Draft — last updated 28 September 2026
Privacy Policy
Your videos stay on your Mac. When you use an AI or publishing feature, only the piece that feature needs is sent to our server and on to the provider that does the job. Our server does not keep your audio or transcripts, and a reel you publish is held only until it is posted (about 48 hours at the very most). Crash reports are only sent if you turn them on. Deleting your account deletes everything we hold about you.
Who we are. Lua is a Mac video editor made by an independent team based in India. Contact: support@trylua.com.
Governing law. This policy is governed by the laws of India. Disputes are handled by the courts of Bengaluru, Karnataka.
1. What stays on your Mac
Your footage, source files, projects, local b-roll library and the app’s working files never leave your Mac. Lua has no feature that uploads your raw footage. Nothing is sent anywhere unless you use a feature in section 2 that needs it.
2. What leaves your Mac, and why
| Data | Sent when | Goes to | How long it is kept |
|---|---|---|---|
| Email address, sign-in profile (Google), device id, app version, macOS version | You sign in; the app checks your account about once an hour | Supabase (sign-in and database) and the Lua server (hosted on Microsoft Azure) | For the life of your account |
| Audio extracted from your takes (audio only, never video), in pieces of up to 30 seconds | You run transcription or the raw cut | Lua server → ElevenLabs (speech-to-text) | Our server deletes the audio once it has the answer; ElevenLabs keeps it per its own policy |
| Transcript words, your edit, the project name | You use the AI chat, raw-cut story planning or b-roll planning | Lua server → an AI model provider (OpenAI, Anthropic or Google) | Not stored by our server; only billing details (credits charged, time) are kept |
| Still frames (images) of your cut | You use the AI chat’s frame check | Lua server → an AI model provider (OpenAI, Anthropic or Google) | Not stored by our server |
| Stills sampled from b-roll candidates (these can include b-roll you added yourself) and search phrases from your transcript | You run AI b-roll research | Lua server → OpenAI or Google (describing frames); short text checks → TypeSafe (Jev); searches → Firecrawl and Pexels | Not stored by our server |
| Web addresses fetched while researching b-roll | You run AI b-roll research | Downloaded directly by your Mac (YouTube and similar sites), not through our server | On your Mac only |
| Your finished export and its caption | You press Publish to Instagram | Temporary storage (Cloudflare R2) → Instagram, via Composio | Deleted after publishing; about 48 hours at the very most (daily cleanup). We keep only a fingerprint of the caption, to stop the same post going out twice |
| Your Instagram connection (the handle; login tokens are held by Composio, not by us) | You connect Instagram | Composio → Meta / Instagram | Until you disconnect |
| Scrubbed crash reports (no names, file paths, transcripts or log lines; full crash dumps are never sent) | Only if you turn crash reports on, when the app crashes | Sentry | Per Sentry’s retention |
We do not sell personal data. We do not use your footage, audio or transcripts for advertising or to train AI models.
3. Who processes your data
- Supabase — sign-in and the account database.
- Microsoft Azure — hosts the Lua server.
- Cloudflare R2 — temporary storage, for Instagram publishing only.
- ElevenLabs — speech-to-text.
- OpenAI, Anthropic, Google — AI models (chat, planning, describing frames); only the provider set up for the feature you use.
- TypeSafe (Jev), Firecrawl, Pexels — b-roll quality checks, search and stock footage.
- Composio, Meta — the Instagram connection and posting, only if you connect Instagram.
- Sentry — crash reports, only if you turn them on.
4. Credits and logs
AI and transcription use is measured in credits (1 credit = $0.01 of provider cost; new accounts get 500 free credits and 2 free videos). We keep your balance, what was charged, and a log of account events (sign-in, publishing, deletion). Publishing is rate-limited and logged.
5. Your rights and deleting your account
You can ask for a copy of what we hold, ask us to correct it, or delete your account. Deleting your account removes it together with your credit history, devices, pending posts and stored files, and disconnects Instagram. The event log is kept with your user id removed. Signing out ends your login on that Mac.
To delete your account, open the account menu in the Lua app and choose Delete account…, then type DELETE to confirm. Your projects and footage on your Mac are not touched — they were never on our servers.
Style learning (cloning your caption style from a reference reel) runs entirely on your Mac today: the reel you drop and its measurements are never uploaded.
6. Security
You sign in with Google or a 6-digit email code. Your session is stored encrypted on your Mac, protected by the macOS Keychain. The app cannot change balances, plans or settings in our database directly — only our server can. Export watermarks follow a signed entitlement, not a setting the app can edit.
7. Children
Lua is not meant for children under 13 (or the minimum age where you live), and we do not knowingly collect their data.
8. Changes
We will post changes to this policy here and, for important changes, in the app. Using Lua after a change takes effect means you accept it.
The short version of this page is What leaves your Mac.