Privacy policy.

Last updated: 20 July 2026

1. Overview

SmashCut is a local-first desktop video editor made by Comaze FZCO ("SmashCut", "we", "our", or "us"), a free zone company incorporated with the International Free Zone Authority (IFZA) in Dubai, United Arab Emirates. This policy explains what information we handle when you use the SmashCut app, its local MCP server, our paid plans, the smashcut.io website, and our support channels (together, the "Service").

The short version, which will not change: your footage stays on your machine. Editing, transcription, and rendering run locally on your device. We do not collect or store your media or projects on our servers, and we do not use your content to train AI models. We collect only the limited information described below — mainly to run accounts, billing, credit metering, and our website.

2. Who we are and how to contact us

The data controller for personal information covered by this policy is:

Comaze FZCO
A free zone company incorporated with the International Free Zone Authority (IFZA)
DSO-IFZA, IFZA Properties, Dubai Silicon Oasis
Dubai, United Arab Emirates
dev@smashcut.io

Our EU/UK representatives under Article 27 GDPR, where required, are being appointed and will be published here.

3. The data that stays on your device

The following are created and stored locally on your device and are not sent to or collected by SmashCut:

• your source footage, audio, and images;
• your projects, timelines, edits, and keyframes;
• transcripts and captions (transcription runs locally on your machine);
• prompts, instructions, and outputs exchanged with any agent you connect (these pass between the app and that agent on your device — see Section 7);
• your exported videos, caption files, and cover images.

We cannot see this content, and we do not receive a copy of it.

4. Information we collect

4.1 Account information. You do not need an account to install the app or to edit. If you create an account — required for a paid plan and for using the MCP server — we collect your name, email address, and your plan and licence status.

Authentication is handled by Clerk, our identity provider. Your password (if you use one) is created and stored by Clerk, not by us: we never receive it. See Section 8.

4.2 Billing information. Payments are processed by Stripe. We do not store card numbers. We receive limited billing details such as a customer and subscription identifier and your subscription status, which we use to manage your plan and to comply with tax and accounting rules.

4.3 MCP usage and credit metering. The MCP server requires a signed-in account. While it is running, the app maintains a connection to our servers so we can meter credits and enforce plan and device limits. Over that connection we receive and store:

• the name of each tool call an agent makes (for example add_captions), with a timestamp and its credit cost — an itemised record, not merely a total;
• a device identifier we generate, and a device name taken from your computer's hostname (this often contains a personal name, e.g. "Jane-MacBook");
• your account identifier and plan and licence status.

This does not include your media, project files, transcripts, prompts, or exports. Tool names describe the kind of edit performed, never its content. You can see exactly what we hold for your account at any time under Account → Usage and Account → Devices on this website.

4.4 Diagnostics and crash reports. We currently collect no crash reports, error logs, or product analytics from the app. No telemetry is sent. If we introduce diagnostics in future, it will be opt-in, controlled in the app's settings, and this policy will be updated before any collection begins.

4.5 Website data. When you visit smashcut.io, our hosting infrastructure processes standard server log data, such as IP address and browser type, to serve and secure the site. We do not run advertising or third-party analytics on the website. See our Cookie policy.

4.6 Support and communications. If you email us, we collect the information you provide and use it to respond and to improve the Service.

We do not intentionally collect special-category or sensitive personal data, and we ask that you not send it to us.

5. How we use information

We use the information above to:

• provide, maintain, and secure the Service, and authenticate account holders;
• operate credit metering and enforce plan, licence, and single-active-device limits;
• process subscriptions, payments, taxes, and refunds;
• provide support and respond to your requests;
• detect, prevent, and address fraud, abuse, and security incidents;
• send you service and transactional messages;
• comply with legal obligations and enforce our Terms.

Legal bases (GDPR/UK GDPR). Where this law applies we rely on: performance of a contract (to provide accounts, the MCP server, and paid plans); legitimate interests (to secure the Service, meter credits, and prevent abuse, balanced against your rights); consent (where we ask for it, which you may withdraw at any time); and legal obligation (tax, accounting, and lawful requests).

6. No AI training

We do not use your media, project files, prompts, transcripts, timeline edits, generated assets, or exports to train, fine-tune, or improve any AI or machine-learning model, and we do not sell or share that content for others to do so. SmashCut does not run its own cloud AI over your content.

7. Third-party agents you connect

SmashCut does not provide an AI model. The app lets you connect a third-party agent (such as Claude Code, Claude Desktop, Cursor, or Codex) to the local MCP server. When you do, that agent may read project information — for example transcripts, timeline structure, or file names — in order to perform the edits you request, and it sends that information to its own provider to function.

That processing is governed by the agent provider's terms and privacy policy, not this one. We do not control and are not responsible for how a provider you choose handles your data. Please review the policies of any agent before connecting it, and do not connect an agent to projects containing information you are not permitted to share with that provider.

8. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We disclose information only as follows:

• Service providers (sub-processors) who process data on our behalf under contract:
  • Clerk — account creation, authentication, and credential management (name, email, password);
  • Stripe — payment and subscription processing;
  • Hetzner Online GmbH — server infrastructure in Germany, where our application and database are hosted.
• Third-party agents you choose to connect, as described in Section 7 — through your own action, not ours.
• Legal and safety — where we reasonably believe disclosure is required by law or legal process, or is needed to protect the rights, safety, or property of SmashCut, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your consent or at your direction.

9. Cookies

The website uses only cookies that are strictly necessary to keep you signed in and to secure the site. We do not use advertising or tracking cookies, and we do not run third-party analytics. Full detail is in our Cookie policy.

10. International data transfers

We are based in the United Arab Emirates, our servers are located in Germany, and our providers operate in various countries including the EU and the United States. Information may therefore be processed outside your country. Where we transfer personal data internationally we rely on appropriate safeguards where required — such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a recognised adequacy decision. Ask us for detail using the contact above.

11. Data retention

We keep personal information only as long as needed for the purposes described here — for the life of your account and then for a limited period afterwards, and longer where needed to meet legal, tax, accounting, dispute-resolution, or security requirements. MCP usage records are retained so we can meter credits across a billing period and show you your own history. Content on your device is retained by you and is not subject to our retention, because we never receive it.

12. Your rights

Depending on where you live, you may have rights to access your personal information, correct it, delete it, port a copy, object to or restrict certain processing, withdraw consent, and not be discriminated against for exercising your rights.

To make a request, email dev@smashcut.io. We will verify your request and respond within the time required by applicable law.

• EU/EEA and UK (GDPR / UK GDPR). You may exercise the rights above and may lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).
• United Arab Emirates (Federal Decree-Law No. 45 of 2021). You have rights of access, correction, deletion, restriction, and objection, and may complain to the UAE Data Office.
• California (CCPA/CPRA). See Section 13.

13. California privacy notice

If you are a California resident, the CCPA/CPRA gives you rights to know, access, correct, and delete personal information, to opt out of "sale" or "sharing", and to limit use of sensitive personal information, and protects you from discrimination for exercising them.

In the past 12 months we have collected: identifiers (name, email, device and account identifiers, device name, IP address), commercial information (subscription and payment records), and internet or network activity (MCP tool-call records and server logs). We collect these from you and your use of the Service, and disclose them to the service providers listed in Section 8 for the purposes in Section 5.

We do not sell your personal information and do not share it for cross-context behavioural advertising. To exercise your rights, contact dev@smashcut.io.

14. Children's privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact dev@smashcut.io and we will delete it. See also the age requirements in our Terms.

15. Security

We use technical and organisational measures designed to protect personal information, including access controls and encryption in transit. The MCP server binds to your device's loopback address (127.0.0.1) and is not reachable from outside your machine by default. No method of transmission or storage is completely secure, and you remain responsible for your device's security and for backing up your content.

16. Third-party links

The website and documentation link to third-party sites and services (including agent providers and export platforms). We are not responsible for their privacy practices, and this policy does not apply to them.

17. Changes to this policy

We may update this policy. We will post the updated version here and change the "Last updated" date, and for material changes provide additional notice where required. Your continued use of the Service after an update takes effect means you accept the revised policy.

18. Contact

Questions or requests about this policy or your personal information:

Comaze FZCO
A free zone company incorporated with the International Free Zone Authority (IFZA)
DSO-IFZA, IFZA Properties, Dubai Silicon Oasis
Dubai, United Arab Emirates
dev@smashcut.io