Skip to the content
Open the editor

Privacy

Your footage, songs, photos and projects never leave your device, and nothing on the service could receive them. This is exactly what is processed, and why.

Version 1.0, in effect since 3 November 2026

1Who is responsible

Drift Technologies, an independent studio operated from Italy, decides what is processed and why, which in the language of the GDPR makes it the data controller. Write to info@driftedit.app about anything on this page; it reaches a person. Drift Technologies is small enough that a data protection officer is not required, so there is no separate address.

2What happens to your work

Nothing about it leaves your device. A video is decoded by your browser, its frames and sound are analysed in the tab (the song's tempo and kicks, the footage's sharpness and motion), the edit is drawn by your own graphics card and encoded in the same tab, and the file is saved where you choose. There is no upload step, and no route or table on the service that could accept a file.

3What your browser keeps, on your own device

So that your work is there next time, the editor keeps, in this browser only:

  • your projects, and for each one where you were in it (the playhead, the zoom, what was selected);
  • the media you imported, with the thumbnails, waveforms and lighter preview copies made from it;
  • what was read from each song and clip, so a second edit starts at once;
  • a few preferences: the theme, whether playback uses the preview copies, and a copy of your plan so it holds for up to 14 days without a connection.

None of it is sent anywhere. Clearing the site's data in your browser removes all of it, and it cannot be recovered for you.

4What the website processes

driftedit.app is static files: no script runs on it, and there is no analytics, no advertising pixel, no third-party embed and no cookie. Cloudflare, which serves it, receives what every web server receives: the page asked for, the browser's description of itself, and the network address it came from, which it uses to deliver the page and protect the site.

5What is counted

Nothing. There is no analytics script and no event counting in the editor, the site or the service. Drift Technologies learns what people reach for by asking them.

6What the service holds for an account

An account exists once somebody signs in, and nothing in this section exists for anybody who has not. For an account, the service holds:

  • an account identifier, and when the account was made;
  • your email address, where you sign in with one or your sign-in provider supplies one, and your display name;
  • your picture, if you add one or your provider has one: copied once and kept so the editor can show it;
  • for each way you sign in (Google, Apple, Discord, TikTok or email), the provider's identifier for you and the address it gave;
  • your password, if you set one, only as a salted PBKDF2 hash that cannot be turned back into it;
  • for each signed-in browser: a hash of its session (the session itself is only in the cookie), when it signed in and when it expires, the browser's description of itself, and its network address cut to its first part (a /24 or /48), enough to tell one place from another and no more;
  • your preferences, such as the theme;
  • your plan and until when it runs, and, once Pro is on sale, the reference of your customer record at Stripe;
  • while a sign-in or email-change link is waiting: a hash of the link, the address it was sent to, and for a sign-in, a hash tying it to the browser that asked.

It never holds a video, a photo, a song, a project or an export.

7Cookies

The website sets none. Signed in, the editor uses three, all on studio.driftedit.app only and all needed for it to work, so none asks for consent:

  • driftedit_session: keeps you signed in, for 30 days from your last visit; scripts on the page cannot read it;
  • driftedit_csrf: a random value the editor sends back with every change, so another site cannot act for you;
  • driftedit_login: for the 15 minutes an emailed sign-in link is valid, ties the link to the browser that asked for it.

8Who else processes it

  • Cloudflare runs the website, the editor and the service, and keeps the account database, pictures and the sign-in emails it sends, as a processor for Drift Technologies under its data processing addendum, which covers transfers outside the European Union with the standard contractual clauses.
  • The sign-in provider you choose (Google, Apple, Discord or TikTok) sees that you signed in to DriftEdit, under its own privacy policy.
  • Stripe, once Pro is on sale (Coming), takes the payment: your card details go to Stripe and never to Drift Technologies, and Stripe processes them under its own terms as a controller in its own right.

9Why it is processed, and on what basis

  • Your account, sign-in, preferences and plan: to provide the service you asked for (performance of a contract, GDPR article 6(1)(b)).
  • The cut network addresses, the session list and the rate limits: to keep accounts and the service safe (legitimate interests, article 6(1)(f)), which you can object to by writing.
  • Payment records, once Pro is on sale: to keep the accounts the law requires (legal obligation, article 6(1)(c)).

10How long anything is kept

  • A session lasts 30 days from its last use, and an expired one is removed within the hour; signing out, or Sign out everywhere, removes it at once.
  • A sign-in link expires after 15 minutes and an email-change link after 30, and either is removed within the hour of expiring.
  • An account is kept until you delete it. Deleting it removes your email, name, picture, password, sign-in methods, preferences and sessions at once and ends any subscription; what stays is the bare record that the account existed and was deleted, with its Stripe reference if it ever had one, which holds nothing that names you.
  • Nothing about your files is kept at any point, because nothing about your files arrives.

11Your rights

Where the GDPR applies to you, you may ask what is held about you, have it corrected, have it deleted, restrict or object to its processing, and receive a copy of it. Most of it is in the editor: Profile and settings shows your sign-in methods and signed-in browsers, downloads everything held about your account as one file, and deletes the account. For anything else, write to info@driftedit.app; you will have an answer within a month.

You may also complain to a supervisory authority in the country you live in; in Italy that is the Garante per la protezione dei dati personali.

12How it is kept safe

Sessions, links and passwords are stored only as hashes. The session cookie cannot be read by scripts, every change carries a token another site cannot forge, and the site and the editor refuse scripts from anywhere but themselves. Sign-in and changes are rate limited. A deleted account cannot sign in again.

13Children

DriftEdit is not meant for anybody under 13, or under the higher age a country sets (the terms, section 5). If a child has made an account without a parent's agreement, write and it will be deleted.

14Changes to this policy

Every version has a number and a date at the top, and what changed is listed at the bottom. A change that materially affects you will be said plainly at the top of this page.

What changed

Version 1.0, 3 November 2026. First publication of the full policy, in place of the short summary that stood here. Expired sign-in and email-change links are now removed within the hour, which section 9 relies on.