Privacy policy

The short version

• Rendering happens on your machine. Your footage, projects and renders stay there unless you keep them in raea storage or publish them.
• raea keeps what it needs to run your account and do what you ask, and nothing to sell. raea doesn't sell or rent personal data, and doesn't use it for advertising.
• raea posts to a social account only when you press Publish. An agent can draft a post; it can't send one.
• raea.io has no advertising or analytics cookies, so there's no cookie banner to click through.
• You can remove a connected account, delete what you've stored, or delete your account at any time.

Who we are

raea (raea.io, the raea app, and the service at api.raea.io) is made by Shinyobjectz LLC, an Oregon company in the United States, which is responsible for the data described here (the data controller). "raea", "we" and "us" on this page mean Shinyobjectz LLC. Questions about this policy or your data go to hello@raea.io.

What raea keeps

• Your account: your email address, and the id of the account you signed in with (GitHub, Google or Apple), or that you signed in with a code mailed to that address. raea has no passwords of its own and never sees those accounts' passwords.
• Your devices: a name for each computer you've signed in on, and a token that lets it act as you. The token is stored only as a hash.
• Your storage: files you choose to keep in raea storage (renders, footage, project media), with their size and fingerprint. They're kept in Cloudflare R2.
• Connected accounts: for each account you connect (YouTube, Google Drive, TikTok, Instagram, Facebook Pages, Threads, LinkedIn, X, Bluesky, Slack, Discord), its id and name, the permissions you granted, and the access tokens the network gave raea. Tokens are encrypted before they're stored and are never shown to the raea app or anyone else.
• Posts: what you published or scheduled, where to, the caption and fields you chose, and what each network answered (the post's id and link, or the error).
• Your plan, if you pay: which plan you're on, its status and dates, the spend limit you set, the usage measured against it, and the ids of your customer record and subscription at Stripe. Your card number and billing address stay with Stripe and Link (below); raea never sees them.
• Your setup answers: what you make, who it's for, your team's size and the AI you picked, given when you set raea up. They pick your first project and what raea suggests.
• Usage statistics and crash reports from the raea app (below).
• The waitlist, if you joined it: your email address.
• Email: the mail raea sends you and raea news, if you ask for it (below).
• Service logs: requests to api.raea.io are logged by Cloudflare for security and debugging, and kept for a short time.

Usage statistics and crash reports

The raea app can send raea two things: usage statistics and crash reports. On the Free plan, outside the EU, the EEA, the UK and Switzerland, sending both is part of the plan: they're on and can't be turned off, and raea says so where the switches are. Pro and Team can turn either off, and raea's engine, which is open source on GitHub, sends neither.

In the EU, the EEA, the UK and Switzerland, on any plan, and on Pro and Team everywhere, each is your choice. Crash reports start on; usage statistics start off and are sent only if you turn them on. Where you are is read from the country each request comes from, not from your account. Both are shown when you set raea up, and you can change either at any time in your account on raea.io or in the app's Settings. When one is off, raea's servers refuse it too, so nothing is kept even from an app that hasn't caught up.

• Usage statistics: when the app opens (its version, the system's version and the chip), which of its features are used and how often, how long AI turns and renders take and whether they finished, and the setup steps you reached. raea uses them to see what's used, what's slow and where people get stuck.
• Crash reports: an error's message and where in raea's own code it happened, with your home folder's name taken out, and the app's version. raea uses them to fix what breaks.
• Neither ever includes your prompts, what an AI wrote, file or project names, footage, renders or anything you make. Both are tied to your account and computer, and are deleted after 12 months.
• Before you sign in, the app tells raea only which setup steps it reached, under a random number made for that copy of the app and nothing that says who you are. That's deleted after 12 months too.

Email

raea sends mail from hello@raea.io, through Resend. It sends only these kinds:

• Sign-in and security: the code and link when you sign in with email, and changes to how you sign in. These always come, since they're how you get into your account.
• Invites, review requests and activity: when someone invites you to a team or a project, sends you a review link, or comments on yours. Each can be turned off in your account on raea.io, or with the unsubscribe link in the mail itself.
• raea news: new releases and what's new, about once a month, and only if you ask for it. It starts off. Signing up on raea.io sends a mail to check the address is yours, and nothing more is sent unless you confirm; in your account you can turn it on directly. raea keeps what you agreed to (the words by the box), when, and where you asked (raea.io or your account, and your country) as the record of your consent. A sign-up that isn't confirmed is deleted after 7 days.

You can stop raea news at any time: with the unsubscribe link in every news mail, the switch in your account, or a mail to hello@raea.io. It stops straight away, and raea keeps the fact that you unsubscribed so it isn't sent again. For each mail raea sends, it keeps the kind, when, the address's domain, a fingerprint of the address and whether it was delivered, for 90 days; and an address that bounces or reports mail as spam stops getting it. If someone invites you to a team by email, raea keeps your address with the invite until it's answered, taken back or expires after 14 days. raea doesn't track whether you open its mail or click its links, and never sells or shares its list.

Paying for a plan

Pro and Team are sold by Stripe as the merchant of record, through Link: when you subscribe, you buy from Link, which takes your payment, collects any sales tax or VAT, sends your receipts and handles payment questions and disputes, under Link's own terms and privacy policy. Stripe tells raea which plan you bought, your subscription's status and dates, and the email address on your customer record. You can also ask Link to delete what it keeps about your purchases; that cancels any subscription bought through it.

Cookies and browser storage

raea.io uses no advertising or analytics cookies and no third-party trackers. What it does keep in your browser is only what the site needs to work:

• raea_session, a cookie from api.raea.io that keeps you signed in to your account on raea.io, for up to 90 days or until you sign out. Your browser's scripts can't read it.
• raea_oauth, a cookie that lasts ten minutes while you sign in or connect an account, so the answer comes back to the browser that asked.
• In your browser's own storage on raea.io: the theme you picked, which sections of the docs you opened, and raea's GitHub star count for the visit.

To show that star count, your browser asks GitHub for it, and the page where you connect an account loads its fonts from Google Fonts, so GitHub and Google see your IP address as they would on any site. Stripe's and Link's checkout and billing pages set their own cookies, under their own policies.

Connected accounts and publishing

When you connect a network, raea asks for the narrowest permissions that let it do what you asked: to read your account's name and id, list the pages or channels you can post to, and upload and publish the videos you choose. raea uses them only to show you those destinations and to publish what you press Publish on, at the time you choose. It doesn't read your feed, messages, followers or other content, and doesn't post anything on its own.

Removing a connection in the raea app deletes its tokens from raea and asks the network to revoke raea's access. You can also revoke raea from the network's own settings at any time; raea then marks the connection as needing to reconnect.

Google user data

raea's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. raea uses Google sign-in to identify you; the YouTube Data API to upload the videos you publish to your channel and to name that channel; and Google Drive (only files you pick in Google's picker) to bring those files into raea. Google user data is not used for advertising, not sold, not used to train AI models, and not read by people except with your permission, for security, or where the law requires it.

Why raea may use it

Where the law asks for a reason to use personal data (in the EU, the UK and places with similar laws), these are raea's:

• To do what you signed up for: your account, devices, storage, connected accounts, publishing and your plan.
• raea's legitimate interest in keeping the service working and safe: service logs, security, limits against abuse, and crash reports, which you can turn off.
• Your consent: usage statistics, which you can turn off again at any time, and raea news.
• The law: billing and tax records, and requests raea is legally required to answer.

Who else handles your data

• Cloudflare runs api.raea.io, its database, its logs and raea storage.
• Stripe and Link sell and bill raea's plans, as described above.
• Resend sends raea's email, as described above: it receives your address and each mail, keeps the raea news list, and tells raea whether a mail was delivered.
• GitHub, Google and Apple, when you sign in with them, tell raea who you are.
• The networks you connect receive the videos and captions you publish to them, under their own privacy policies.

raea shares personal data with no one else, except where the law requires it.

Where it's kept

raea is run from the United States, and Cloudflare, Stripe and Resend process data in the United States and other countries. When personal data from the EU, the UK or Switzerland goes to the United States, it's protected by those providers' Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long raea keeps it

Your account, storage, connections and posts are kept while your account exists. Stored files you delete are removed from storage. A connection you remove is deleted right away. When a paid plan ends, the files it kept are kept for at least 30 days so you can download them or subscribe again, and may be deleted after that. When you delete your account, raea deletes all of it within 30 days, except billing records the law requires raea to keep.

Your rights and deleting your data

Wherever you live, you can ask raea to show you, correct, export or delete the personal data it keeps about you, and to stop or limit a use of it. Remove a connected account in the raea app (Settings, then Connections), or revoke raea from the network's settings. For anything else, including deleting your account and everything raea keeps for it, email hello@raea.io from your account's address; raea answers within 30 days and confirms when it's done. If you're in the EU or the UK, you can also complain to your data protection authority.

raea doesn't sell personal data or share it for targeted advertising, as California, Oregon and other states define those terms, and doesn't use sensitive personal data to infer things about you.

Security

Everything travels over HTTPS. Network tokens are encrypted with AES-GCM before they're stored, device tokens are stored only as hashes, and stored files are reached only through short-lived signed links.

Children

raea isn't meant for children under 13, or under the age your country sets for agreeing to this on your own, and doesn't knowingly keep their data. If you believe a child has an account, write to us and it will be deleted.

Changes

When this policy changes, this page shows the new date. A change to what raea keeps or who it shares data with is announced in the raea app before it applies.