Security

Sign-in is handled entirely by Google Firebase Authentication (email/password or Google account). Your password is never transmitted to or stored on our servers.

Every API request that touches your data carries a short-lived identity token, and the server re-verifies that token cryptographically on every single call — the interface's checks are never trusted on their own.

Your full card number never leaves your browser. It is validated on your device (card type and checksum) and only the last 4 digits are transmitted, together with your ID document number.

This means a breach of our database could not expose a usable card number — we simply do not have it.

The database is deny-by-default: a signed-in user can read exactly one document — their own profile — and can write nothing directly.

Every write (plans, payments, cloud versions, usage) goes through the server, which authenticates the caller first. There is no path from a browser straight into the database.

Resolution, frame rate, watermark, formats, and quotas are applied on the server when a render is requested. Modifying the page or the client code cannot bypass them.

All traffic between your browser, our servers, and Firebase runs over HTTPS/TLS. There are no unencrypted endpoints.

Administrative access is restricted to an explicit allow-list of email addresses configured on the server. Every admin API call re-checks that list server-side — the admin dashboard is only a window onto those checks.

The optional local render worker runs on your own computer and receives exactly one thing: the generated scene code of your own project. It has no access to your files, installs no background services, and sends back only the finished video and progress updates.

Each account's data lives in its own documents — there is no query path from one user's session to another user's content.

Cloud versions are size-capped and limited to the newest 20 per account, which also bounds what could ever be exposed.

If you find a security issue, please email us with the details — we read every report and respond within 72 hours. Please do not test against other people's accounts; we can provide a test account on request.