01Who this covers
CoAnimator is made by Delta4 Infotech Pvt. Ltd. (“Delta4”, “we”, “us”), a company incorporated in India. This policy covers the coanimator.com website, the free browser tools on it, and the CoAnimator desktop app for macOS, Windows and Linux.
It does not cover the third-party services you choose to connect the app to. If you point CoAnimator at an AI provider using your own API key, that provider’s privacy policy governs what you send it. We are not in that path — see your own API keys.
02What never leaves your machine
CoAnimator renders on your own hardware. That is a product decision before it is a privacy one, but the privacy consequence is the important part of this policy, so it goes first:
- Your projects. Project files, timelines, scripts and scene definitions stay in your filesystem. We have no copy and no way to fetch one.
- Your media. Source video, screen recordings, audio, voiceover and images are read from disk and written back to disk. Nothing is uploaded to us.
- Your renders. Exported video is produced locally by your CPU and GPU. There is no render queue on our side to put it in.
- Your API keys. Keys you enter are stored on your device for the app to use. We never receive them.
The same holds for the free tools on this site. Video to GIF, the device mockup tool and the auto caption generator run entirely in your browser — the file you drop in is never uploaded, and the transcription model is downloaded to your browser rather than your audio being sent to a server.
03What the desktop app does send
Three things, and nothing else.
Licence checks
When you activate a paid licence, add a device or manage your devices, the app sends your licence key, the email you purchased with, and a device identifier and name so a seat can be attributed to a machine and freed again later. Without this, a two-device licence cannot be counted.
Update checks
The app asks this site for the latest published release. That request carries your IP address, app version, operating system and CPU architecture, because those decide which build you are offered. Downloads are redirected to GitHub’s content network, so GitHub receives your IP address for the duration of the download; the bytes do not pass through us.
Crash and failure reports
When the app crashes, a render fails, or a window stops responding, it posts a report. A report contains an install identifier, a session identifier, the app version, your platform, CPU architecture and operating system version, the name of the failure, and the error message and stack trace. It does not contain your project, your media, your account or your keys.
One honest caveat: a stack trace can incidentally include a file path, and a file path can include a project name or your user folder name. We do not ask for it, we do not index it, and we use it only to work out what broke. Reports go to the internal tools our engineers triage them in, and are not used to build a profile of you.
The install identifier exists to tell “one machine crashed forty times” apart from “forty people crashed once”. It is not an account, and we do not join it to your licence, your purchase or your email address.
04Your own API keys and third-party AI
CoAnimator lets you bring your own AI provider. When you do, the app talks to that provider directly from your machine using your key. Whatever a feature sends — a prompt, a script, a frame — goes to the provider you chose, under the agreement you have with them, at the price they charge you. We do not proxy it, receive it, store it or mark it up.
This means two things worth being clear about. Your data at that provider is governed by that provider’s policy, including whatever they say about training on it, so it is worth reading. And because we are not in the path, we cannot retrieve or delete anything you sent them — you would ask them directly.
05What the website collects
| What | Why |
|---|---|
| Server logs | IP address, user agent, referring page and the URL requested, kept briefly by our host for security, abuse prevention and debugging. |
| Google Analytics 4 | Pages viewed, approximate location from IP, device and browser, and a pseudonymous cookie identifier, so we know which pages are worth keeping. Property G-XN3MEY9JRB. We do not run advertising or remarketing tags. |
| Chat widget | If you open the chat, YourGPT processes the conversation and anything you type into it, so we can answer you. |
| Waitlist and forms | The email address you type, so we can tell you when the thing you asked about ships. |
You can block analytics with any content blocker or by declining cookies where your jurisdiction requires us to ask. The site works the same either way; nothing on it is gated behind tracking.
06When you buy a licence
Purchases are handled by Dodo Payments, who act as merchant of record. They are the seller on the transaction: they take your billing details and card information on their own checkout, run the payment, and collect and remit sales tax where it is due. Your full card number never touches our systems, because it is never sent to them.
What we receive back is what we need to give you the thing you bought: your email address, the product purchased, the order reference, the amount and currency, the country used for tax, and the licence key issued against it. We keep that record for support, for licence recovery, and because tax law requires us to keep sale records.
07Why we are allowed to hold it
Where the GDPR, the UK GDPR or a comparable law applies, our legal bases are:
- Performance of a contract — issuing and validating your licence, counting devices, delivering updates, answering support.
- Legitimate interests — diagnosing crashes, preventing fraud and licence abuse, keeping the service up, and understanding which pages people read. We have weighed these against your interests, which is why crash reports carry a random install id rather than an account.
- Consent — analytics and marketing email, where your jurisdiction requires consent. You can withdraw it at any time.
- Legal obligation — tax and accounting records for the sale.
09How long it is kept
- Licence and purchase records — for as long as the licence exists, and after that for as long as tax and accounting law requires us to keep the sale.
- Crash and failure reports — kept for as long as they are useful for diagnosing the fault. They are not attached to your name, your email or your licence, so what is retained is a bug record rather than a record about you.
- Analytics — retained on the schedule set for our Analytics property, after which Google deletes it.
- Support and chat conversations — kept while the issue is open and for a reasonable period after, so a follow-up does not start from nothing.
- Waitlist emails — until you ask to be removed, or until the thing you signed up for has shipped and been announced.
10Your rights
Depending on where you live, you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong;
- delete it, where we are not required to keep it;
- stop processing it, or object to processing based on legitimate interests;
- withdraw a consent you previously gave, without affecting what came before;
- receive it in a portable format.
Email [email protected] with “Privacy request” in the subject line. We will ask you to confirm you are the person on the account — usually by replying from the purchase email — and answer within 30 days.
If you are in the EEA or the UK you may also complain to your local supervisory authority. If you are in India, you have the corresponding rights under the Digital Personal Data Protection Act, 2023. If you are in California, note that we do not sell or share personal information as those terms are defined there, so there is nothing to opt out of.
One limit worth stating plainly: we cannot delete what we never had. Your projects, media and renders are on your disk, not ours.
11Where the data sits
We are based in India, and the services listed above operate in the United States and the European Union among other places, so data may be processed outside your country. Where a transfer out of the EEA or the UK needs a safeguard, it is made under the European Commission’s standard contractual clauses or an equivalent mechanism offered by the provider.
12Security
Traffic to the site and the API is encrypted in transit. The credentials that reach your data — payments, licensing, analytics — are held server-side, and none of them is shipped to the browser or bundled into the desktop app. Access to the internal tools that receive crash reports is limited to the people who work on the app. No system is perfectly secure, and we will not claim otherwise — if a breach affects you, we will tell you and the relevant authority as the law requires.
13Age
CoAnimator is a tool for making product videos, and it is not directed at children. Do not use it or buy a licence if you are under 18, unless a parent or guardian is doing it for you. If we learn we hold data from a child, we will delete it.
14Changes, and how to reach us
When this policy changes, the date at the top changes with it. If a change is material — new data collected, or an existing type used for something new — we will say so on the site or by email rather than hoping you re-read the page.
Write to [email protected]. We read every message that arrives there, and it reaches the people who can act on it.