Privacy Policy

1. Who We Are

DrewUI ("we", "us", "our") operates the website at drewui.com, the DrewUI DCOMP desktop application for Windows, and DCUT with its DCUT Launcher (see Section 3). We are the data controller for personal data collected through these services.

If you have questions about this policy or wish to exercise your data rights, contact us using the details in Section 11.

2. Data We Collect

2.1 Account Data

When you create an account we collect:

• Email address
• Password (stored as a salted hash by Supabase — we never see it in plain text)
• Account creation timestamp

2.2 Alpha Application Data

If you apply for alpha access we additionally collect:

• First name and last name
• Discord username
• Content creation experience level
• Games you create content for (selected from a list)
• Optional social media profile URLs (TikTok, Instagram, YouTube, Twitch, other)
• A free-text description of why you want to join the alpha

2.3 Pricing Survey Data

Alpha testers are invited to complete a pricing survey. Responses include:

• Pricing expectations (numeric ranges in USD)
• Preferred pricing model (subscription vs. one-time)
• Free-text opinions about product capabilities and missing features

Survey responses are linked to your account via an internal user ID.

2.4 Discord Identity

If you choose to link your Discord account, we receive your Discord user ID via OAuth and store it in your profile to verify server membership and assign community roles.

2.5 Payment Data

Payment processing is handled entirely by our payment providers. New purchases are processed by Lemon Squeezy, which acts as the Merchant of Record and handles VAT/sales tax collection where required. Existing subscriptions originally created on Stripe continue to be billed and serviced by Stripe. We do not store full card numbers or CVVs. We receive and store:

• Your plan type (monthly / lifetime)
• Subscription status and expiry date
• The customer, subscription, and order identifiers issued by whichever payment provider processed your purchase (for managing your billing)

2.6 App Usage Data (DCOMP)

This section is about DCOMP. DCUT and the DCUT Launcher send no analytics; what they do send is in Section 3.

The DrewUI DCOMP desktop application communicates with our servers to validate your license — checking your subscription or alpha status when the application starts and verifying your session token.

Beginning with version 1.3.2, the desktop application also collects product usage events through PostHog so we can understand how DCOMP is used and prioritise improvements. Each event is tied to your Supabase account identifier (a UUID, not your email); your subscription tier and alpha/access status are associated with your analytics profile. The events we collect are:

• Session lifecycle — when the app is opened and closed.
• Workflow events — when a video is loaded, when a preset is applied (with the preset’s name and target game), when a project is saved or opened (with node count).
• Render telemetry — when a render starts, completes, or fails, along with technical properties such as codec, encoder, hardware encoder used, bitrate, resolution, frame rate, and whether audio was included.

What these events do NOT contain: your video content, file names, file paths, project or node-graph contents, mask geometry, keystrokes, screen activity, or browsing behaviour. All creative work stays entirely on your machine.

The lawful basis for this processing is our legitimate interest in understanding how DCOMP is used so we can improve it. You have the right to object at any time — email privacy@drewui.com and we will exclude your account from analytics capture and delete your existing analytics profile. An in-app opt-out toggle is in development.

2.7 Technical Data

Like all web services, our servers and Supabase automatically receive standard HTTP request data including your IP address and browser user-agent. This data is used for security and abuse prevention and is not used for behavioural advertising.

3. DCUT and the DCUT Launcher

DCUT is DrewUI's video editor for Windows. The DCUT Launcher signs you in, installs and updates DCUT, and starts it. This section says what each of them sends, what DrewUI keeps and for how long. The rest of this policy, including your rights in Section 8, applies to DCUT too.

3.1 What the DCUT Launcher sends

• Sign-in. Your email and password go to Supabase Auth, our authentication provider, over an encrypted connection, just as when you sign in on drewui.com. If you tick Remember me, the launcher keeps your sign-in on your PC, encrypted for your Windows user account.
• License checks. When the launcher starts DCUT, checks for updates or downloads a component, it sends a machine ID (a one-way SHA-256 hash of this PC's Windows ID, so the raw ID never leaves the PC), the DCUT and launcher versions, and the platform (windows-x64). Your account is identified by your sign-in.
• What we keep for each PC. With your account, DrewUI keeps one record per PC: the product (DCUT), the machine ID, when the PC was first seen and last seen, the DCUT and launcher versions and platform it last reported, and a launch count (how many times the launcher has checked in from it). We use it to enforce the computer limit (3 PCs; a PC stops counting 30 days after its last check) and to know which versions are in use.
• Launch ticket. The server answers with a signed launch ticket that names your account ID, your email, the machine ID and the DCUT version, and is valid for 7 days. The launcher stores it on your PC, encrypted for your Windows user account, so DCUT can start offline. Our license service writes a log line for each ticket it issues (your account ID, the DCUT version and the time).
• IP address. Like any web service, our servers and hosting provider see your IP address when the launcher connects. It is used for security and abuse prevention, appears only in standard server logs, and is not part of your license record.
• Downloads. DCUT, its updates, the speech-to-text runtime, the speech models and DrewUI Camera come from DrewUI's file storage (Supabase Storage) through links that expire after a short time. The storage service sees your IP address and which files you download. The Download button on your dashboard makes the same account check. Each time the launcher or the Download button (for DCUT or DCOMP) makes a download link, DrewUI records it with your account: the product, the version, whether the launcher or the dashboard asked for it, how many files it covers, and when it was made and when it expires. We use these records to limit how many links an account can get (10 an hour from the dashboard) and to trace a link that is passed on.

3.2 What DCUT itself sends

• Nothing about your editing. Your footage, projects, captions, presets and exports stay on your PC. Captions are made on your PC: your audio is not sent to DrewUI or anyone else.
• No analytics and no crash reports. DCUT sends no usage events (the analytics in Section 2.6 are DCOMP only) and no crash reports. If DCUT crashes, it writes a log file on your PC (%APPDATA%\DrewUI\DCOMP\data\dcomp-crash.log) holding the time, the error message, where in DCUT's code it happened, DCUT's version and a list of code addresses. It reaches us only if you send it yourself. The report from Help > About DCUT > Copy Report includes your email address, your graphics hardware and the last lines of DCUT's log, which can name your files and folders, so send it to us privately.
• Publishing, only to platforms you connect. If you connect YouTube, TikTok, Instagram or Buffer and publish from DCUT, the video and its title, description and other post details go straight from your PC to that platform, under that platform's own terms and privacy policy. The same applies to the Twitch link for stream markers. Your platform sign-ins stay on your PC; DrewUI never receives them or your videos. You can disconnect a platform in DCUT and revoke DCUT's access in that platform's account settings. DCUT's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• OBS link. When you turn it on, DCUT talks to OBS at the address you set, normally on your own PC or local network.
• Send to phone. Works only on your local network and only while a share is open. Files go straight from your PC to your phone; nothing passes through DrewUI's servers.

3.3 Where it is stored and for how long

License and computer records are stored with your account in Supabase (United States, AWS), like the rest of your account data. We keep each PC's record for as long as your account exists, so that the computer limit works; deleting your account deletes all of them. Download link records are kept the same way, for as long as your account exists, and are deleted with it. Server logs are kept for a limited time by our infrastructure providers (Section 6).

3.4 Having a PC removed

To have a PC removed from your account, for example to move DCUT to a new one sooner than 30 days, email getdrewui@gmail.com (or use the form in Section 11) from the email on your DrewUI account, and tell us roughly when you last used that PC. We delete its record, which frees its slot at once. If that PC runs DCUT again later, it is recorded again. Uninstalling DCUT does not delete the record by itself.

3.5 Why we process it

We process this data to provide DCUT under the license you accepted (contract performance), and to enforce the computer limit and prevent unlicensed use (legitimate interest). You can object under Section 8, but because the license check is how DCUT is licensed, DCUT cannot run without it.

4. Why We Collect It

5. Third-Party Services

We share data with the following sub-processors. Each has their own privacy policy and applicable data processing agreements:

We do not sell your personal data to third parties. We do not use your data for behavioural advertising.

Cookies & Local Storage

We use browser localStorage (not traditional HTTP cookies) to store your authentication session and your privacy consent choice. These are strictly necessary for the service to function and do not track you across other websites.

If you accept analytics in our consent banner, PostHog sets cookies and uses localStorage to measure product usage. These are not strictly necessary — they are only set after you opt in, and they are never set if you decline. PostHog traffic is routed through our own domain (a first-party proxy), and PostHog is configured to respect your browser's “Do Not Track” setting and the Global Privacy Control (GPC) signal — if your browser sends GPC, analytics stays off even if you accepted the banner. You can withdraw or change your consent at any time using the button below (or by clearing this site's browser storage); withdrawal stops analytics immediately.

When you initiate a checkout, Lemon Squeezy (and, for legacy customers, Stripe) may set their own cookies during the checkout flow. Refer to their respective privacy policies for details.

Manage cookie preferences

6. Data Retention

• Account data — retained for as long as your account exists. Deleted within 30 days of a verified erasure request.
• Alpha application data — retained for the duration of the alpha programme and up to 1 year thereafter for internal records.
• Pricing survey data — retained indefinitely in anonymised/aggregated form. Identifiable responses deleted upon account erasure request.
• Payment records — retained for 7 years to comply with financial record-keeping obligations.
• Technical logs — typically retained for 30–90 days by our infrastructure providers.
• DCUT computer records (see Section 3): retained for as long as your account exists, so the computer limit works. A single PC's record is deleted on request; all of them are deleted with your account.
• Download link records (see Section 3): retained for as long as your account exists, to enforce the download limit and trace a link that is passed on. All of them are deleted with your account.
• Product usage events — retained for as long as necessary for ongoing product analytics. Deleted on a verified erasure request (including deletion of the corresponding PostHog person record).

7. International Transfers

DrewUI is operated from the United States. All third-party sub-processors listed above are also based in the United States. If you are located in the European Economic Area (EEA) or United Kingdom, your data is transferred to the US under applicable transfer mechanisms (Standard Contractual Clauses or equivalent frameworks) maintained by each sub-processor.

8. Your Rights (GDPR / CCPA)

Depending on your location, you have the following rights regarding your personal data:

To exercise any of these rights, email us at privacy@drewui.com. We will respond within 30 days. We may need to verify your identity before acting on a request.

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with your local data protection authority (for EEA residents) or the UK Information Commissioner's Office (for UK residents).

CCPA (California Residents)

California residents have additional rights under the California Consumer Privacy Act, including the right to know, delete, and opt out of sale of personal information. We do not sell personal information. To exercise CCPA rights, contact us at privacy@drewui.com.

9. Children's Privacy

DrewUI DCOMP is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without parental consent, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Continued use of our services after changes constitutes acceptance of the updated policy.

11. Contact Us

Use the form below to submit a data rights request. You'll receive an automatic confirmation email, and we'll respond within 30 days.