Privacy policy

Brag Studio is operated by Synosonic OÜ, an Estonian company. Last updated October 9, 2026. Brag Studio uses your account information and product brief to create the films you request.

What we collect

We store your email, sign-in provider identifiers, hashed password when applicable, product briefs, job history, credit records and generated files. We keep bounded security records to limit abuse. Passwords are hashed. Google and ChatGPT sign-in supplies the account identity you authorize; we don’t receive your provider password.

When you use our contact form, we store your name, reply email, selected topic and message to handle your request. Messages are retained in our private support inbox for up to 90 days and are forwarded to our private Telegram support chat through the Telegram Bot API. Correspondence needed for legal obligations or an ongoing dispute may be retained longer.

For service operations, new account and video submission details are also sent to our private Telegram operator chat through the Telegram Bot API. These alerts contain account email, verification and plan status, credits, job settings and your submitted product brief. Previously permitted coarse device/country and campaign context may be included when available. Passwords, authentication tokens, IP addresses, payment credentials and private storage links are excluded. Queued alert payloads expire after seven days and are cleared after delivery; minimal delivery records expire after 90 days. Telegram chat copies have separate retention and can be included in an erasure request through the contact form.

Service email and feedback

When service email is enabled, our email delivery provider receives your verified account email to notify you that a requested video is ready. Notifications link to the studio and require sign-in; videos are not attached. We store delivery status and retry identifiers to operate this service. These are transactional messages, separate from optional analytics or marketing subscriptions. Optional first-film feedback and your comments are stored privately for product improvement; avoid sensitive information in comments. You can request removal through the contact form.

AI and payment providers

Your product brief and imported website text are sent to OpenAI for generation. When an approved ChatGPT plan connection is available, eligible AI requests use the plan you authorize. OAuth credentials are encrypted on the server and are never placed in browser storage or video containers. Stripe processes payments; Brag Studio does not store your card number. Oracle hosts our application servers. Backblaze B2 stores completed videos and encrypted backups when cloud storage is enabled. Google Fonts may receive connection information when fonts load.

Your ChatGPT connection

Sign-in permission and plan-usage permission are separate. A plan connection does not grant access to your ChatGPT conversations or API keys. You can disconnect the plan from account settings or manage access in ChatGPT settings.

Storage and retention

Generated files are available to download for 30 days from the generation request; download anything you want to keep. Private recovery versions may remain in storage for up to about 66 days, and encrypted database backups for up to about 36 days, subject to storage lifecycle processing. Account information, briefs and credit history are retained to provide the service and handle support. Financial records may be retained for legal obligations. Contact Synosonic for access, correction or account removal requests.

Cookies

We use secure account and short-lived sign-in cookies. Temporary product drafts stay in your browser session only while you complete provider sign-in. They contain no passwords or OAuth tokens.

Analytics preferences

For visitors identified as being in the EU, analytics starts after you accept. For visitors identified outside the EU, limited analytics is on by default; you can turn it off through “Analytics settings” in the footer. If your region is unknown, we ask before enabling analytics. Cloudflare estimates the country from your connection and supplies a country-only header. We use it to choose the preference flow. When analytics is permitted, events include the country estimate and coarse device type, browser and operating system. We do not send your IP address, raw browser user agent, city or precise location to PostHog. Later product events may use the last known permitted browser context. VPNs and network changes can affect this estimate.

PostHog Cloud US receives visits and selected product events, such as sign-in, completed generations, downloads requested and subscription payments. Events use a site-specific pseudonymous identifier. We exclude emails, form content, product briefs, submitted website URLs, card details and authentication tokens. PostHog IP geolocation and automatic click capture are disabled. When analytics is permitted, PostHog also receives masked session replays of supported pages to help us find usability problems. Public page text and interface labels are visible in replays. Form values, private customer text (including film names and credit balances), customer media and sensitive attributes are hidden before capture. Page URLs lose query strings and fragments. Account and admin pages are excluded. We do not record console logs, network headers or bodies, canvas pixels or third-party frames. Recordings travel through our server without your raw IP address or private provider credentials. Our selected PostHog project is hosted in the United States. EU analytics uses your consent; default analytics outside the EU supports our legitimate interest in improving the service and measuring acquisition, with your right to object. Analytics is optional everywhere; turning it off does not affect your account, purchases or films.

Your browser remembers preferences for up to 180 days. A secure analytics cookie links permitted events on this site. Existing rejections and Global Privacy Control remain respected. You can change your choice through “Analytics settings”; withdrawal stops future event and replay collection and removes unsent account events. Previously delivered events may remain in PostHog for up to one year on our launch plan; use the contact form for an erasure request. Preference records, minimal delivery identifiers and unsent events are held privately; unsent events expire after seven days. Visits excluded by your choice or regional rule are absent from analytics reports. Account, credit and financial records needed to provide the service remain separate from analytics.

Purposes, rights and international processing

Synosonic OÜ is the controller of account and service information. We process it to perform our contract with you, meet legal obligations, and protect the service under our legitimate interests. Providers may process information outside the EEA; appropriate contractual safeguards apply where required. Do not submit sensitive or confidential information in a public product brief.

Where applicable, you may request access, correction, erasure, restriction, portability or object to processing. Send requests through our contact form. You may complain to the Estonian Data Protection Inspectorate or your local supervisory authority. The service is intended for adults.