Privacy policy

In short

Kesit is an editor that works on your video on your own device. Your video, audio and image files, your projects and the speech used for captions are never sent to any server, ours included. Our server only knows your account and your subscription.

What we never see

• The video, audio and image files you import.
• Your projects and the text in them. They live in your browser’s own storage (IndexedDB and OPFS).
• The audio processed for automatic captions. Speech becomes text with a model running on your device.
• The files you export.

What we keep

• Account: your email address and when the account was opened. If you sign in with Google, the name and profile picture link Google shares.
• Session: a single session cookie in your browser (see Cookies).
• Subscription: your plan, billing interval, period end and your customer number at the payment provider. Your card details never reach us.
• Problem reports: if you send one, your message, your email if you left it, and the browser details if you chose to attach them (version, video support, screen size).
• Refund requests: for which subscription, and when.
• Gift access: the plan granted to your account, start and end dates, and revocation date when applicable. This is separate from paid subscriptions. Administrative actions record the user and administrator identifiers, action time and reason; unnecessary personal details should not be entered in reasons.

Model files and third-party servers

Some features download a machine-learning model into your browser to work. Only the model file is requested; your video, audio and projects are not sent. The server providing the file does see your IP address and browser details, as with any web request.

• Automatic captions: the Whisper model is downloaded from Hugging Face (huggingface.co) and the ONNX Runtime that runs it from jsDelivr (cdn.jsdelivr.net) the first time; both are kept in your browser.
• Background removal and subject reframing: MediaPipe runtime files come from jsDelivr (cdn.jsdelivr.net) and model files from Google Cloud Storage (storage.googleapis.com).
• Stock videos (Media → Videos): your search words are sent from our server to the stock provider, Pexels (pexels.com) or Pixabay (pixabay.com), to find videos; your IP address is not passed on with them. Stills and previews are loaded by your browser straight from the provider (images.pexels.com, videos.pexels.com or cdn.pixabay.com), which sees your IP address. The video you add comes straight from Pexels, or from Pixabay through our server, which passes the file on without keeping it. It is then kept in your browser like any file you open.

Limiting problem reports against abuse

Anyone can send a problem report without an account, so each one passes a counter on Cloudflare first: at most 3 reports an hour from one connection and 500 a day in total. To count per connection, the server turns your IP address and the current day into an HMAC-SHA-256 value using a server-only secret and keeps only that value, the hour or day it belongs to, and a number. Your IP address, message and email are not written to this counter.

That value is a pseudonymous key, not an anonymous one: with the server secret, an IP address and the day, the same value can be computed again. Each counter entry has an end time (the end of its hour or day) and is deleted after it: by a scheduled clean-up and whenever the counter is next used. Delivery of the scheduled clean-up has not yet been checked on the live service, so we do not promise a fixed deletion time beyond this. Legal basis: legitimate interest in keeping the report form usable (KVKK art. 5/2-f).

Service providers

• Cloudflare: hosting of the site and the API, the database, and cookieless visit statistics.
• Polar: taking payments, invoices and subscription management (merchant of record). Card details are processed by Polar and its payment infrastructure.
• Resend: sending sign-in codes and notification emails.
• Google: only if you choose to sign in with Google.

These providers may run servers outside Türkiye. The KVKK notice has the details on transfers abroad.

How long we keep it

• Account details: until you delete your account.
• Subscription and invoice records: as long as tax and commercial law require.
• Problem reports: 12 months. Abuse counter entries: until the end of their hour or day, then deleted as described above.
• Gift records remain until account deletion. Administrative activity and retry-prevention records enter daily cleanup after 12 months. Account deletion removes gift rows and scrubs the relevant target action contents. Live scheduled cleanup has not yet been verified, so no exact deletion time is promised.
• Technical event records from the payment provider: 90 days.

Your rights

From your account page you can download your data as JSON, change your email and delete your account. For anything else, write to kvkk@kesitvideo.com. Your rights under Turkish law are set out in the KVKK notice.

Who is responsible

Kesit Video, Türkiye. Email: info@kesitvideo.com