DRAFT — NOT LEGAL ADVICE. This template needs review by Owen and a qualified attorney before it is published or relied on. It is not in force.

Privacy Policy (draft)

This template does not itself create a privacy program or guarantee compliance with any privacy law (including the CCPA/CPRA, other U.S. state laws, or the GDPR).

Product name: ClipFit.
Operator (to be confirmed): [PLACEHOLDER: legal entity name]. Until an entity is formed or confirmed, the operator is expected to be Owen Johnston, an Illinois-based operator, or a business entity Owen later designates.
Mailing address: [PLACEHOLDER: mailing address].
Privacy contact email: [PLACEHOLDER: privacy contact email].
Draft date: 12 November 2026 (America/Indianapolis). Version: Draft 0.3 — pre-launch, not published. Operational defaults in this draft are proposed and pending Owen’s sign-off.

Fill in the legal entity name, mailing address, and privacy contact email before publication. Until then, this document is an internal draft only.

1. Scope

This draft describes how the ClipFit website and self-serve clipping subscription (“Service”) would collect, use, and share personal information. It covers the pre-launch waitlist at https://clipfit-c5k.pages.dev and, later, accounts and paid subscriptions, once those are enabled.

PROPOSED, pending Owen’s sign-off Paid launch of the Service is offered only in the United States. The Service is not offered to users in the European Economic Area or the United Kingdom at this time.

The Service is aimed at adult creators and businesses, not at children. See Section 9 for children’s privacy, including the federal Children’s Online Privacy Protection Act (COPPA).

2. Information we may collect and why

Information you provide

  • Waitlist or contact details (collected now): name, email address, channel or show name, and whether you make podcasts, streams, or both, plus your agreement to the rights clause and to these policies. We use this to operate the waitlist and contact you about beta access or launch. Waitlist submissions are collected by Tally, as described in Section 4.
  • Account details (once accounts exist): login identifiers and profile information you submit, used to create and administer your account and provide the Service.
  • Content you upload (once uploading is enabled): video and audio files, and metadata such as file names and duration. Uploads may contain voices, faces, and other personal information of you or other people who appear in your footage. We would use this to transcribe, clip, reframe, caption, and deliver output files to you. You are responsible for having the rights and any required notices or consents to upload that footage.
  • Support messages and form submissions: used to respond to you and to keep a record of requests (including access or deletion requests).
  • Payment details (later, when payments are enabled): billed through Stripe. We would not intend to store full card numbers on our own servers. Stripe would collect payment information under its own privacy policy, and we would receive limited billing information (for example, subscription status, last four digits or a payment-method token, and transaction amounts) needed to administer your subscription, prevent fraud, and meet tax or accounting obligations.

Information collected automatically

  • Standard technical data such as IP address, browser type, device type, referring URL, pages viewed, and approximate timestamps, if the chosen host or a later analytics tool logs them. The current marketing site is hosted on Cloudflare Pages, which may log technical data in the ordinary course of hosting.
  • Cookies or similar storage, as described in Section 8.

We do not invent or claim any additional data practices. If a new tool is added, this policy must be updated before it collects data.

3. How we would use information

  • To operate the waitlist and contact you about beta access or launch.
  • To provide, maintain, and improve the Service, including transcribing, clipping, captioning, and delivering your files.
  • To communicate about your account, billing (once enabled), security, and policy changes.
  • To enforce terms, prevent abuse, and comply with law, including copyright notices described in the draft Terms of Service.
  • To measure basic site or product performance, only with tools that have been disclosed in this policy.

We would not sell your personal information for money. We would not use your uploaded footage in public marketing without a separate, documented permission from you.

ATTORNEY REVIEW: “sale” / “sharing” definitions under CCPA/CPRA and similar state laws if ClipFit will have California or other covered-state consumers, and whether any analytics or advertising tool would require an opt-out. This draft does not claim CCPA or GDPR compliance.

4. Service providers, including Tally (now) and Stripe (later)

We would share personal information only:

  • With service providers that process data for us, as named below and with others we appoint to help operate the Service. Each provider has its own terms and privacy policy.
  • If you direct us to, for example by using an integration you connect.
  • For legal reasons, such as a valid legal request, to protect rights and safety, or in connection with a merger, sale, or reorganization, with appropriate safeguards.

Tally (now). Waitlist signups are collected through Tally (tally.so), including the embed and form at https://tally.so/r/kbezB6. Tally is a third-party form service and service provider / processor for waitlist submissions. Tally stores the information you submit (such as your name and email) so we can contact you about the beta. Tally’s own privacy policy also applies to data it processes.

Stripe (later). When paid billing is enabled, Stripe would be our payment processor and a service provider for subscription payments. Stripe is not enabled on the current site. We would not intend to store full card numbers on ClipFit servers. Stripe collects and processes payment information under its own privacy policy.

Hosting. The current public site is hosted on Cloudflare Pages. Cloudflare may process technical data (such as IP addresses and request logs) as a service provider to deliver the site.

Other providers still to be named. Cloud compute, storage, transcription, or email-delivery providers used to render clips or send service messages will be named here before they are placed into production. [PLACEHOLDER: rendering, storage, transcription, and email providers, if any, to be named before launch.]

ATTORNEY REVIEW: classify each vendor (Tally, Stripe, Cloudflare, and later processors) as a service provider / processor versus an independent controller, and put appropriate contracts in place. This draft names Tally and Stripe but does not itself create those contracts.

5. Retention

We would keep personal information only as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law. Intended categories and periods:

  • Waitlist records: PROPOSED, pending Owen’s sign-off kept until paid launch, or until you unsubscribe or ask us to remove you, whichever comes first. To leave the waitlist, reply to a waitlist email or write to [PLACEHOLDER: privacy contact email] and ask to be removed. After a verified removal request, we would delete the waitlist record, subject to the backup and legal-hold rules below.
  • Uploaded source files: PROPOSED, pending Owen’s sign-off deleted automatically when processing ends, whether processing succeeded or failed, and in any event no later than 24 hours after upload. Ordinary jobs are expected to finish in minutes, and source-file deletion would be logged.
  • Generated clips and download links: PROPOSED, pending Owen’s sign-off expire after 7 days, after which the files and links would no longer be available.
  • Account data (profile, login identifiers, subscription status, and related records, once accounts exist): PROPOSED, pending Owen’s sign-off kept for the life of the account and deleted within 30 days of account closure or a verified deletion request, except records we must keep (for example, payment and tax records, or a legal hold).
  • Payment and tax records: PROPOSED, pending Owen’s sign-off kept as long as required by law for tax, accounting, and dispute-resolution purposes. The specific number of years is not stated here.
  • Backups: PROPOSED, pending Owen’s sign-off residual copies in backups would roll off within 30 days after deletion from production systems.
  • Legal holds: we may keep information longer if needed for a valid legal request, dispute, security investigation, or copyright complaint.

The retention periods above are proposed defaults pending Owen’s sign-off. Do not publish them until they match what the product actually does.

ATTORNEY / ACCOUNTANT REVIEW: set the actual payment- and tax-record retention period (how long the law requires those records to be kept) before publication. This draft does not invent a number of years.

6. Security

We would use reasonable administrative and technical measures appropriate to a small software service (HTTPS, access control, and processor security features). No method of transmission or storage is completely secure. A final policy should describe actual measures in place at launch, not aspirations.

ATTORNEY REVIEW: replace aspirational security language with a description of measures actually in place at launch.

7. Your choices and how to request access or deletion

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information, to opt out of certain processing, or to appeal a denial.

To request access to or deletion of personal information, or to make another privacy request, email [PLACEHOLDER: privacy contact email] (or write to [PLACEHOLDER: mailing address]). Please say whether you are asking for access, correction, or deletion, and provide enough information for us to find your records (for example, the email address you used on the waitlist or account). We may need to verify your request before acting on it. PROPOSED, pending Owen’s sign-off After a verified deletion request, account data would be deleted within 30 days, except records we must keep, as described in Section 5. We will explain if we cannot fulfill a request in full because of a legal exception (for example, records we must keep for tax, security, or a pending dispute).

You may unsubscribe from non-essential emails using the link in those emails, or by contacting us. Essential service or billing messages may still be sent when you have an account.

PROPOSED, pending Owen’s sign-off To leave the waitlist, reply to a waitlist email or write to [PLACEHOLDER: privacy contact email] and ask to be removed. We would then stop using your waitlist email to contact you about launch, and would delete the waitlist record as Section 5 describes.

Because Tally currently stores waitlist submissions, and Stripe would later store payment information, you may also need to make a request to that provider for data it holds as an independent controller, if that is how counsel classifies the relationship. Start with a request to us at the contact above; we will tell you if you also need to contact a provider.

ATTORNEY REVIEW: intake, verification, and response timelines for access and deletion requests, and whether additional state-specific notices (for example, a “Notice at Collection” or appeal process) are required.

8. Cookies and analytics

This draft marketing site does not itself enable a separate analytics or advertising product (for example, it does not include a Google Analytics, Meta Pixel, or similar tag in the site files reviewed for this draft). The site and its host may still use cookies or similar storage that are needed to operate the page (for example, security, load balancing, or session state). The waitlist is embedded from Tally, and Tally may set cookies or similar storage under its own policy when you load or submit the form.

If we later add non-essential analytics or advertising cookies, we will name the tool in this policy before it is turned on and, where required, obtain consent first. We will not claim analytics practices that are not actually in use.

ATTORNEY REVIEW: cookie / tracking disclosures and consent if any non-essential analytics, advertising, or cross-context tracking is later added, and review of cookies set by the Tally embed and by Cloudflare.

9. Children’s privacy (COPPA and under-13)

The Service is not directed at children, and we do not knowingly collect personal information from children under 13. Under the Children’s Online Privacy Protection Act, 15 U.S.C. § 6501(1), a “child” is an individual under the age of 13. 15 U.S.C. § 6502 makes it unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under that section, which include providing notice and obtaining verifiable parental consent. Official text: https://uscode.house.gov/us/usc/119-124/t15/s6501/ and https://uscode.house.gov/us/usc/119-124/t15/s6502/.

ClipFit is also intended only for users who are at least 18, as stated in the draft Terms of Service. We do not knowingly collect personal information from anyone under 18. If you believe we have collected personal information from a child under 13, or from anyone under 18, contact [PLACEHOLDER: privacy contact email]. We will delete that information, except where a short legal retention is required, and will not condition use of the Service on collecting personal information from a child.

ATTORNEY REVIEW: age-gating and COPPA operational practices (including what to do if a user under 13 is discovered, and whether footage of children appearing in a customer’s fitness video creates separate obligations). This draft states that the Service is not directed at children and that we do not knowingly collect under-13 data; it is not a COPPA parental-consent program, because the Service is not intended to collect information from children.

10. Illinois BIPA (flag only — not a compliance claim)

Fitness video may include faces and voices. The Illinois Biometric Information Privacy Act, 740 ILCS 14, defines a “biometric identifier” to include a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and states that biometric identifiers do not include, among other things, photographs or physical descriptions such as height, weight, hair color, or eye color. “Biometric information” means information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual. Official text fetched from the Illinois General Assembly: https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57&Print=True.

If a private entity is in possession of biometric identifiers or biometric information, 740 ILCS 14/15 imposes, among other things, a public written retention policy, written notice, a written release, limits on sale and disclosure, and security duties. This draft does not claim that ClipFit collects or does not collect biometric identifiers, that photographs or ordinary video fall inside or outside BIPA, or that ClipFit complies with BIPA. Those are legal questions for counsel, especially if the product later performs face detection, face-geometry analysis, speaker identification, or similar processing on fitness video.

ATTORNEY REVIEW: Illinois BIPA (740 ILCS 14) as it may apply to fitness video that contains faces or voices, including transcription, clipping, or any later face- or voice-analysis feature. Do not add BIPA consent, retention, or “we do not collect biometrics” language until counsel advises on the actual pipeline. This section is a flag only.

11. International transfers and US-only launch

The operator is expected to be based in Illinois, in the United States. PROPOSED, pending Owen’s sign-off Paid launch of the Service is offered only in the United States. The Service is not offered to users in the European Economic Area or the United Kingdom at this time, and additional EEA/UK transfer mechanisms and privacy notices have not been added.

Information we do collect (including waitlist submissions and, later, account and payment data from U.S. users) may still be processed in the United States and in the countries where our providers (including Tally now, and Stripe later) operate.

ATTORNEY REVIEW: US-only paid launch, whether the current public waitlist should be limited so that EEA/UK personal information is not collected, and what international-transfer or privacy notices would be required if the Service is later offered outside the United States.

12. Changes to this policy

When this policy is adopted, we may update it from time to time. Material changes would be posted on this page with a new effective date and, where required, notice to users (for example, by email). The updated policy would apply going forward from that date. If we change how we use personal information in a material way, we will not apply the change retroactively without a lawful basis, subject to legal review.

13. Contact

To ask a privacy question, or to request access or deletion:

  • Operator: [PLACEHOLDER: legal entity name]
  • Mailing address: [PLACEHOLDER: mailing address]
  • Privacy email: [PLACEHOLDER: privacy contact email]

Until those placeholders are filled, this document is an internal draft only.

Official sources cited in this draft

The statutory descriptions above are based on official texts fetched for this review. They are not a complete statement of the law.

End of draft. Do not publish until legally reviewed and the placeholders above are filled in.