New: the storyboard. Redraw or revoice one scene without redoing the video.

See how it works
Doodaro
Start free

Privacy Policy

Last updated September 21, 2026

This policy explains what personal data Doodaro collects when you use doodaro.com, the studio at app.doodaro.com, and the Doodaro API and MCP endpoint, what we do with it, and the choices you have. Doodaro ("Doodaro", "we", "us") is responsible for your data. Contact: support@doodaro.com.

The short version: we collect what we need to run your account and make your videos. We do not sell your data and we do not show ads. The marketing site uses Google Analytics and the Meta Pixel to see which pages and ads bring people to Doodaro; if you are in the UK, the EEA or Switzerland, they only run if you turn them on, and anyone can turn them off on the Cookies page.

1. What we collect

Account details

Your name, email address and a password. We store only a salted hash of your password (PBKDF2), never the password itself. Password reset links are stored only as a one-way hash and expire after 60 minutes. You can also add a display name, workspace name, contact email, language and time zone in Settings.

Your content

The scripts, scenes, projects, templates, reference images, uploaded pictures and voice recordings you create or upload, and the pictures, narration and videos generated for you. When you import a document or a link, we read it to extract its text; we keep the text you choose to use, not the original file.

Billing details

Payments are handled by Polar, the merchant of record. From Polar we receive and store your name and email as given at checkout, your plan, subscription status and renewal dates, and Polar customer, checkout and subscription IDs. We never receive your card number.

API keys

For each key: its name, a short prefix, its last four characters, a one-way hash of the secret, and when it was created, last used and revoked. The full secret is shown to you once and is not stored.

Connected social accounts (when you connect one)

If you connect a platform such as YouTube, Facebook, Instagram, Threads, TikTok, LinkedIn or X, we store the account's ID, display name, username and profile picture link, the permissions you granted, and the access tokens the platform gives us, encrypted with AES-256-GCM. For Facebook, that means the Pages you choose to connect, not your personal profile. We never see your social media password. Disconnecting deletes the tokens from Doodaro.

We use this access only to do what you ask in Doodaro: show which accounts are connected, publish the videos and text you choose to the account you choose, and show you how those posts performed. We never post without your action, we do not read your private messages, and we do not sell, share or use data from these platforms for advertising or to train AI models.

Feedback

If you send feedback from the studio, we store what you write, an optional contact email, and context that helps us fix problems: the page, browser and screen size, app version, language and time zone.

Technical and security data

Our hosting provider processes your IP address and request details to deliver the service and keep logs. We use your IP address to limit repeated sign-in, sign-up and import attempts, and we record failed sign-in attempts against a hash of the email address. Request logs are kept for a short period for security and troubleshooting.

2. Cookies

The studio sets one essential cookie that keeps you signed in. It is HttpOnly, lasts up to 7 days and is removed when you log out.

The marketing site at doodaro.com uses two measurement tools:

  • Google Analytics counts visits and shows which pages and sources bring people to the site. It sets cookies such as _ga, which last up to 2 years.
  • The Meta Pixel tells us which of our Facebook and Instagram ads bring visitors, so we can measure and improve them. It sets cookies such as _fbp, which last up to 90 days, and reports your visit to Meta.

If you are in the United Kingdom, the European Economic Area or Switzerland, neither tool sets a cookie or reports your visit unless you turn measurement on. Everywhere else they run by default. Wherever you are, you can turn them on or off at any time on the Cookies page, linked at the bottom of every page. Turning them off does not affect the studio.

The site also loads the Inter font from Google Fonts, so Google receives your IP address and browser details when you visit it.

3. Why we use your data

  • To provide the service you asked for (performing our contract with you): your account, saving your work, generating pictures and voices, rendering videos, the API, and connecting social accounts you choose to connect.
  • To bill you (contract and legal obligations): working with Polar to start, change and cancel subscriptions and keep required records.
  • To keep Doodaro secure and working (our legitimate interest): rate limits, preventing abuse and fraud, logs, backups and fixing problems you report.
  • To contact you about your account, billing, security and important changes to the service or these policies. If we ever send marketing emails, you will be able to opt out.
  • To understand how people find Doodaro and to measure our advertising (your consent in the UK, the EEA and Switzerland; our legitimate interest elsewhere): Google Analytics and the Meta Pixel on doodaro.com, described under Cookies.
  • To comply with the law and respond to valid legal requests.

We do not sell or rent personal data, and we do not train our own AI models on your content. The only advertising use is measuring Doodaro's own ads with the Meta Pixel on doodaro.com; your account, projects and videos are never used for advertising.

4. Who processes your data

We use these service providers, which process data on our behalf or, for Polar and connected platforms, under their own policies:

  • Supabase: database for accounts, projects and billing records (hosted in the United States).
  • Cloudflare: website and studio hosting, media storage, video rendering, security and request logs.
  • Polar: checkout, payments, tax, receipts and the billing portal, as merchant of record.
  • OpenAI: the story assistant, scene pictures and the image generator. We send the script text, picture descriptions, style instructions and reference images needed for the request.
  • Cartesia: narrator voices and voice samples. We send the narration text and chosen voice.
  • Resend: sends account emails such as the welcome email and password reset links. We send your email address, your name if you gave one, and the message.
  • Google Fonts: the font on doodaro.com, as described under Cookies.
  • Google Analytics: measures visits to doodaro.com, as described under Cookies.
  • Meta Platforms: the Meta Pixel on doodaro.com, which reports visits to Meta so we can measure our ads, as described under Cookies.
  • Social platforms you connect: YouTube (Google), Facebook, Instagram and Threads (Meta), TikTok, LinkedIn and X receive requests made with the access you granted.

When you link a web page or document for import, our servers fetch that address, so the site you link sees a request from Doodaro, not from you. We may also disclose data if the law requires it, to protect the rights and safety of users or the service, or as part of selling or reorganizing Doodaro, in which case this policy continues to apply.

5. YouTube and Google

Doodaro's YouTube features use the YouTube API Services. If you connect a YouTube channel, you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

What we access

When you connect a channel, you sign in on Google's own page and choose to allow two permissions: uploading videos to your channel, and viewing your YouTube account. With them, Doodaro reads your channel's ID, name, custom URL and profile picture, uploads only the videos you choose, and reads the status and link of the videos Doodaro uploaded so it can show you the result. We do not read your other videos, comments, subscribers, messages or analytics, and we never see your Google password.

How we use it

We use this access only to show which channel is connected, upload the video, title, description and settings you review and confirm in Doodaro, and show you whether the upload worked. Doodaro never uploads without your action. We do not sell YouTube data, use it for advertising, share it with anyone other than Google, or use it to train AI models.

How we store it and for how long

The access tokens Google gives us are encrypted with AES-256-GCM. We keep your channel details and tokens only while the channel is connected, and we refresh or delete any other YouTube data we hold within 30 days. When you disconnect the channel in Doodaro, we delete its tokens and details immediately. If you remove Doodaro's access in your Google Account instead, we delete the stored YouTube data within 7 days.

How to remove access

Disconnect the channel in Doodaro under Connected accounts, or remove Doodaro at any time from your Google Account's security settings page for third-party apps. Either one stops Doodaro from uploading. Questions about YouTube data: support@doodaro.com.

Doodaro's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. International transfers

Our providers store and process data in the United States and other countries where they operate, so your data may be processed outside the country where you live. We choose providers that protect data with contractual and security safeguards.

7. How long we keep data

  • Account and content: while your account is open. When you ask us to delete your account, we delete it within 30 days; copies in backups are removed as backups expire.
  • Billing records: as long as tax and accounting law requires. Polar keeps its own records under its policy.
  • Connected social account tokens: until you disconnect the account or delete your Doodaro account.
  • YouTube data: deleted immediately when you disconnect the channel, within 7 days of removing Doodaro in your Google Account, and otherwise refreshed or deleted within 30 days.
  • Rate-limit counters: a few minutes to a day. Request logs: a short period set by our hosting provider.
  • Feedback: until it is no longer needed to handle your report, or until your account is deleted.

8. Security

Data is encrypted in transit. Passwords and API key secrets are stored only as hashes, social media tokens are encrypted, database access is limited to our servers, and every workspace is kept separate. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

9. Your rights

Depending on where you live, including under US state privacy laws where they apply and, for people in the European Economic Area or United Kingdom, the GDPR, you can:

  • access the personal data we hold about you and get a copy of it;
  • correct inaccurate data (most of it you can edit yourself in Settings);
  • delete your data, as described on the data deletion page;
  • object to or ask us to limit some uses, and receive your data in a portable format;
  • withdraw consent you gave, such as a connected social account, at any time;
  • complain to your data protection authority.

To use these rights, email support@doodaro.com from the email address on your account. We reply within 30 days and may ask you to confirm your identity.

10. Children

Doodaro is not meant for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

We may update this policy. If a change is material, we will tell you by email or in the studio before it takes effect. The date at the top shows the latest version.

12. Contact

Privacy questions and requests: support@doodaro.com.