Who We Are

Vidlet is operated by Spark Games Ltd, a company registered in England and Wales (company no. 15379140). Spark Games Ltd is the data controller for the personal information described in this policy.

The Short Version

Every editing tool runs in your browser and your video file is never uploaded. The optional AI features are the exception: they need a server, so they send the audio or the text taken from your clip, never the video itself. The rest of this page spells out exactly which is which.

What Runs On Your Machine

Anything that changes your video runs in your browser through WebAssembly (FFmpeg.wasm). That covers compressing, trimming, slicing, cropping to portrait, converting to GIF, burning in subtitles, extracting or adjusting audio, format conversion, thumbnails, filters and voice cleanup.

Your video file is never uploaded for any of these
They work with no account and no sign-in
Files are processed in memory and never reach us
We cannot view, retrieve or analyse the videos you edit this way

What The AI Features Send Us

Some features cannot run locally in a browser. Auto-edit, AI subtitles, highlight detection, caption cleanup, transcript formatting, b-roll suggestions and A/B caption variants all call our server, which passes the request to Groq, our AI processor. Here is what leaves your machine:

Transcription: the audio track extracted from your clip, up to 25MB. The video itself stays in your browser.
Everything else: the transcript or captions produced from that audio, as text.

These features require signing in, and metering their usage is the only reason accounts exist at all.

Caching Of AI Results

AI responses are cached for up to 24 hours, keyed on a hash of the exact input, so transcribing the same clip twice does not run twice. The cache holds text derived from your audio, meaning transcripts and captions. It never holds video or audio files. If you self-host, set AI_CACHE_DISABLED=1 to turn it off.

Accounts

Signing in uses Google. Sessions are JSON Web Tokens and there is no database and no user table, so the only personal data we hold is the email address inside your session token, used to identify calls to the AI routes and count usage against your quota. Sign out and that token is gone.

Optional Integrations

YouTube upload: covered in full below.
Stock media search: searching for stock footage or music sends your search term to Pixabay. Your video is not involved.
Support chat: every page loads a chat widget from sparkbrain.app. It receives whatever you type into it.

YouTube publishing

Publishing is optional and off until you connect a channel. Vidlet uses YouTube API Services to do it, so by connecting you also agree to the YouTube Terms of Service, and Google's handling of your data is governed by the Google Privacy Policy.

What we ask Google for, and why:

Upload videos — to publish the file you chose to your own channel. Nothing is uploaded until you press Publish.
View your channel — to show you which channel you are about to publish to, so you cannot post to the wrong one.
Manage your videos — requested only by the Vidlet MCP server, only to run a title and thumbnail A/B test on a video Vidlet itself uploaded, and only when you ask for one. The website never asks for this permission.
Your name and email address — to check your Vidlet plan covers publishing.

Where the connection lives. Connecting stores a Google refresh token: in the browser it is encrypted into a cookie on your own device, and in the MCP server it is a file on your own machine. Either way it is not kept in any database of ours. It is sent to vidlet.app only to exchange it for a one-hour access token, which the exchange needs because the client secret cannot live on your device.

Where your video goes. Straight from your device to Google's upload endpoint. It does not pass through vidlet.app, and we never hold a copy. We read no other channel and no video Vidlet did not upload, and we ask for no playlist, comment, analytics or partner permissions.

How to disconnect. “Disconnect” in the publish dialog forgets the connection on that device. To revoke Vidlet's access at Google outright, use the Google security settings page.

What We Never Do

Sell or rent your personal data
Run third-party advertising
Use tracking or advertising cookies
Upload, store or retain your video files

Signing in sets a session cookie. It keeps you logged in and does nothing else.

Your Rights

Under UK GDPR you can ask what we hold about you, ask for it to be corrected or deleted, and complain to the Information Commissioner's Office. In practice the only personal data we hold is the email in your session token, so signing out and revoking Vidlet in your Google account settings clears it. Contact us using the link below for anything else.

Local version (MCP)

The Vidlet MCP server (npm i -g @spark-apps/vidlet), used from Claude Desktop, runs entirely on your local machine. Auto-captions use whisper.cpp locally, so your audio is never sent to any cloud service. This is the one place transcription really is fully offline.

How to verify this

Vidlet is not open source, so take none of this on trust: open your browser's network tab while you edit. Every tool except the optional AI features runs locally, and you will see no request carrying your video.

Contact

For privacy-related questions, email support@vidlet.app or ask in our Discord.