Privacy Policy
Effective date: August 29, 2026
This policy explains what Final Form Studios ("we", "us") collects when you use Final Vision ("the Service"), why, and what stays entirely on your machine. The short version: your creative work lives in your browser, and the usage data we collect during alpha is collected only with your explicit consent. When you generate, the prompt for that one generation is sent to our server so we can run it for you — see section 1 for exactly what that includes and what it does not.
1. What stays on your machine
- Your projects — scripts, characters, storyboards, images, edits — are stored locally in your browser (localStorage and IndexedDB) and in files you export. We do not upload your project to our servers.
- Provider API keys. The Service no longer asks for or accepts your own OpenAI, Anthropic or WaveSpeed key. If you saved one in an earlier version it stays in your browser, goes directly to that provider, and is never sent to us — we have never received, stored, or used it. Saved keys are masked out of session recordings.
What leaves your machine when you generate. Generation runs on our servers, so this is the part that does not stay local. For each request:
- the prompt and settings you generated with are sent to our server and passed to the AI provider using our API key;
- any images you attached to that generation are sent too and stored so the request can run — reference images for a character or location, and the storyboard frames a video is animated from;
- the resulting image or video is stored in our storage so we can deliver it to you, and we keep a record of the request (who, when, how many credits, and whether it succeeded) because it is a paid transaction we may need to reconcile or refund;
- we do not send your project, your other characters, or anything you did not include in that generation.
Nothing else is transmitted. Writing, editing, planning and export do not leave your browser at all — only an actual generation does.
2. What we collect
| Data | Where it lives | Why |
|---|---|---|
| Account data: email address, name, hashed password | Supabase (our authentication provider) | To create and secure your login |
| Payment data: name, email, card details | Stripe (payment processor) — we never see full card numbers | To process subscriptions |
| Product analytics: feature usage events, page views | PostHog (analytics provider) | To understand which features help and which confuse |
| Session recordings during alpha (screen activity, clicks, navigation inside the app), only after you consent at signup or login | PostHog | To see where filmmakers get stuck and improve the product |
Analytics events are limited to product metadata (which feature, success/failure flags). We do not send your script text, character data, generated images, or provider keys to analytics. Password fields are always masked and login pages are excluded from replay.
3. Session recording consent
Session replay runs only during early access and only after you tick the monitoring-consent checkbox. If that ever changes, this policy and the consent wording will change with it. To withdraw consent, contact us and stop using the Service while we remove your recordings.
4. Third parties we rely on
- Vercel — hosting, and cookieless web analytics (visit and page-view counts only). It sets no cookies and does not track you across other sites.
- Supabase — account authentication.
- Stripe — payments and subscription management.
- PostHog — product analytics and consented session replay.
- OpenAI / Anthropic / WaveSpeed — AI generation. We call them on your behalf using our own key, and your prompt is processed under their terms as well as ours. If you saved your own provider key in an earlier version of the Service, those calls go directly from your browser to the provider and are billed to you by them.
- YouTube (no-cookie embed) — the promo video on our landing page loads only if you press play.
- Google Fonts — typefaces on our public pages.
We don't sell your data, and we don't run third-party advertising trackers.
5. Retention
- Account data is kept while your account exists.
- Session recordings and analytics are kept only as long as needed for product research during alpha.
- Local project data is under your control — it persists in your browser until you clear it, and in any files you've exported.
- Images generated with credits are kept in our storage so you can retrieve them. We do not delete them on a schedule — they stay until you delete them or close your account, and deleting your account deletes them. Email us and we'll remove stored images associated with your account.
- The transaction record for each credit generation (request id, credits, status, timestamps) is retained separately as a financial record, for as long as we're required to keep billing records — including after the image itself is deleted.
6. Your rights
You can ask us at any time to access, correct, or delete the personal data we hold about you (account data, analytics tied to you, recordings). Email adroitcreativestudios@gmail.com and we'll act on it promptly. Deleting your account does not touch the projects stored on your own machine.
7. Children
The Service is not directed at children under 16, and we do not knowingly collect their data.
8. Changes
If we change this policy in a material way, we'll notify account holders by email or in-product notice before the change takes effect.
9. Contact
Privacy questions: adroitcreativestudios@gmail.com.