Privacy policy
This Privacy Policy describes how propane media ("propane", "we", "us" or "our") collects, uses, stores, shares and protects personal data when you visit propanemedia.ai (the "Site") or use our clipping service (together, the "Service"), and explains the rights and choices you have in relation to that data.
We have tried to keep this policy readable, but the substance matters more than the style, so here is the summary up front: we collect the minimum personal data needed to run an account-based, paid product — your email address, basic session and security data, your purchase and generation history — and nothing more. We do not run advertising, we do not use third-party analytics or tracking, we do not profile you, and we never sell or rent your personal data to anyone.
1. Who we are and how to contact us
propane media operates the Service, which turns broadcast sports footage into short-form video reels. For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), propane media is the data controller of the personal data described in this policy.
For any question, request or complaint relating to your personal data, you can reach us at hello@propane.app. We aim to respond to all privacy-related requests within 30 days.
2. Scope of this policy
This policy applies to personal data processed in connection with the Site and the Service. It does not apply to the practices of third parties that we do not control, such as our payment processor's own checkout pages — those are governed by the third party's own privacy policy (see Section 14).
The video content available through the Service consists of sports broadcast footage and match data. It depicts public sporting events and professional athletes performing in public; it is not derived from data about you, and nothing you upload becomes part of it — the Service does not accept user-uploaded media.
3. Personal data we collect
We collect data in two ways: data you give us directly, and data generated automatically when you use the Service. We do not buy data about you from anyone, and we do not collect data about you from other companies.
3.1 Data you provide to us
- Email address. Your account is identified by your email address. We use it to send you single-use sign-in links (the Service uses passwordless "magic link" authentication — we never ask you to create or store a password), payment receipts, and occasional service notices. Providing an email address is required to create an account.
- Correspondence. If you contact us by email, we receive the contents of your message and your email address, which we keep for as long as needed to handle your enquiry.
3.2 Data collected automatically
- Session and security data. When you sign in, we create a session record containing the IP address and browser user-agent string from which the session was started, together with its creation and expiry times. We collect this solely to secure your account — for example, to investigate a suspected account compromise or abuse of the Service.
- Purchase and credit records. When you buy credits, we record the purchase in an append-only credit ledger: the number of credits, the time, and a reference to the corresponding Stripe transaction. Every credit spent or refunded is likewise recorded. We never see or store your card number, CVC or full billing details — payment details are entered directly with Stripe, our payment processor, and never pass through our servers.
- Generation history. We keep a record of each reel you generate: which match, team or player it was built from, the settings you chose (format, length, ordering and similar options), when it was created, and its status. We keep this so you can re-download and edit your reels, so credits are charged and refunded correctly, and so we can diagnose failed builds.
- Edit history. If you use the editor, we store your edit specifications (clip order, trim points, volume levels) so your edits persist between visits.
- Service logs. Like virtually every web service, our servers keep routine operational logs of significant account activity — sign-ins, generations, purchases, errors — used to operate, debug and secure the Service.
3.3 Data we do not collect
For clarity, we do not collect: your name, postal address, phone number, date of birth, photographs, contacts, precise location, or any special-category data. We do not use third-party analytics, advertising identifiers, fingerprinting, cross-site tracking, or social-media pixels anywhere on the Site.
4. How and why we use your data
We use the personal data described above exclusively to:
- Provide the Service — create and maintain your account, sign you in, render and deliver the reels you request, store your generation and edit history, and maintain an accurate credit balance;
- Process payments — complete credit purchases through Stripe, apply purchased credits to your account, issue refunds where a generation fails, and send receipts;
- Communicate with you — send sign-in links, transactional emails about your purchases and account, and respond when you contact us;
- Keep the Service secure — authenticate requests, detect and prevent fraud, abuse, and unauthorized access, and enforce rate limits;
- Comply with the law — keep the financial records we are legally required to keep, and respond to lawful requests from public authorities where we are legally obliged to do so;
- Improve and debug the Service — investigate errors and failed generations using our own operational logs.
That is the complete list. We do not use your data for advertising, we do not build marketing profiles, and we do not send marketing emails.
5. Legal bases for processing
Where the GDPR or equivalent legislation applies, we rely on the following legal bases:
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the Service | Email, session data, generation and edit history, credit ledger | Performance of a contract (Art. 6(1)(b) GDPR) |
| Processing payments | Email, credit ledger, Stripe transaction references | Performance of a contract (Art. 6(1)(b) GDPR) |
| Security and abuse prevention | IP address, user-agent, service logs | Legitimate interests (Art. 6(1)(f) GDPR) — keeping the Service and its users' accounts secure |
| Financial record-keeping | Credit ledger, purchase records | Legal obligation (Art. 6(1)(c) GDPR) — accounting and tax law |
| Responding to enquiries | Email correspondence | Legitimate interests (Art. 6(1)(f) GDPR) — answering the people who write to us |
Where we rely on legitimate interests, we have assessed that the processing is limited, expected, and does not override your rights and freedoms. You may object to it at any time (see Section 11).
6. Cookies and similar technologies
We use exactly one cookie, and it is strictly necessary for the Service to function:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| propane_sid | First-party, essential | Keeps you signed in. Contains a random session identifier with a cryptographic signature; a tampered cookie is rejected. Set only after you sign in. | Up to 30 days; removed when you sign out |
Because this is a strictly necessary cookie, it does not require consent under the ePrivacy rules, and we therefore do not show a cookie banner. We set no advertising, analytics, preference or third-party cookies of any kind.
Separately, your browser's local storage holds one value: your light/dark theme preference (propane-theme). It is written and read entirely within your browser and is never transmitted to us.
We do not respond to "Do Not Track" browser signals because we do not track you in the first place.
7. Connecting your Instagram account
propane lets you publish a reel you have generated straight to an Instagram professional (Business or Creator) account. This is entirely optional — the rest of the Service works whether or not you ever connect one.
If you choose to connect an account, you are sent to Instagram to sign in and approve access. propane never sees or stores your Instagram password. Instagram returns an access token, which we store encrypted (AES-256-GCM) and use only to act on your explicit instructions.
What we receive from Instagram
- Profile basics — your Instagram user ID, username, display name, account type, profile picture URL, follower count and post count. We use these to show you which account you are posting to.
- Insights for reels you published through propane — views, reach, likes, comments, shares, saves and watch time, so you can see how a reel performed without leaving the app.
- Comments on reels you published through propane — so you can read and reply to them from propane.
What we send to Instagram
- The reel you selected, and the caption you typed, at the moment you press Publish — and nothing else. We never post on your behalf without you initiating it.
- Replies you write to comments on those reels.
What we never do
We do not read your existing posts, your direct messages, your followers' personal data, or any media you did not create in propane. We do not use Instagram data for advertising, profiling, or training models, and we never sell it or share it with third parties.
Disconnecting and deletion
You can disconnect at any time from the Publish tab in the app, or by removing propane from Instagram's Apps and websites settings. Either way, the stored access token is destroyed and propane can no longer post to, or read anything from, your account. Reels you already published remain on your Instagram account — they are yours. See Data deletion for the full process and to check a deletion request.
Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies.
8. How we share your data
We share personal data only with the following categories of recipients, and only to the extent necessary:
7.1 Service providers (processors)
We use a small number of infrastructure providers to run the Service. Each processes data on our behalf, under contract, and only for the purpose described:
| Provider | Role | Data processed |
|---|---|---|
| Stripe | Payment processing | Your email and payment details (card details are collected by Stripe directly and never touch our servers). Stripe acts as an independent controller for the payment data it collects — see the Stripe Privacy Policy. |
| Resend | Transactional email delivery | Your email address and the content of sign-in and receipt emails. |
| Neon | Managed database hosting | Account, session, ledger and generation records described in Section 3. |
| Cloudflare | Object storage (R2) | The video files you generate, addressed by opaque identifiers. |
| Hetzner | Server hosting (EU data centers) | All Service traffic terminates on servers hosted by Hetzner in the European Union. |
7.2 Legal and business reasons
- Legal compliance. We may disclose personal data where required by law, regulation, legal process or enforceable governmental request, or where necessary to protect our rights, the security of the Service, or the safety of others.
- Business transfers. If propane media is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction. We will notify you of any such change in ownership or in the use of your personal data.
We do not sell personal data, we do not "share" it for cross-context behavioral advertising (as those terms are defined in the California Consumer Privacy Act), and we have not done so in the preceding 12 months.
9. International data transfers
Our servers are located in the European Union. Some of our service providers (such as Stripe, Resend, Neon and Cloudflare) are headquartered in the United States and may process data there. Where personal data is transferred outside the EEA or the UK, we rely on appropriate safeguards recognized by applicable law — such as the provider's certification under the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses — as set out in each provider's data processing terms.
10. How long we keep your data
We keep personal data only for as long as it is needed for the purposes described in this policy:
| Data | Retention period |
|---|---|
| Account (email) | Until you ask us to delete your account. |
| Sign-in links | Single-use tokens that expire within minutes; only a hash is ever stored. |
| Sessions (incl. IP, user-agent) | Expire automatically after at most 30 days; expired sessions are purged. |
| Credit ledger and purchase records | For the period required by applicable accounting and tax law (typically 6–10 years), including after account deletion. |
| Generated reels and edit history | Until you delete them or your account is deleted, after which they are removed from active storage. |
| Service logs | Rotated on an ongoing basis and kept only as long as needed for security and debugging. |
| Email correspondence | As long as needed to handle your enquiry and a reasonable period thereafter. |
When retention periods end, data is deleted or irreversibly anonymized. Residual copies may persist in encrypted backups for a limited period before those backups are themselves rotated out.
11. How we protect your data
We take the security of your data seriously and apply technical and organizational measures appropriate to the risk, including:
- All traffic between your browser and the Service is encrypted in transit using TLS (HTTPS);
- Passwordless authentication: sign-in links are single-use and short-lived, and only a cryptographic hash of each token is stored — a database leak alone cannot be used to sign in;
- Session cookies are cryptographically signed, marked HttpOnly and Secure, and a tampered cookie is rejected outright;
- Payment card data is handled entirely by Stripe, a PCI-DSS Level 1 certified processor, and never reaches our infrastructure;
- Generated videos are delivered through short-lived, signed URLs tied to your account — reels are not publicly listable;
- Access to production systems is restricted, key-based and limited to those who operate the Service;
- Rate limiting and abuse detection on authentication and generation endpoints.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that puts your rights and freedoms at risk, we will notify you and the competent supervisory authority as required by law.
12. Your rights and choices
You have choices and rights over your personal data regardless of where you live. If you are in the EEA, the UK, or another jurisdiction with comprehensive data-protection law, these rights include:
- Access — ask for a copy of the personal data we hold about you;
- Rectification — ask us to correct inaccurate or incomplete data;
- Erasure — ask us to delete your account and personal data ("right to be forgotten"), subject to records we must keep by law;
- Portability — receive the data you provided to us in a structured, commonly used, machine-readable format;
- Restriction — ask us to limit how we process your data in certain circumstances;
- Objection — object to processing based on our legitimate interests;
- Withdrawal of consent — where processing is based on consent, withdraw it at any time (this does not affect processing already carried out);
- Complaint — lodge a complaint with your local data protection supervisory authority. We would, however, appreciate the chance to address your concerns first.
If you are a California resident, the CCPA/CPRA gives you comparable rights to know, access, correct and delete personal information, and the right not to be discriminated against for exercising them. As stated above, we do not sell or share personal information, so there is nothing to opt out of.
To exercise any of these rights, email hello@propane.app from the address associated with your account. We will verify the request by confirming control of that email address, respond within 30 days, and will not charge a fee unless a request is manifestly unfounded or excessive. You may also designate an authorized agent to act on your behalf where the law provides for it.
13. Automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects. The Service's rendering pipeline processes sports footage and match data, not data about you.
14. Children's privacy
The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child under 16 has created an account, contact us at hello@propane.app and we will delete the account and its data promptly.
15. Third-party services and links
Checkout is completed on pages operated by Stripe, and emails are delivered by Resend; their handling of your data is described in their own privacy policies. The Site may occasionally link to other websites; we are not responsible for the privacy practices of sites we do not operate, and we encourage you to read the privacy policy of any site you visit.
16. Changes to this policy
We may update this policy from time to time to reflect changes in the Service, the law, or our providers. When we do, we will revise the "Last updated" date at the top of this page. If a change materially affects how we handle your personal data, we will give you more prominent notice — for material changes, by emailing the address on your account before the change takes effect. Your continued use of the Service after an updated policy takes effect constitutes acceptance of the updated policy.
17. Contact us
If you have any questions about this policy or about how we handle your personal data, contact us at:
propane media
Web: propanemedia.ai