove them, along with the monthly spend estimate. A model server's address, name and settings, and its key if you gave one, stay until you remove the server. Removing your account from the device removes all of it. What a connected AI app, an AI company or a model server has already received is kept as its own terms or software decide, and deleting it here does not delete it there.

AI voices and your own voice. T6FV's voices come with the app, and the voice model stays on your device until you delete it, like any model. Voice-overs are files in your work, kept and deleted like your others. Your own voice stays only on the Mac it was made on. It is deleted when you delete it, which also withdraws your agreement, when you remove the account from the device, when a company seat's data is cleared from the device, when you tell the app you live in Colorado, Illinois, Texas or Washington, when the app finds the device in one of them by a location you have already allowed, or once it has gone unused for three hundred and sixty-five (365) days, whichever comes first. The dated record that you agreed holds no audio, and it is deleted with the voice in every one of those cases. We never hold either, so there is nothing of them for us to delete.

Account data is retained while your account is active. When you delete your account (in-app: Profile → Delete Account, with password confirmation):

Our database's own backups still hold what was deleted until they expire (below).

Cloud library (for plans that include one) is retained while the plan is active. The copy on our servers is the records and the pictures, documents and audio stored with them, and the client-link keys, mailbox settings, app preferences, hard drive details and hard drive listings the library carries; wherever this section says the library is deleted, all of that is deleted with it. A file no record refers to any more — because you removed the picture, or deleted the record that pointed at it — is removed by a clean-up that runs weekly. So is the still of a file you sent to your T6FV Cloud Drive from the File Manager, once the file is deleted for good or its T6FV Cloud Drive copy is removed. That includes a drive's listing: the one a new scan replaces, and the one you switch off or remove with the drive from your account, is removed the same way. The copy held for somebody you shared a binder with is deleted as soon as you remove them, they leave, or you stop sharing that binder. If you move to a plan that keeps your cloud library but does not include sharing, the binders you shared stop reaching the people you shared them with, and we email those people. If no plan that includes sharing covers your account again within sixty (60) days, the copies we held for them are deleted, with your binders' activity records, approvals and sign-offs. Your own library stays as it is, and so do the member lists of your binders. When paid access ends, syncing stops and the copy on our servers is held unchanged for 60 days so that resubscribing restores it; we email you when the hold starts and again before it ends, and at the end of that period the copy is permanently deleted, with what we held for the people you shared binders with. Hosted review video, your T6FV Cloud Drive and your portfolio images are not part of the library and are kept until you delete them or your account (hosted video and T6FV Cloud Drive files, once your account no longer has storage, for the periods described under "T6FV Cloud Drive" below, and older copies at addresses from before version 2.0.10 as described below); so are the member lists of the binders you shared. Their activity records, approvals and sign-offs are deleted with the library at the end of the hold. Deleting your account deletes it immediately, without the hold. While your account holds a seat in a company's workspace that you have joined, it cannot be deleted until the seat has ended, except after a long suspension as below, so that the company binders in it reach the company first ("Company workspaces", below; Terms §6.4). Neither deletion touches the copies on your own devices, which remain yours.

Company workspaces. A deleted company binder stays in the company's trash for thirty (30) days, so that the Owner or an Admin seat can restore it, and is then deleted permanently, with its records and files. While the company's plan is suspended, its workspace is switched off or the company is closed, nothing in the trash is deleted for being thirty days old: a binder that has been there longer is deleted once the workspace runs again, and in any case two (2) years after it was deleted, whatever the company's state. A binder still being moved into the trash at that point goes back to the person who held it, in a closed company as an ordinary binder of theirs. A former seat's archive is kept for the company until its Owner deletes it, and for no longer than two (2) years after the seat ended, or until the company is erased (below). From fifteen (15) days before the two years end, the client links still waiting to be published again from it close and the binders' holder is told, and the archive is deleted, with the name, email address and library notes it kept about the person, before the two years end: our clean-up runs daily, and deletes it on its first run from the day before. An archive made when a company binder is handed from one seat to another is kept until the seat it was handed to brings it into their library, and we remind them once a year; once it has been brought in whole it is deleted, and if anything of it was left out, it is kept for no longer than two years after the handoff. A part-made copy left by a removal that stopped before it finished is deleted once the removal has stopped, if nothing was taken out of the person's library; if anything was, it is kept like an archive. When an archive goes, so do our other records of that seat's ending: the record of the removal, the records of its client links, the record of what came back from the person's devices, the names in the company's notifications about it, the record our servers kept of the seat's devices, and, for a closed company, the address of an Owner it was waiting for and the names on its roster. If a letter about it could not be delivered, we keep only which holder and which archive it was, so that we can follow it up. Two things can keep an archive longer, and we resolve each by hand: an archive whose end date our records do not hold, and one with a client link that will not close. When a company is closed, every seat is ended as Section 3 describes, each company binder becomes an ordinary binder of the Owner, and the company's trash and archives are kept for the Owner to bring in, under the same limits. The company's invoice list is kept while the company exists and is deleted when the company is closed, with our records of what the Owner did to its invoices. The invoices themselves stay in the libraries of the people who hold them, and a card payment taken into the company's Stripe account can still be refunded in that account by whoever then holds it. While a company's plan is suspended, a seat whose own plan has no cloud library has their cloud copy kept but not served for up to thirty (30) days, and then held for the sixty (60) days above, which do not delete it while a copy for the company is still to be made. Once the suspension has lasted more than thirty days, the seat may delete their account, and the company binders in it are copied to the company first (Section 3, "Company workspaces"). Time logged on a binder stays with the binder after the person who logged it leaves it, under the name they had then, and is deleted with the binder.

Erasing a company. If a company's Owner asks us in writing to erase the company, rather than keep its trash and archives for the periods above, we finish within thirty (30) days of the request. Every seat ends at once, without waiting for the seats' devices, so changes a device had not yet sent are lost; and the company's binders, its trash, its former seats' archives, the client links on its work, its settings and the company itself are deleted. Each person keeps their own account, their own binders and the copies in their own T6FV Cloud Drive, and a company binder that had already gone back to the person who holds it — because the company's workspace was switched off, or because they had left — stays theirs. While the erasure runs, nothing is restored from or put in the company's trash, nothing is brought in from an archive, and a binder made in that time stays its maker's own. For thirty (30) days afterwards, any of the company's work that a device kept offline throughout sends back is taken out of that person's account again. We keep our invoices to the company, as the law requires, and a record of the erasure — the reference of the request, which of our staff ran it, the times and the counts, with no name or email address — and we email the Owner a statement of what was erased and when. The copies of it our database's backups hold are gone within thirty-five (35) days of the erasure, and the statement says on which day.

T6FV Cloud Drive keeps what you put on it until you remove it, or, once your account no longer has storage, until the period described below ends. A file on the drive is not deleted for being old, unopened, or unreferenced. One thing you do removes a file later rather than at once. When you move a file you added to a binder, or a clip, to the app's Trash, its T6FV Cloud Drive copy is kept while it is in the Trash, so you can put it back, and it is deleted when you empty the Trash, when you delete it from the Trash, or thirty (30) days after you moved it there, whichever comes first. A clip's editing copies and transcripts on your T6FV Cloud Drive are deleted with it: the app finds them by listing your T6FV Cloud Drive, and when the drive holds more than one listing can show, a copy filed under a production that the device deleting it does not know of can be missed, and stays there. Putting it back before then keeps its copies. For a file you keep only on T6FV Cloud Drive, that copy may be the only one the app has: the device that keeps it there holds none, though another of your devices may have downloaded it. So when it leaves the Trash it may be gone from the app. When you empty the Trash or delete it from there, the app says that T6FV Cloud Drive holds its only copy, or that it may, for each such file the device you are using knows of. The file you added it from is not touched. The app deletes a T6FV Cloud Drive copy only where it can tell that the copy is that file's or that clip's own. Where it cannot, it leaves the copy on your T6FV Cloud Drive, where you can remove it yourself. That is the case, for example, for a copy that another of your files or clips also names. It is also the case, on a device that holds no backup record of the file, for a copy in a folder named after a name its binder had at another time than the one that device looks under (as when the binder was renamed after the file went to T6FV Cloud Drive, or after that device first backed the binder up), and for a copy in a folder named as another binder in your library, one shared with you included, or one of its productions, is named or was until recently (a copy of a binder, made with Duplicate or from a blueprint, carries the original's production names, the first of them the original binder's own name). A device holds a backup record of a file it backed up to T6FV Cloud Drive or downloaded from there. Adding a file with T6FV Cloud Drive only, or from a browser, leaves none, even on the device that added it. A clip's removal at thirty days, and the removal of its editing copies and transcripts, are made only by a device of yours on which this version of this policy has been accepted; until then, those copies stay on your T6FV Cloud Drive. Copies on your own hard drives are never touched. Editing copies are the exception, because the app made them rather than you: they are deleted when you clear them in Proxies & previews, when their production or binder is deleted, with your account, or with their clip, as above. A render or an edit package is different: it is kept only on the device that made it, and deleting it there does not go through the Trash and takes it off the client links that show it. Its T6FV Cloud Drive copy stays, for you to download or remove, unless you tick Also remove its T6FV Cloud Drive copy when you delete it, and give your account password if the app asks for it, which removes that copy as well. If your plan no longer includes storage, the drive is not frozen: you can still list and download everything on it, and still delete files — what stops is adding new files. It is not kept for ever, though. We may delete every file on the drive, the editing copies included, but only after our weekly check has found your account without storage and we have emailed you to say so, if we have your address, and then no earlier than twelve (12) months after that email and only after emailing you twice more, about a month and about a week beforehand. Every video you host — review cuts on client links and video you uploaded to your Portfolio — may be deleted sooner, wherever it is shown, but no earlier than sixty (60) days after that first email and only after emailing you again about a week beforehand. Moving to a plan that includes storage before then stops the count and keeps everything still there; while your account holds a seat in a company, none of this applies. Deleting your account deletes every file on the drive immediately, with no hold, so take copies of anything you want to keep before you delete. This is deliberately different from the cloud library above, which is held for 60 days and then removed.

Takes the editors made. A photo take's original is deleted with the take (or, when you saved re-graded versions of it, with the last version that keeps it), and kept while the take is in the Trash. What the app notes about how a take was made goes with the take; one left behind by an older version of the app is deleted after 35 days. Previews of motion graphics are deleted as Section 2 says.

Client links (for plans that include them) publish an encrypted copy of the content you choose to a page your client can open, and hold what your clients submit on that page (notes, comments on files, task check-offs, signed approvals, and payment reports — the name, amount and reference a client enters when they tell you they have paid) until your app collects it, and the notes and comments on the link's live thread as the next paragraph says. That content is retained while the link exists — and a link is not kept forever: a link that no client has opened for twelve (12) months is deleted, together with its published copy and any uncollected client submissions, and we email you at least thirty (30) days before that happens so you can open or republish it if you still need it. Republishing a link, or anyone opening its page, restarts the twelve months. A pay link (a client link that carries an invoice) is deleted on the same basis, and also as soon as you void or delete the invoice it was issued for. When your paid access ends, the pages close to clients immediately and everything clients sent is held for 60 days so you can save it to your devices and so resubscribing restores the links; we email you when the hold starts, and at the end of it the links and any uncollected client submissions are permanently deleted. Deleting a link yourself deletes its published copy and any uncollected client submissions at once — the app first saves what it can to your device and warns you about anything it cannot. Deleting your account deletes all of your client links, their published pages, and any uncollected client submissions immediately, without the hold. Copies already saved to your devices remain yours. While a link keeps an access log, each of its entries is deleted ninety (90) days after it is made, or with the link (Section 3). Embedded play counts are kept about 13 months and deleted with your account (Section 3).

Notes and comments on a client link are kept in more than one place. Once your app files one, it is a note in your binder, kept until you delete it; revoking or deleting the link does not delete a note already filed. Its copies on the live threads of the links showing it stay, readable by anyone who can open the link, until our weekly clean-up removes the oldest beyond the 200 a link's page reads, you delete the note, or the link is deleted. Turning comments off stops a page showing them, and does not delete those copies. A comment on a shared file that you delete on a device running version 2.0.9 or 2.0.10 keeps its live copies until the clean-up removes them or the link is deleted, unless it went with its file's whole deliverable and a device of yours on a later version that already held the binder takes the copies off. A comment your other links show stays in their published copies until each is next published. A comment your app cannot file yet waits in the link's inbox: because the binder already has 90 deliverables, the file or the binder has all the comments it takes, or the device does not have the file or the link's latest settings yet. A device of yours on version 2.0.11 or later that holds the binder, and on which this policy has been accepted, files it once it can; one it still cannot file becomes due to be let go fourteen (14) days after it arrived, and that device lets it go the first time it takes in the link's messages after that. Until then it waits, within the twelve-month and lapse rules above, unless the link is deleted or our weekly clean-up removes it as one of the oldest messages beyond the 1,000 a link's inbox keeps; you can also discard the comments waiting for room. A comment still waiting when you turn comments off is deleted without being filed by such a device, once the link has been published with comments off. Versions 2.0.9 and 2.0.10, and a device on which this policy has not yet been accepted, never let one go, so while only those are in use a comment waits until the link is deleted or the weekly clean-up removes it among those oldest messages. A comment that cannot be filed — a repeat, one that is malformed, one about a file the link no longer shows or whose comments you have closed, or one sent to a team link or a pay link — is deleted when your app finds it. When a link, or one browser on it, has sent far more than a link allows, our servers refuse more comments from it for an hour and delete the live-thread copy of a comment that arrived over the limit; the copy waiting for your app is kept and filed like any other.

Files at addresses from before version 2.0.10. The pictures and files on client links and Portfolios, and hosted video, that were published before the change Section 8 describes sit at the older addresses that carry an account's identifier. While those addresses are being retired, we keep what is at them, without counting it against your storage — even after you replace it, remove it from your Portfolio or publish a link again without it — so that a device of yours can still copy it to its new address. Deleting or revoking a link deletes its own older copies with it, except, sometimes, a file an earlier republish had left off that link. Once the older addresses are retired, we delete whatever is still at them after a notice period.

Recording links hold a guest's recording in our storage only until the host's device collects it: once it has downloaded the recording and filed it as a take, it deletes our copy. A recording the host's device never collects, or that never finished uploading, becomes due for deletion fourteen days after the expiry its link had when the recording was made, and our weekly clean-up deletes it the first time it runs after that — normally within twenty-one days of that expiry. What we keep about each recording — the details Section 3 lists — goes with it. A link stops taking new recordings when it expires — which the host's app can set, each time it sets it, no more than eight days ahead — or when the host turns it off or ends the session. A recording already under way when the session ends has up to a day to finish uploading, but never past the link's expiry; and a piece the page had already been given an upload address for can still arrive up to an hour after any of these. The link's own records, including the page's reports to the host's app and which anonymous sign-in held the link, are deleted by the same weekly clean-up once the session's links have been expired for a day. The anonymous sign-in itself is deleted automatically by our authentication provider about thirty days after it was created. Deleting the host's account deletes the rest at once, except that a piece the guest's page had already been given an upload address for can still arrive within the following hour; our weekly clean-up deletes it the first time it runs after that. The recording the host collected is theirs, in their project, and deleting the link does not remove it.

The guest's browser keeps its own copy of what they recorded, so that a dropped connection loses nothing and they can save a copy, and the page asks the browser not to clear it on its own. The page deletes a recording from that copy only while it is open and has been told that the host's device collected it. A recording the link refused is not deleted, and once the link's records have been cleared the page is never told; so a copy can stay in that browser until the guest clears its data for the site.

Live show links work while the show is open on the host's device and for about a day after it closes: while the show is open, the host's app renews each link every hour to expire a day later, and the host can end a guest's place sooner; the host's app can never set a link more than two days ahead. Opening the show again renews its links, and makes again any link records the clean-up had already deleted, unless the host had ended that guest's place. Our daily clean-up deletes a show's link records — the sealed names, the handshake and which anonymous sign-in claimed each place — the first time it runs a day after the show's links have expired, normally within two days of that expiry; deleting the host's account deletes them at once. The anonymous sign-in itself is deleted automatically by our authentication provider about thirty days after it was created. We never hold the guest's picture or sound, so there is nothing of it to delete; what the host recorded is theirs.

Messages from our website's contact forms (Contact sales and the homepage's) are not stored on our servers. The email that carries one stays in our inbox for as long as we need it to answer you and follow up; ask the Privacy Officer (Section 1) and we will delete it.

Our database keeps point-in-time recovery for seven (7) days, daily scheduled backups for seven (7) days and weekly ones for four (4) weeks, so what was deleted stays in them for at most about four weeks. Files we hold in Cloudflare R2 are not backed up. Records we are legally required to keep — records of card payments made through the app, our invoices for the Agency plan and their payments, and subscription transaction records held by RevenueCat — are kept for at least as long as tax law requires; nothing yet deletes them automatically. A copy of the data of the app this one replaced, exported in August 2026 before that data was deleted, is kept, restricted to our administrators, until no later than February 18, 2027. Unverified accounts are subject to scheduled cleanup. Ninety (90) days after it was sent, a feedback report, bug report, content report or item of Agent feedback has its content blanked — the prompt and reply, the error and its trail of actions, what you were looking at when you reported something and, for Agent feedback, its message — leaving what you wrote in the report's notes box (except in Agent feedback), the category, the area of the app, whether it was a crash, our triage, a content report's reason and what it was about, the device details where it has them, and the dates. The reports you sent stay with us after you delete your account, with your name, username and email address removed from them and their content, your notes included, blanked at once. Deleting your account does not cancel an app-store subscription — cancel it in your store settings.

10. Your Rights

Everyone: you can access and correct most of your information directly in the app (profile, portfolio, published content), delete individual posts and content, and delete your account entirely in-app. For anything you cannot do in-app, contact the Privacy Officer (Section 1). We respond to access and correction requests within the time required by applicable law (30 days under PIPEDA, extendable as the law permits), and we do not discriminate against you for exercising any right. If you commented on a file somebody shared with you through a client link, you cannot change or delete the comment yourself: ask the person who shared it, who decides what they keep about the people they share work with (Section 3A).

Canada (PIPEDA and provincial laws): you may request access to the personal information we hold about you, request corrections, withdraw consent (subject to legal or contractual restrictions — withdrawing consent for account data means closing the account), and challenge our compliance. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Quebec (Law 25): you additionally have rights to data portability of computerized personal information you provided, to request de-indexing or cessation of dissemination in certain circumstances, and to complain to the Commission d'accès à l'information du Québec. We do not make decisions about you based exclusively on automated processing.

EEA / UK (GDPR / UK GDPR): where GDPR applies to our processing, we process personal data on these legal bases: performance of a contract (account, subscriptions, cloud features you use); legitimate interests (service security, abuse prevention, defending legal claims — balanced against your rights); consent (optional features that send data off-device where we ask first, such as translation pack downloads, including prompts in feedback reports, and including what a connected AI says it was doing in feedback you send from AI connections); explicit consent for your own voice (Section 5), which the app makes and keeps only on your device and which we never receive; you withdraw it by deleting your voice under Voices, in the app's AI settings, which deletes it and the record of your agreement at once; and legal obligation (tax and accounting records). You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time without affecting prior processing. You may lodge a complaint with your local supervisory authority or the UK Information Commissioner's Office. We have not appointed an EEA/UK representative; we are a Canadian company and offer the Services globally through the app stores.

United States (state privacy laws, including California CCPA/CPRA): we do not sell personal information, do not share it for cross-context behavioural advertising, and do not use or disclose sensitive personal information for purposes requiring a right to limit. You have the rights to know, access, correct, and delete, exercisable in-app or through the Privacy Officer, and the right not to be discriminated against for exercising them. Because we do not sell or share personal information, no "Do Not Sell or Share" mechanism is required, and we treat universal opt-out signals as satisfied by default.

Verification: for requests made outside the app, we verify identity against the account email before acting, and we may decline requests that are manifestly unfounded or excessive, as the law allows.

11. Children

The Services are for adults. You must be at least 18 to use them (our Terms of Use, and in-app age confirmations, require this). We do not knowingly collect personal information from anyone under 18; if we learn we have, we will delete it. If you believe a minor has provided us personal information, contact the Privacy Officer.

That is a different question from information about a minor. Productions involve children, and the app will hold what you put in it — a young performer's name and call time, a guardian's contact details, footage of a child, a signed minor release. We do not solicit any of it and we do not use it. Where you record it, you are responsible for it under Section 3A, and the law protecting children's information is stricter than the rest; a guardian's consent is usually the least of what is required.

12. Changes to This Policy

We may update this policy as the Services evolve. Material changes will be announced by email and/or prominent in-app notice at least thirty (30) days before they take effect where feasible; the "Last Updated" date always reflects the current version. Continued use of the cloud features after the effective date constitutes acceptance of the updated policy, to the extent permitted by law. Prior versions are available on request.

13. Contact and Complaints

Privacy Officer, THE 6-FIGURE VIDEOGRAPHER LTD., Mississauga, Ontario, Canada — info@t6fv.com.

If we cannot resolve your concern, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376), your provincial privacy regulator, or — where GDPR or a U.S. state law applies to you — your local supervisory authority or attorney general.