Privacy Policy

This policy covers the phoenixtools.dev website, the Phoenix Clips web panel, the licence service behind the Auto-publish subscription, and the Phoenix Clips software you install on your own machine. The short version: almost everything stays on your computer, and the little we do keep is listed below, exactly.

Who is the data controller

The controller is the seller identified in the Seller details section at the bottom of this page. For anything in this policy, write to the email address listed there.

One exception: if you deploy the self-hosted Phoenix Clips service on your own infrastructure, you are the controller of the data that deployment processes. See Self-hosted deployments.

What we collect, and where it comes from

The website (phoenixtools.dev)

The website runs no analytics and no trackers — no Google Analytics, no advertising pixels, no fingerprinting. What remains:

• Hosting logs. The site is hosted on Vercel, which keeps standard server logs (IP address, user agent, requested URL) to operate the service.
• The services request form. If you submit the form on the Services page, the fields you fill in (name, email, project details) are delivered to us through Web3Forms, a form-delivery provider, and arrive in our support mailbox. We use them only to answer you.

The licence service

When you buy the Auto-publish subscription, our licence service (hosted on Railway) stores the minimum needed to run your subscription:

• Your licence record: the licence key, your Paddle subscription and customer identifiers, the subscription status, and the paid-period dates.
• Browser seats: an anonymous, randomly generated browser identifier for each browser you use the panel in, with first-seen and last-seen timestamps. This enforces the limit of 5 concurrent browsers per key; a browser not seen for 30 days stops counting and its record becomes inert. The identifier is not derived from your hardware and identifies nothing outside our own service.
• Webhook bookkeeping: identifiers of payment events already processed, so a retried delivery from Paddle is not applied twice.

We do not store your name, email, or address on the licence service. When we email your licence key after purchase, your email address and country are read from Paddle at the moment of sending and are not saved on our side.

Payments

Payments are handled entirely by Paddle.com Market Ltd as merchant of record. Paddle collects and stores your payment details, billing address, and invoices; we never see your card number. Paddle’s processing is governed by Paddle’s privacy policy.

The Phoenix Clips software on your machine

The local install keeps everything on your computer:

• your clips, captions, and publishing history live in a local library folder;
• platform access tokens (TikTok, Instagram, YouTube, Facebook, X) and your Anthropic API key are stored in the Windows Credential Store on your machine;
• media you publish is uploaded to your own storage bucket, configured with your own credentials — not to ours.

None of this passes through Phoenix Tools servers. The only network call the panel makes to us is licence validation: your licence key plus the anonymous browser identifier described above.

Data from the TikTok API

If you connect a TikTok account, the software requests exactly these scopes and uses them only as described:

• user.info.basic — your display name and avatar, shown in the panel so you can see which account is connected;
• video.publish — publishing a clip to your account, only when you explicitly trigger it;
• video.list — view, like, comment, and share counts of your own published videos, shown on the panel’s Analytics screen.

TikTok data is stored locally on your machine, refreshed periodically while the service runs, and deleted together with the installation. You can revoke the app’s access at any time in your TikTok settings under Settings and privacy → Security → Apps and services (this article is a courtesy pointer; the exact menu location is TikTok’s and may change); revoking invalidates the stored tokens immediately.

The same principle applies to the other platforms you connect: tokens are stored locally, used only to publish what you approved and to fetch the statistics of your own posts.

Self-hosted deployments

If you deploy the Phoenix Clips service to your own infrastructure instead of running the local installer, that deployment — its database, its storage, its platform tokens — runs under your accounts and your control. You are the data controller for it; this policy covers only what reaches the systems we operate, which for self-hosted deployments is licence validation and nothing else.

Legal basis

Under the GDPR we process:

• licence and subscription data to perform our contract with you (Art. 6(1)(b));
• the anonymous browser identifier out of legitimate interest in preventing licence sharing and fraud (Art. 6(1)(f)) — the least intrusive mechanism we found for it;
• form submissions to answer your request (Art. 6(1)(b), pre-contractual steps).

Subprocessors

Provider	What for	Where
Paddle.com Market Ltd	Payments, invoicing, tax (merchant of record)	UK / EU
Vercel Inc.	Website hosting	USA / EU edge
Railway Corp.	Licence service hosting	USA / EU region
Cloudflare, Inc.	DNS, content delivery, transactional email (licence key delivery)	USA / EU
Web3Forms	Delivery of the services request form	USA
Google LLC (Workspace)	Support mailbox	USA / EU

Retention

• Licence records are kept while your subscription or licence is valid, and afterwards as long as tax and accounting law requires.
• Browser-seat records stop counting toward the seat limit after 30 days of inactivity and are removed with the licence record.
• Form submissions are kept in the support mailbox as long as needed to handle the request and any follow-up.
• Everything stored on your own machine is yours: it is retained until you delete it or uninstall the software (the uninstaller asks whether to delete the library and saved credentials).

International transfers

Some subprocessors process data outside the EEA (notably in the USA). Where they do, transfers rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses, per each provider’s data-processing agreement.

Your rights

You have the right to access, correct, delete, and receive a copy of your personal data, to object to processing based on legitimate interest, and to lodge a complaint with a supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens). To exercise any of these, email the address in Seller details below; we respond within one month.

Note that most product data never reaches us — clips, captions, and platform tokens live on your machine, and deleting them is in your hands directly.

Cookies

The website sets no tracking cookies and no third-party cookies. Your theme and language preferences, and — in the Clips panel — your licence key and session, are kept in your browser’s local storage, which stays on your device and is sent to no one. Clearing your browser’s site data removes all of it.

Changes to this policy

If the policy changes, the new version is published at this address with an updated date above. Material changes to what we collect will be announced in the changelog before they take effect.