Privacy Policy

We store what the product needs to work: your Google profile basics, the content you make, and a count of what you have used. There are no ads, no ad networks and no cross-site trackers. We do not sell or rent personal data, and we do not train AI models on your content. We read your content only to operate the service or to debug a problem you report. Content goes to third-party AI providers when you ask for a generation, and deleting your account really does delete everything.

• Account — the name, email address and avatar from your Google sign-in, plus your Google account ID. No passwords, ever.
• YouTube connection — an OAuth token for the channels you connect. It is used for the publishing you ask for (uploading a video, taking it live at the scheduled time, cancelling a scheduled upload) and to show your channel list.
• Your content — projects, scripts, uploaded footage and audio, media our servers fetch for you when you import a video from a link, your library, generated media, and rendered videos.
• Usage metering — counts of what your account has consumed (voiceover seconds, AI video seconds, images, publishes, exports), which is how plan allowances work.
• Billing state — your plan, subscription status and billing period. Card numbers and invoices live with Paddle, our payment provider; we never see your card details.
• Support — messages you send through in-app feedback, and the delivery status of emails we send you.
• Operational logs — request logs and error reports for keeping the service running, retained briefly and never used for profiling.

The app uses one strictly necessary cookie: your sign-in session. This site stores your light/dark choice in your browser. There are no analytics or advertising cookies, which is why there is no cookie banner.

Loru is built on a small number of providers, each processing data only on our instructions and only for the purpose named:

• Railway (US/EU) — hosting, databases, and file storage.
• Paddle (UK) — payments, as merchant of record. Paddle is a controller of the billing data it collects at checkout, under its own privacy policy.
• Google — sign-in and YouTube publishing, under the authorisation you grant.
• Anthropic — script and text generation: your prompts and story text are sent when you use the writing features.
• ElevenLabs — voiceover and music: narration text is sent when you generate a voiceover.
• fal.ai — image and video generation: your prompts are sent when you generate visuals, along with the source still when you animate one.
• Resend — sending the transactional emails described in §6.
• Sentry (US) — server-side error reporting: when something breaks on our side, the error and the account it happened to are recorded so we can fix it. Nothing runs in your browser.
• Stock libraries (Pexels, Jamendo, Freesound, LottieFiles) — your search terms are sent when you search stock media, and the previews you browse load from those providers' own servers.

Content reaches the AI providers only to fulfil the generation you asked for, under their commercial API terms, which do not permit them to train on it.

Loru uses YouTube API Services to publish on your behalf, and Google’s own handling of your data is described in the Google Privacy Policy. We store a token for your connected channels and the metadata of the videos we published for you. We do not read your subscriber lists, your analytics, or anything beyond your channel list. You can revoke Loru’s access at any time in Google security settings; disconnecting a channel or deleting your account removes the token on our side and asks Google to revoke the grant. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We send transactional email only: a welcome note, replies to your support messages, and billing notices (subscription started, payment failed, subscription cancelled). There is no marketing list to unsubscribe from.

• Your work — uploads, projects, library — for as long as your account exists. Never deleted on a timer, with one exception: an item you remove from your library is permanently deleted about 30 days later, once no video is using it.
• Rendered video files — about 30 days; re-renderable from the project.
• Support attachments — about 90 days after a conversation closes.
• Operational logs — kept briefly by our hosting and error-reporting providers, typically days to a few weeks.
• After account deletion — everything above is removed right away, and residual copies in internal caches clear within 30 days. Records that tax law requires to be kept about transactions stay with Paddle.

Where GDPR applies: we process your account and content data to perform our contract with you; metering and abuse prevention under our legitimate interest in operating a sustainable service; billing records under legal obligation. We do not process special categories of data, and we do not make automated decisions with legal effect about you.

You can access, correct, export, or delete your data. Most of it is already in your hands: your content is visible and downloadable in the app, and account deletion is a button in your profile that removes everything permanently. For anything else — a copy of your data, a correction, an objection — email support@loru.app and we will answer within 30 days. If you are in the EU/EEA or UK you can also complain to your local data protection authority.

Our providers process data in the EU and the United States. Where personal data leaves the EEA or UK, the transfer is covered by the providers’ standard contractual clauses or by an adequacy framework, for US providers the EU–US Data Privacy Framework where they are certified.

The data controller for everything described here is PE DRYHA MAKSYM, operating Loru at https://loru.app. For questions, complaints, or to exercise any of your rights, write to support@loru.app.

If this policy changes materially, we will update the date at the top and tell account holders by email or in the app before the change takes effect.