Privacy & Policy

Welcome to Shorty! Shorty summarizes YouTube videos, web pages, documents and pasted text, transcribes audio and video, generates subtitles, and converts files. This Privacy Policy explains what we collect, why, who receives it, how long we keep it, and what you can control — including what we share with an AI assistant when you connect one. By accessing and using our services, you agree to the terms of this Privacy Policy.

What information do we collect?

• Account information — your email address, the name or username you give us, and a hashed password. If you sign in with Google or Apple we store the link to that account, never its password.
• Content you submit — the links you paste (YouTube videos, web pages, audio and video URLs), text you type, and the files you upload (audio, video, PDF, Word documents, images and other files you convert).
• Content we generate for you — summaries and their sections, article and transcript text, transcription results and the detected language, subtitle files and captioned videos, and converted files. These are stored with your account so you can come back to them.
• Processing records — one record per job you start: its type, status, progress, a title derived from your content, the identifier of what it produced, timestamps, and any error message the pipeline reported.
• Plan and billing — your plan tier, entitlements, trial and renewal dates. Payments are handled by RevenueCat and the app stores; we never receive or store your card number.
• Developer and integration data — API keys you create, webhook endpoints and their signing secrets, a log of your API requests (method, path, status, duration and request id), records used to make retries safe, and — for each AI assistant you connect — the app, the permissions you granted, and its access and refresh tokens.
• Technical data — your IP address and browser user agent are stored with your sign-in session, along with cookies, device push tokens if you enable notifications, product analytics events, and error diagnostics.
• Chats with Shorty's assistant — the messages you send to the in-app AI assistant, its replies, and any thumbs-up or thumbs-down you leave on an answer.
• Support messages — what you write to us through the support form or by email, and the address we reply to.

Browser extension

The Shorty browser extension (Chrome, Edge, Firefox) adds a Summarize button to YouTube video pages and a toolbar popup. It runs only on youtube.com, m.youtube.com and music.youtube.com. It reads the address of the video page you are on and checks the page locally to see whether the video is private or unlisted. It does not store anything, does not use cookies or browser storage, does not run in the background and does not send data to us by itself. When you click Summarize, or submit a link in the popup, it opens Shorty in a new tab with the YouTube video id and the summary language you chose in the link; from that point the request is handled like any other link you submit to Shorty, as described in this policy. The extension does not collect your browsing history, your YouTube account details or the content of the pages you visit.

How do we use this information?

• To run the product: send your content to the AI models and transcription service that produce your summaries, transcripts and subtitles, and to store the results in your library.
• To operate your account: sign you in, apply your plan's limits and quotas, and send the emails the service needs to send (verification, password reset, account deletion, and the occasional lifecycle notice).
• To keep the service working and safe: diagnose errors, measure how features are used, rate-limit abuse, and answer your support requests.
• To fulfil requests you make through a connected AI assistant — see the next section.

We do not sell your personal information, and we do not use your content to advertise to you.

AI assistants and connected apps

You can connect Shorty to an AI assistant — for example ChatGPT or Claude — so it can work with your Shorty data on your behalf. This only happens after you sign in and approve the specific permissions on a consent screen; an assistant can never reach your data without that approval, and it only gets the tools covered by the permissions you granted.

When a tool runs, its result is sent to the AI assistant provider you connected — OpenAI if you connected Shorty to ChatGPT, Anthropic if you connected it to Claude — and from that point it is also handled under that provider's own privacy policy. Below is everything those tools can return, including nested fields.

• Your summaries and articles — for each item: its identifier, title, description, type and creation date; and for a single item you ask about, its summary sections and the article or transcript text it was built from.
• Your transcriptions — for each one: its identifier, status, progress, detected language, the name of the file or link you submitted, and its creation date; and for a single transcription you ask about, the full transcript text and, if it failed, a short reason written by Shorty (for example, that the link could not be downloaded).
• Your jobs — for a job you started through the assistant: its identifier, status, type, the identifier of the item it produced, and, if it failed, a short reason written by Shorty.
• Your plan and usage — your plan name and tier, the limits that come with it (upload sizes, realtime minutes, conversion caps), and how much of your daily cloud-conversion quota you have used and have left. When you also grant the billing permission, it includes whether you are subscribed or on a trial, your trial end and renewal dates, whether the plan will renew, which store bills you, and your subscription identifier.
• Your profile and settings — when you grant the profile permission: your first and last name, username, email address, profile picture and interface preferences. An assistant can change them, remove a device push token, send you an export of your data, or delete your account after you confirm.
• Support messages — a message an assistant sends to Shorty support on your behalf (subject and body) and the list of support messages you sent that way.
• Connected apps and API keys — the AI assistants connected to your account, and for your API keys: name, prefix, permissions, creation and last-use dates. A new key's secret is shown once, to the assistant that created it, and never again.
• Webhooks and file conversions — your webhook endpoints (address, description, subscribed events, status) and their delivery history, signing secrets only when you grant the separate secrets permission; and your file converter jobs (file name, formats, status) and download links for finished output.
• Referral summary — your referral link, its click, signup and sale counts, and your pending, cleared and paid earnings.
• Links we create — for downloads, uploads, plan changes and reconnecting with more permissions we give the assistant a single-use link that expires after 15 minutes and works only while you are signed in as you.
• Activity record — for each tool call we keep the tool name, its permission group, which connected app made it, the time, whether it worked, and a one-way hash of the arguments, never the arguments themselves. When you delete your account this record is detached from you.
• Creating new work — an assistant can start a summary, transcription or subtitle job from a link, pasted text or a file you already uploaded. Shorty receives what the assistant sends (the link, text or file reference, the language and the subtitle style) and returns the new job's identifier, a link to follow it, and — if your plan does not allow the request — a plain message naming the limit.
• Our public documentation — an assistant can search Shorty's developer docs. That content is public and contains none of your data.

Deliberately not sent to a connected assistant: your IP address or browser user agent, your device push tokens, your card or other payment details, the secret of an existing API key, webhook signing secrets unless you grant the secrets permission, the internal identifiers of the AI and transcription engines we run, and raw error or debug output from our pipeline. Your name, email address and subscription dates are sent only when you grant the profile or billing permission.

You can see every connected app and disconnect it at any time under Settings → Connected Apps. Disconnecting deletes the permission record and that app's stored access and refresh tokens, and because every tool call re-checks your permission, the app stops being able to read or create anything immediately.

Who else receives your information?

We do not sell your personal information or share it for anyone else's marketing. We do rely on service providers who process it on our behalf, only to run Shorty:

• AI model providers (OpenAI, and models reached through OpenRouter) — they receive the content being summarized or edited so they can produce the result.
• Our transcription service — receives the audio or video you submit in order to transcribe it.
• Cloud storage and search — your uploads and generated files are stored in object storage, and your summaries are indexed so you can search your own library.
• Sign-in providers (Google, Apple) — if you choose to sign in with them.
• Billing (RevenueCat and the Apple and Google app stores) — to manage subscriptions and entitlements.
• Email, notifications and support — to deliver account emails, push notifications you opted into, and replies to your support messages.
• Analytics and error monitoring (PostHog, Sentry, Google Analytics) — to understand feature usage and diagnose failures. Ordinary usage events carry identifiers rather than your content; the exception is your chats with Shorty's in-app assistant, whose traces include the message and the reply so we can debug and improve it.
• An AI assistant you connect — as described in the section above.

We may also disclose information where the law requires it.

How long do we keep it?

• Your content and results — kept while your account exists, so your library stays available. You can ask us to delete specific items at any time.
• Connected-app permissions and tokens — kept until you disconnect the app, which deletes them. An access token already issued to an app stays valid until it expires (30 days by default) or you disconnect the app, and consent is re-checked on every call, so disconnecting ends its access straight away.
• Sign-in sessions — kept until they expire or you sign out, and deleted when you delete your account.
• Records that make retries safe — when an assistant or an API call supplies a retry key, we store that key with the job it produced so a repeat does not run the work twice.

Deleting your account removes your sign-in identity (email, name, username and password), your linked Google and Apple sign-ins and all your sessions immediately. Stored content is not erased in that same step — email us and we will delete it.

Your choices and controls

• Disconnect an AI assistant — Settings → Connected Apps.
• Delete your account — Settings → Danger Zone.
• Manage API keys, webhooks and notifications — the matching tabs in Settings.
• Access, correct or delete your data — email us and we will act on the request.
• Cookies — you can manage or block them in your browser settings, with the caveat that signing in requires a session cookie.

You can also choose not to provide certain information, but that may limit the features available to you.

Do we use cookies?

We use cookies to keep you signed in, to carry out the sign-in and connected-app approval handshakes securely, and to measure how the product is used so we can improve it.

How do we protect your information?

Your library is private to your account: a request for your saved work is matched against the signed-in user, and a connected app reaches only your own items plus the public ones Shorty publishes to everybody. Passwords are stored hashed, webhook signing secrets are stored encrypted, and traffic is served over HTTPS with a baseline of security response headers. We implement technical and organizational measures to safeguard your data against unauthorized access and data breaches.

Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Any updates will be posted on our website, and the revised policy will take effect immediately upon posting.

Contact us

If you have any questions or concerns about this Privacy Policy, or you want to access, update or delete your information, please contact us at hello@devino.ca.