Privacy Policy — Hookova

1. Who we are

Hookova ("Hookova", "we", "us") operates the Hookova hook analyzer. For data-protection purposes we are the controller of the personal data described below. You can reach us at petazfeng@gmail.com.

2. What we collect

We collect only what the service needs to work:

Account data — your email address, and, if you sign in with Google, the name and profile picture Google returns. If you register with a password we store a bcrypt hash of it, never the password itself.
Content you submit — the video URLs you paste into the analyzer, plus any title or notes attached to a run.
Data derived from your runs — extracted keyframes, the audio transcript, and the AI-generated storyboard and report for each analysis.
Billing data — your plan, subscription status, credit balance, and the customer/subscription identifiers Stripe gives us. Card numbers are handled entirely by Stripe; we never see or store them.
Technical data — IP address, browser user agent, and timestamps in our server and error logs, kept for security and debugging.

We do not run advertising or analytics trackers, and we do not buy personal data from third parties.

3. How we use it

To run the analyses you request and show you the resulting reports.
To create and secure your account, and to keep you signed in.
To meter credits, take subscription payments, and prevent abuse of the free tier.
To diagnose failures — downloads and AI calls fail often enough that logs are how we fix them.
To email you about your account or material changes to the service (we do not send marketing email).
To comply with legal obligations, such as tax and accounting rules.

4. Our legal bases (UK/EU)

Where the UK GDPR or EU GDPR applies, we rely on: performance of a contract (running analyses, managing your account and subscription); our legitimate interests (keeping the service secure, preventing abuse, improving reliability); and legal obligation (financial records). Where we ever rely on consent, you can withdraw it at any time.

5. Who we share it with

We do not sell your personal data. We share it only with the service providers that make the product work, each acting on our instructions:

Anthropic — the multimodal model that produces the storyboard receives your keyframes and transcript.
OpenAI — Whisper receives the extracted audio for transcription.
Apify and RapidAPI — receive the video URL you submitted in order to fetch the source video.
Cloudflare R2 — stores the keyframes shown in your report.
Stripe — processes payments and subscription management.
Our hosting and database providers — run the web app, the job queue, and the worker.

We may also disclose data if legally required, or to establish, exercise, or defend legal claims.

6. International transfers

Some of the providers above process data in the United States and other countries outside the UK/EEA. Where that happens we rely on the providers' standard contractual clauses or an adequacy decision to protect your data.

7. How long we keep it

Source video files — deleted from our server as soon as keyframes and audio have been extracted, usually within a couple of minutes. We never keep a copy of the video.
Keyframes, transcripts and reports — kept while your account is open, so you can revisit a report. Delete a report and its stored data goes with it.
Account and billing records — kept while your account is open. After you close it we delete your account data within 30 days, except records we must retain for tax and accounting purposes.
Server logs — retained for a short period for security and debugging, then rotated out.

8. Your rights

Depending on where you live, you have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. Email us at petazfeng@gmail.com and we will respond within one month. You can also delete individual reports yourself at any time from your library.

If you are in the UK or EEA and think we have handled your data badly, you can complain to your local supervisory authority — but please contact us first so we can try to put it right.

9. California residents

We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not process sensitive personal information for purposes requiring a right to limit. California residents may exercise their rights to know, delete, correct, and to non-discrimination by emailing petazfeng@gmail.com.

10. Security

All traffic is served over TLS. Passwords are hashed with bcrypt. Access to production data is limited to the people who operate the service. No system is perfectly secure, so if you believe your account has been compromised, contact us immediately.

11. Children

Hookova is not intended for children under 13 (or under 16 where local law sets that threshold). We do not knowingly collect data from them. If you believe a child has created an account, tell us and we will delete it.

12. Changes to this policy

If we change this policy materially, we will update the date at the top of this page and, where the change affects you meaningfully, notify you in the app or by email.

13. Contact

Questions about privacy: petazfeng@gmail.com.

2. What we collect

We collect only what the service needs to work:

Account data — your email address, and, if you sign in with Google, the name and profile picture Google returns. If you register with a password we store a bcrypt hash of it, never the password itself.

Content you submit — the video URLs you paste into the analyzer, plus any title or notes attached to a run.

Data derived from your runs — extracted keyframes, the audio transcript, and the AI-generated storyboard and report for each analysis.

Billing data — your plan, subscription status, credit balance, and the customer/subscription identifiers Stripe gives us. Card numbers are handled entirely by Stripe; we never see or store them.

Technical data — IP address, browser user agent, and timestamps in our server and error logs, kept for security and debugging.

We do not run advertising or analytics trackers, and we do not buy personal data from third parties.

3. How we use it

To run the analyses you request and show you the resulting reports.

To create and secure your account, and to keep you signed in.

To meter credits, take subscription payments, and prevent abuse of the free tier.

To diagnose failures — downloads and AI calls fail often enough that logs are how we fix them.

To email you about your account or material changes to the service (we do not send marketing email).

To comply with legal obligations, such as tax and accounting rules.

4. Our legal bases (UK/EU)

5. Who we share it with

We do not sell your personal data. We share it only with the service providers that make the product work, each acting on our instructions:

Anthropic — the multimodal model that produces the storyboard receives your keyframes and transcript.

OpenAI — Whisper receives the extracted audio for transcription.

Apify and RapidAPI — receive the video URL you submitted in order to fetch the source video.

Cloudflare R2 — stores the keyframes shown in your report.

Stripe — processes payments and subscription management.

Our hosting and database providers — run the web app, the job queue, and the worker.

We may also disclose data if legally required, or to establish, exercise, or defend legal claims.

7. How long we keep it

Source video files — deleted from our server as soon as keyframes and audio have been extracted, usually within a couple of minutes. We never keep a copy of the video.

Keyframes, transcripts and reports — kept while your account is open, so you can revisit a report. Delete a report and its stored data goes with it.

Account and billing records — kept while your account is open. After you close it we delete your account data within 30 days, except records we must retain for tax and accounting purposes.

Server logs — retained for a short period for security and debugging, then rotated out.

8. Your rights

If you are in the UK or EEA and think we have handled your data badly, you can complain to your local supervisory authority — but please contact us first so we can try to put it right.

9. California residents