Privacy Policy

Squall Studio is operated by Skyrocket, Inc. ("we", "us"). This policy covers squallstudio.com and the services offered on it, including the AI story and video production tools and the video clipping service.

You can reach us at support@squallstudio.com with any question about this policy or about data we hold about you.

Account information. When you create an account we store your email address and a hashed password. If you sign in with Google, we receive your email address and basic profile details from Google; we never receive your Google password.

Service enquiries. When you submit the video clipping form we store the name and email you provide, plus the optional link and notes. We use these only to respond to your enquiry.

Content you provide. Story ideas, scripts, characters, locations, uploaded images and audio, and the video and audio generated from them are stored so the product can work and so you can return to your projects.

Payment information. Payments are processed by our payment processor. Card numbers are handled by the processor and never reach our servers; we store only a customer reference, your credit balance and your subscription status.

Usage data. We record page views and product events (for example, that a form was submitted) to understand how the site is used. These events carry the page path and do not include what you typed into a form.

YouTube. If you connect YouTube, we store an access token for your channel and the details of the videos you post. The YouTube section below explains how.

TikTok. If you connect TikTok, we store an access token for your account and the details of the videos you send to it. The TikTok section below explains how.

Instagram. If you connect Instagram, we store an access token for your account and the details of the Reels you post. The Instagram section below explains how.

To provide the product: generating scripts, images, audio and video from what you give us, and keeping your projects available to you.

To respond to enquiries, including video clipping requests and support messages.

To take payment, apply credits and manage subscriptions.

To keep the service secure and working, including diagnosing errors.

To understand aggregate usage so we can improve the product.

We do not sell your personal information, and we do not use your private projects to train our own models.

We use a small number of processors to run the service. Your data is shared with them only to the extent needed to do their job:

Cloud hosting provider — hosting, database and file storage.

AI model providers — generating text, images, video, music and sound effects from your stories, shot descriptions and reference images.

Payment processor — payments and subscriptions.

Analytics provider — product analytics.

Google — optional sign-in, and YouTube posting if you connect a channel.

TikTok — posting, if you connect an account.

Meta — Instagram posting, if you connect an account.

These providers process data in the United States. We may also disclose information where the law requires it.

To learn which companies provide the services listed here by type, write to support@squallstudio.com.

If you connect a YouTube channel, Squall Studio uses YouTube API Services to upload the episodes you choose to that channel and to show you which channel is connected. Google's handling of your data is described in the Google Privacy Policy.

When you connect, we store an access token for your channel, encrypted. We use it only when you click Post, to show your channel's name, and to check that the connection still works. We don't read, change or delete anything else on your channel, and we don't share the token.

For each video you post, we keep the title, description and visibility you chose, and YouTube's ID for the video so we can link to it. We delete YouTube's video ID 30 days after posting.

You can disconnect at any time in the posting dialog. That revokes our access and deletes the token and video IDs right away. You can also remove our access in your Google security settings; we then delete that data within 30 days. To ask us to delete your data, email support@squallstudio.com and we'll do it within 7 days.

Squall Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect a TikTok account, Squall Studio uses TikTok's developer services to send the episodes you choose to that account, either as a post or to your TikTok inbox as a draft, and to show you which account is connected.

When you connect, we store an access token for your account, encrypted. We use it only when you click Post, to show your account's name and posting options, and to check that the connection still works. We don't read, change or delete anything else on your account, and we don't share the token.

For each video you send, we keep the caption and settings you chose, and TikTok's ID for the post so we can link to it. We delete TikTok's post ID 30 days after posting. To send a video, we give TikTok a private link to the episode file that stops working within an hour.

You can disconnect at any time in the posting dialog. That revokes our access and deletes the token and post IDs right away. You can also remove our access in your TikTok app's settings, where it lists the apps connected to your account; we then delete that data within 30 days. To ask us to delete your data, email support@squallstudio.com and we'll do it within 7 days.

If you connect an Instagram professional account, Squall Studio uses Meta's Instagram API to post the episodes you choose to that account as Reels, and to show you which account is connected and how many more posts Instagram allows today.

When you connect, we store an access token for your account, encrypted, and your account's Instagram IDs, so we can act when Meta tells us you removed our access. We use the token only when you click Post, to show your account's name, and to keep the connection working (Instagram tokens must be renewed every 60 days). We don't read, change or delete anything else on your account, and we don't share the token.

For each Reel you post, we keep the caption and settings you chose, and Instagram's ID for the post so we can link to it. We delete Instagram's post ID 30 days after posting. To post a Reel, we give Instagram a private link to the episode file that stops working within an hour.

You can disconnect at any time in the posting dialog. That deletes the token, your account's IDs and the post IDs right away. To also remove Squall Studio from your Instagram account, open Instagram's Settings, then Website permissions, then Apps and websites; when you remove it there, Meta tells us and we delete the same data. To ask us to delete your data, email support@squallstudio.com and we'll do it within 7 days.

We protect sensitive data, including Google user data, with these safeguards.

Encryption in transit. The site is served only over HTTPS, and plain HTTP requests are redirected to HTTPS. Our servers reach Google, YouTube and our other providers only over encrypted connections.

Encryption at rest. Our cloud hosting provider encrypts our database and file storage at rest.

Google user data. From Google sign-in we keep only your Google account ID, email address and name. We use Google's sign-in token once, to read them, and don't keep it. To post to YouTube we ask Google for two permissions: uploading videos, and read-only access, which we use only to show which channel is connected.

Connected-account tokens. Before we store the token YouTube, TikTok or Instagram gives us, we encrypt it ourselves with AES-256-GCM, under a key kept in a secrets manager apart from the database. Each token is bound to your account, so a copy can't be used for anyone else's. We decrypt it only in our servers' memory: when you post, when we show which account is connected, and to keep the connection working. No page in Squall Studio shows it, and we don't share it.

Passwords and sign-in. We store passwords only as salted scrypt hashes, and API keys only as SHA-256 hashes, so neither can be read back. The cookie that keeps you signed in is sent only over HTTPS and can't be read by scripts on the page.

Files. Links to your uploaded and generated files are signed and stop working within an hour.

Access. Only authorized staff can reach our production systems and database.

Generating a script, image, voice or video sends the relevant parts of your project to the model providers listed above. Only what is needed for that generation is sent. We do not publish your projects, and projects are private to your account unless you are viewing the public demo project, which contains no customer data.

We keep your account and project data for as long as your account exists. Video clipping enquiries are kept while we are in contact with you and for a reasonable period afterwards. Ask us to delete your account or an enquiry and we will do it.

You can ask us to give you a copy of the personal data we hold about you, correct it, or delete it. Depending on where you live you may have further rights, including under the GDPR or the CCPA. We do not sell personal information, so there is nothing to opt out of on that front. Write to support@squallstudio.com and we will respond.

We set a session cookie so that you stay signed in. Our analytics provider sets cookies to measure usage. We do not run advertising cookies or third-party ad trackers.

The service is not directed at children under 13, and we do not knowingly collect their personal information.

If we change this policy we will update the effective date at the top of this page. Material changes will be announced in the product.