Privacy Policy
Last updated: 2026-10-26 (Asia/Shanghai). Written for the preview deployment; update processor list when analytics or payments go live.
This policy describes how Faceless Video Script Generator (“we”) handles information when you use the website and script generator.
1. What we collect
- Form inputs: topic, optional audience, niche/platform/tone selections you submit to generate a script. Processed in memory to produce output.
- Rate-limit cookie:
fsg_runscounts free preview generations in your browser (typically 7 days). - Server-side IP counter: for abuse prevention we may store a short-lived count keyed by IP in process memory (preview). Production should use Redis/KV — documented in the project README.
- Technical logs: standard server/request logs (timestamps, status codes). We do not require an account for preview use.
2. Optional LLM processing
If the server operator configures LLM_API_KEY, your prompt may be sent to the configured provider (default: DeepSeek, or another OpenAI-compatible endpoint via LLM_BASE_URL) to improve script quality. That processing is governed by that provider's terms and privacy policy. Template mode keeps generation on the application server without calling a model API.
3. Analytics
Analytics are off by default. If NEXT_PUBLIC_GA_ID (Google Analytics 4) or NEXT_PUBLIC_PLAUSIBLE_DOMAIN is set, we may record product events such as generate, copy, download, and limit_hit. Configure those tools' cookie/consent banners as required by your jurisdiction before enabling in production.
4. Payments (future)
When credits or subscriptions launch, payment data will be handled by a processor such as Creem or Stripe — not stored as full card numbers on our servers. This section will name the processor and link their policy before checkout is enabled.
5. Cookies
Essential: fsg_runs for free-run counting. Analytics cookies only if GA4 (or similar) is enabled.
6. Retention & security
Prompt text is not intentionally stored as a long-term database in preview mode. Rate-limit state expires with the cookie window / IP bucket. Use HTTPS in production; rotate API keys; never expose secrets via NEXT_PUBLIC_*.
7. Your choices
Clear site cookies to reset the browser run counter. Contact us to ask about access or deletion requests once accounts exist. For EU/UK users we will add lawful-basis and DPA language before targeting those regions with ads or paid plans.
8. Contact
Privacy questions: contact@facelessscript.example · Contact page.