Where your video goes.

Fovea turns a video into JSON. You send us a file and a schema, we send back data matching that schema. This page is about what happens to personal data along the way.

Fovea is operated by [LEGAL ENTITY NAME], of [REGISTERED ADDRESS]. For your account data we are the controller. For anything inside the videos and schemas you send us, you are the controller and we are your processor — we only touch that content to run the extraction you asked for.

Whether we need a UK or EU representative under Article 27 has not been decided: [REPRESENTATIVE — TO CONFIRM].

• The upload lands on our server’s local disk, in a RAM-backed tmpfs volume. It is never written to a durable disk and does not survive a restart of the container.
• We measure the duration server-side with ffprobe, from the file we actually received. A duration sent by a client is never trusted — it is the whole billing input.
• The file is uploaded to Google’s Gemini Files API and analysed by a Gemini model. This is the only place your video goes.
• The model’s answer is validated against your schema. A malformed shape is retried internally, and escalated to a larger model once. You never receive a partial or best-effort result.
• We delete Google’s copy through their API and our copy from disk. Both deletions sit in finally blocks, so they run on the failure path and on paths that failed in ways we did not anticipate.
• What remains is the job record: filename, MIME type, byte size, measured duration, the schema you sent, the JSON we returned, which model ran, and any error.

The complete list. Nothing else is kept anywhere.

• Account. Your email address, a scrypt hash of your password with a per-row salt, and when the account was created.
• Sessions. A SHA-256 of the token in your session cookie, and an expiry. The token itself is not stored, so a leaked database row cannot be replayed as a login.
• API keys. A name you choose, the leading non-secret prefix of the key, a SHA-256 of the key, when it was created, when it was last used, and when it was revoked. A key is shown once, at creation, and is unrecoverable afterwards — including by us.
• Jobs. Filename, MIME type, size in bytes, measured duration, billed seconds, the schema you sent and what it compiled to, any free-text instructions you added, the extracted JSON, which model ran and whether it escalated, how many attempts it took, error code and message, timestamps, which surface created it (web, API or MCP) and which API key.
• Minutes ledger. An append-only list of grants and debits, in seconds. Every debit names the job that caused it. Your balance is the sum of that list, never a stored counter.
• Top-up interest. If you press a price, we record which tier, where you pressed it, and your account or email address. Nothing is charged and no payment details are collected — see the terms.
• Waitlist and signup feedback. If you gave us an email address on the landing page: the address, which form captured it, and the HTTP Referer header your browser sent. If you answered the question after signing up: the option you picked, any free text you wrote, and whether you answered, skipped or closed the box.

We do not store your video after the job ends. We do not store your password. We do not store your API key. We hold no payment details of any kind, because no payments are taken at all right now. We do not log IP addresses or user-agent strings, and there is no analytics, no session recording and no advertising anywhere on this site.

Three companies. Named, with what each one gets.

• Google (Gemini API). Receives the video file, your schema and your instructions, and analyses them. This is the only third party that sees your video. We delete the file through Google’s Files API when the job ends. Nothing you send is used to train any model, ours or theirs; we use the paid API tier for that reason. [CONFIRM GEMINI API TERMS AND DPA IN FORCE AT LAUNCH]
• Hetzner Online GmbH. Hosts the server and the Postgres database, in Helsinki, Finland. That is where your account, your job records and your extracted JSON live.
• Cloudflare. DNS for fovea.run. It answers the question “what address is fovea.run”, so it sees that a lookup happened, not what you then sent. If the domain is later put behind Cloudflare’s proxy, Cloudflare would also terminate TLS and see request contents — this page will say so on the day that changes. [CONFIRM PROXY VS DNS-ONLY AT LAUNCH]

There is nobody else. No analytics provider, no error tracker, no email marketing platform, no support desk, no CDN in front of the application. We do not sell data and there is no arrangement under which anyone could buy it.

We would disclose data if a valid legal order compelled us to. We have not received one.

• Your video: for the length of the job. Usually a minute or two. Deleted on success and on failure.
• Job records, including the extracted JSON: until they are deleted. There is no automatic expiry, and no delete button in the product yet. That is a gap rather than a policy, and we are saying so instead of implying otherwise: today, deleting an extraction means emailing us. Deleting your account removes its jobs, ledger and API keys with it.
• Sessions: 30 days, then they expire. Signing out removes the row immediately.
• Waitlist and top-up interest: until you ask us to remove them.

Under the UK and EU GDPR, our bases are:

• Performance of a contract — your account, running your jobs, keeping the ledger that tracks your minutes.
• Legitimate interests — hashing credentials and keeping session records, so accounts can be kept secure; recording which top-up tier people press, so we can decide whether to build payments; keeping signup feedback, so we can decide what to build next. In each case the data is minimal and the alternative is guessing.
• Consent — the email address you type into the landing page form. Withdraw it at any time and we delete the row.

For personal data inside your videos we act only on your instructions, and our basis is the one you rely on. Having the right to send us that footage is your responsibility, not ours — see the terms.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask for it in a portable form, object to a use of it, or ask us to restrict processing. Those are rights under the GDPR and we will honour them whether or not the GDPR applies to you.

To use any of them, email [CONTACT EMAIL]. There is no self-service export or account-deletion button yet, so this is a human process: we will answer within 30 days and normally much sooner. We will not charge for it and we will not ask why.

If you think we have handled your data badly, you can complain to your data protection authority. Tell us first if you are willing — it is faster, and we would rather fix it.

One cookie: fovea_session. It holds a random token, is httpOnly and sameSite=lax, and lasts 30 days. It is what keeps you signed in. Nothing else is stored in your browser — no analytics cookie, no third-party cookie, no tracking pixel, no local storage.

There is no cookie banner because there is nothing to consent to. The one cookie we set is strictly necessary to log you in, and you cannot have an account without it.

• Everything travels over HTTPS. There is no plaintext endpoint.
• Passwords are scrypt hashes with a per-row salt, stored so the parameters travel with the hash and can be raised later.
• Session tokens and API keys are stored only as SHA-256 digests. The plaintext of either exists exactly once, in your hands.
• Videos are held in a RAM-backed tmpfs volume, so a crash cannot leave one behind on a disk and a restart clears the mount.
• The database is not reachable from the public internet and no client code talks to it. Every read and write goes through our own API.

The honest limit: this is a new and very small operation. There is no SOC 2 report, no penetration test, no security team and no 24-hour on-call. If that matters for what you were about to upload, let it decide.

Our server and database are in Helsinki, Finland, inside the EU, with Hetzner Online GmbH. Your account and your extracted JSON do not leave that machine.

Your video does. It goes to Google’s Gemini API to be analysed, and Google may process it outside the EEA and the UK, including in the United States. Transfers rest on Google’s standard contractual clauses and its certification under the EU–US Data Privacy Framework. [CONFIRM DPA AND TRANSFER MECHANISM BEFORE LAUNCH]

Fovea is a developer tool and is not aimed at children. Do not create an account if you are under 16. We do not knowingly hold data about children, and if you think we do, email us and it will be deleted.

A video you upload is a different question. If children appear in your footage, you are the controller of that material and it is on you to have a basis for sending it.

The product is young and this page will change with it. The date at the top is the version marker.

If a change materially reduces protection — a longer retention period, a new subprocessor that receives your video, anything that would make you reconsider what you upload — we will say so plainly at the top of this page rather than quietly reissuing it.

Email [CONTACT EMAIL]. A person answers. Data requests, complaints and “what exactly do you have on me” all go to the same address.