Your data is yours. I don't sell it, and I don't look.
I'm privacy-first and customer-first. The app's data lives on your computer. This page says what that means, and the few places it does not.
Jobs, clients, invoices, payments, and money stay on the machine where you installed Cinebun. The app still runs with the Wi-Fi off. Apart from what you publish to your client portal (below), there is no copy of that data on my servers, and I can't open it. Pairing a phone also sends it off the machine, but it's end-to-end encrypted before it goes, so my server can pass it along to your phone but never read it, and the one-time pairing code is deleted the moment it's used.
The portal is off until you turn it on. Couples sign, pay, and fill in their details there.
If you turn it on, what you publish to it — your clients' names and contact details, your proposals and invoices, their signatures and questionnaire answers, and any files you or your clients upload — is stored on my servers, on Cloudflare, so your clients can open it. It stays there only until you remove that client from your portal or turn the portal off; then it's deleted, and Cloudflare's own backups of it roll off within 30 days. After you turn the portal off, I keep only its web address, for 30 days, so no one else can take it and receive your old links. Card payments go straight to your own Stripe account: I keep only your Stripe account ID and never see card details.
Private links: once your portal is on the latest version, every client you share from then on gets a private link. What they see, type, sign and upload is locked with a key that lives only in their link and on your computer. My servers store it, but they can't read it, and neither can I. What stays readable is what the portal needs to work: amounts and line-item prices (not what they're for), payment status, when the page was opened, signed or paid, the card brand and last four digits, file sizes, and your studio's own name, logo and colors. Clients you shared before that update keep their old links, and their pages are stored the way described above.
If you'd rather host it yourself, the app can run the portal on your own Cloudflare account instead. Then none of it is on my servers.
I haven't added analytics or trackers to this site, and it sets no cookies. Fonts are part of the site. The one thing it stores in your browser is your light or dark choice, under the key cinebun-theme, and only if you press the switch. That value stays on your machine. It is not a cookie.
The waitlist keeps the email you give it, only to tell you about the launch. It also keeps the name and the platform you type, any answers you choose to give in the short questionnaire (linked to your entry, never copying your email), a hash of the network address (not the raw address), and your browser's user-agent string (cut to 300 characters), so one network cannot sign up over and over. If you join from a friend's link, I keep who invited you, only so I can apply the discount. To be removed, write to hello@cinebun.app.
If you ask for a beta code, the request goes on that same list entry, so you're never in two places. It keeps the same things, plus the date you asked and the one line you type about what you shoot, if you type one. I read each request myself and approve or decline it. A decline sends nothing, and you stay on the launch list.
If I invite you to the beta, the email goes out through Resend, which receives your email address, your name and your invite code to send it. Invite emails note whether they were opened or clicked, and whether you accepted the invite, so I know who to follow up with. That is all it is used for. The questionnaire can also keep an optional link to a meme. If you join from a friend's link, your first name is shown to people who open your own link, and the link records who joined through it.
While Cinebun is in beta, I need to know what's going wrong so I can fix it, so this part works a little differently. That still doesn't mean I look at your work. I only see what you send me, like a Feedback message or a problem you describe, or something you tell me I can look at.
The beta app goes online for two small things. When you first open it, it sends your invite code to cinebun.app to check it. After that, every few hours, it asks downloads.cinebun.app whether a newer version is out. That request carries nothing about you or your work. Like any web request, it does reveal your network address to Cloudflare, which hosts the files.
The Feedback button in the app sends only when you press Send. It sends what you type, your app version and computer type, which screen you were on, and your invite code. If you leave the box checked, it also sends a screenshot of the Cinebun window, which can show client names, so uncheck it if you'd rather not. It is stored on my Cloudflare account so I can fix things, and you can ask me to delete it.
Nothing else leaves your computer unless you switch it on: the client portal, your phone, email, travel times, or AI with your own key. There are no analytics and no automatic crash reports. If the app crashes, the crash log stays on your computer.
AI is optional. A local model sends nothing off your computer. If you bring your own key, what you ask goes to that provider. Nothing is resold. Skip AI and the rest of the app still works.
Buying goes through Lemon Squeezy, which is the payment processor and the merchant of record. It takes your payment details and handles sales tax and VAT. I never see your card. The core app is $200, once, and there is no subscription for it.
If you send a feature request, the site keeps the text you write, the area you pick, and the email only if you give one. It also keeps a hash of the network address, not the raw address, so one network cannot flood the form.
Write to hello@cinebun.app.