Privacy Policy
Last updated 4 October 2026
Keyframes is operated by Maximum Ventures LLC (Florida, United States). It is film production software, and this page explains what it stores, who else sees it, how long it is kept, and what you can ask us to do about it. It covers the app at app.keyframes.mov and this marketing site at keyframes.mov.
Two different kinds of data
The distinction matters for everything below. Your account data is data about you as a customer — we decide what to collect and why, so we are the controller of it. Your production data is the work you do in the app: scripts, breakdowns, budgets, schedules, and the contact details of the cast and crew you enter. For that, you decide what to put in and why; we hold and process it on your behalf.
That second point is not a technicality in a film tool. When you add a gaffer’s phone number to a contact record, or a performer’s day rate to a budget line, you are the one responsible for having a reason to hold it and for telling them you do. We keep it for you and hand it back or delete it when you say so.
What we store
Your account
- Your name, email address, and profile picture if you upload one.
- Sign-in sessions, each recording the IP address and browser user-agent they were created from. This is how "sign out of other devices" works and how an unrecognised sign-in can be spotted.
- Your interface preferences — theme, panel widths, default views.
- If you apply for the student plan: the .edu address you verified, whether verification succeeded, and when. The one-time code itself is deleted after use or expiry.
Your productions
- Screenplays, as a live collaborative document plus the snapshots and revision history that let you go back.
- Everything derived from or attached to them: scenes, elements, shots, setups, beats, mood boards, locations, schedules, budgets, call sheets and tasks.
- Contacts you add — name, and optionally phone, email, department, role, agent details, union, day rate and notes.
- Files you upload: images, PDFs, attachments and any generated documents.
- An activity log of every change made to a record: who made it, when, what changed, and whether it was made by a person or proposed by Key and accepted by a person.
If you apply to be a Campus Ambassador
The application form collects your name, email, school, program and the answers you write, plus a short video you upload. We use the video and your answers only to review your application.
- If you're not selected, or you withdraw, we delete the video: within 90 days of the wave closing, or right away if you withdraw. Your written answers are deleted within 12 months of the wave closing.
- If you're selected, we keep the video and your answers until your term ends.
- You can ask us to delete your application sooner at any time, at the email address below.
- We also log the IP address an application or an upload came from, to stop automated abuse. We clear those within 30 days.
If you become an Ambassador, a public badge page shows your name, school, title and term. You can hide it from your own portal at any time.
The demo
If you try the demo without signing in, we create a temporary guest account with no name or email address attached, along with the demo production you work in. Both are deleted after 3 days without a visit, or 7 days after you started, whichever comes first. To stop anyone starting demos in bulk, we also count how many each IP address starts in a day, and we delete those counts after two days.
This website
If you join the beta waitlist we store your email address, the country your request came from, the page that referred you, your browser user-agent and the time — nothing else. There are no advertising cookies, no analytics scripts and no tracking pixels on this site.
Cookies
The app sets one cookie: your sign-in session, which is also how the demo remembers your guest account. It is strictly necessary — without it you cannot stay logged in. Your theme and layout preferences are kept in your browser’s local storage, not sent anywhere. We do not use advertising or analytics cookies on either the app or this site — the product-usage analytics described below runs from our own servers, with no analytics script in your browser and no cookie of its own.
Product analytics
We use PostHog to see which parts of the app get used, so we know what to improve. It never receives your name, email, script text, scene content, contact or budget details, Key prompts or responses, or any page URL with a query string — only your internal account id, your organization and production ids, and which screen or action you used. This is pseudonymous, not anonymous: those ids let us re-identify the activity from our own database if we ever need to, they just never carry a name, an email or any content on their own. We never record your screen, never capture what you click or type, and never run surveys. Your IP address is discarded before it reaches PostHog. You can turn this off from Settings → Privacy → “Share usage data”. Nothing changes for you in the app either way. The setting is cached for up to a minute, so turning it off can take that long to apply everywhere. If you delete your account, we also try to delete your PostHog profile at the same time. If that doesn't happen automatically, email us at the address below and we'll remove it by hand. Nothing is sent to PostHog while you're using the demo.
Who else sees it
We do not sell data and we do not share it for advertising. We use the following processors, and only what each one needs:
| Service | What it receives |
|---|---|
| Railway | Hosting and the database. Everything the app stores lives here. |
| Cloudflare (R2, Pages, D1) | Uploaded files; this marketing site; the waitlist. |
| Resend | Email delivery: sign-in links, invitations, student verification codes, call sheets you send (including the PDF attached to them), and Campus Ambassador program email, including application updates and the monthly recap if you opt into it. |
| Cloudflare Workers AI | When you use Key or an AI suggestion, see below for what is sent. If you're a Campus Ambassador, we also use it to read the posts and evidence you log for your monthly activity. A plain-code check looks for the required disclosure line automatically; staff only review what it couldn't read, plus a sample of the rest. |
| Sentry | Error reports when something breaks, and any problem you report from inside the app: the error, where in the code it happened, the page you were on, and which account you were signed in as — your name, email address and user id — so we can reply and know whose production was affected. Not your request bodies, which can contain script text, and never a recording of your screen. A screenshot is included only if you attach one yourself. |
| Stripe | Payment details, when paid plans are switched on. During the free beta nothing is charged and no payment data is collected. |
| OpenStreetMap Nominatim | If address lookup is enabled, a location address you type is sent to be turned into coordinates. Nothing else about you goes with it. |
| Cloudflare Turnstile | On the demo page before a guest account is created, and on the Campus Ambassador application and notify forms: a check that runs in your browser to confirm a person is submitting it. Cloudflare's handling of that data is set out in its Turnstile Privacy Addendum. |
| PostHog | Product usage analytics: your internal account id and which screen or action you used. Never your name, email, script text or other content — see “Product analytics” above. Opt out any time from Settings. |
What the AI features send
Keyframes’ assistant is called Key. When you ask it something, the relevant part of your production — the scene text, the records it needs to answer — is sent to the AI provider above so it can answer. If you never use Key or the suggestion features, none of your work is ever sent to an AI provider. Key does not act on its own: it proposes changes and a person accepts them, and every accepted change is recorded in the activity log with the fact that Key proposed it.
People you invite
Collaborators you add to a production see the work in that production, limited by the permissions of the role you give them. Someone you send a call sheet to receives a link that grants access to that call sheet without a login — treat those links as confidential, because anyone holding one can open it until it expires.
How long it is kept
- Your account and productions: until you delete them, or until you delete your account.
- Deleting a production removes its records; the files attached to it are removed by a cleanup job that runs daily.
- The activity log is retained and shown according to your plan’s window. Older entries stop being displayed; they are not deleted, so audit history stays intact.
- Database backups are kept on a rolling 30-day window. A deletion you request is applied to the live database immediately; backups age out within that window, and we do not restore a backup to bring deleted data back.
- Waitlist entries: until the beta closes or you ask us to remove yours.
- Demo guest accounts and their productions: 3 days without a visit, or 7 days at most. Daily per-IP demo counts: two days.
- Campus Ambassador applications, videos and evidence: see “If you apply to be a Campus Ambassador” above.
Deleting your account
You can delete your account yourself, in Settings. It deletes your user record, your sign-in sessions, your preferences, and every production in your personal workspace along with its scenes, shots, contacts and files. Productions belonging to a team organisation are not deleted — they belong to the organisation, not to you — and your membership of them is removed. This cannot be undone.
Your rights
Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, receive a copy in a portable form, object to a particular use, or complain to your data protection authority. Email hello@keyframes.mov and we will answer within 30 days. We will not charge you for it or make you justify the request.
Security
Traffic is encrypted in transit. Access to a production is checked on every read and every write against the permissions of your role, not just hidden in the interface. We are a small team running beta software, and we would rather say that plainly than imply a certification we do not hold. If you find a security problem, email hello@keyframes.mov and we will take it seriously.
Children
Keyframes is not intended for anyone under 16, and we do not knowingly collect their data.
International transfers
Keyframes is operated from the United States and its data is stored there. The processors listed above operate internationally. If you are in the UK, the EEA or Switzerland, using Keyframes means your data is transferred to the United States; we rely on the Standard Contractual Clauses our processors offer, and you can ask us which apply to a particular service.
Changes
If this policy changes in a way that affects you, we will email you before it takes effect rather than quietly changing the date at the top.
Contact
hello@keyframes.mov — for anything on this page, including deletion and access requests. Keyframes is operated by Maximum Ventures LLC, a Florida limited liability company; we will give a postal address on request.