Privacy Policy

Spacenos Technologies Private Limited operates HeyCaveman and is the controller of the personal data described in this policy. Contact us about privacy at support@heycaveman.com.

• Account data: your email address and account identifiers. Sign-in is by emailed code or magic link; we do not use or store passwords.
• Content: scripts, project settings and the video timeline you create, plus generated media such as narration audio, AI drawings and rendered MP4s.
• Usage data: plan, quotas and usage counters (for example renders and AI calls), and timestamps.
• Billing data: subscription status and payment history from Razorpay. We never see your full card number, UPI or bank credentials.
• Your own API keys if you add them (stored encrypted with AES-256-GCM).
• Technical data: IP address, browser, device and error traces (via Sentry), and server logs.
• Analytics data (only if you consent): pages visited, interactions and session recordings via Google Analytics and Microsoft Clarity.

Photos for "character from photo" are analysed in memory to design a character and are not stored.

To make your video, your script is sent to Anthropic (Claude), which directs the video. In illustrated mode, image prompts derived from your script are sent to an image provider (OpenAI, Google Gemini or Cloudflare). Narration text is converted to speech by our self-hosted Kokoro model and, where needed, a third-party text-to-speech service.

We use these providers through their APIs, and where a provider offers the option we use settings that do not allow your inputs to be used to train its models. Each provider may retain inputs for a limited time under its own terms (for example for abuse monitoring). If you add your own API keys (BYOK), those requests run under your account with that provider and its terms and privacy policy apply.

Background photos, videos and icons are fetched from Openverse, Wikimedia Commons, Pixabay and Iconify. Search terms derived from your script may be sent to those services.

• Projects are deleted automatically after a set period from creation — currently 15 days on Free and 45 days on Pro, as shown in your dashboard. We email you about 3 days beforehand (you can turn this off).
• Generated media (narration audio, rendered MP4s, AI drawings) is kept for up to about 46 days, then deleted. Please download your MP4s.
• Account data is kept while your account exists and deleted when you delete your account, except where we must keep limited records (for example billing records for tax law).
• Error data in Sentry and analytics data are kept according to those services' retention settings (typically 90 days for errors and up to 14 months for analytics).

We use essential cookies to keep you signed in and remember your choices. Analytics tools (Google Analytics and Microsoft Clarity) load only after you consent; until then we send them nothing. We use Google Consent Mode with all storage denied by default. Sentry error monitoring is essential and does not set cookies.

You can change your choice at any time with Cookie settings in the site footer. Withdrawing consent stops analytics from loading on future visits. You can also block or delete cookies in your browser, but blocking essential cookies will stop sign-in from working.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share data only with service providers (subprocessors) that help us run the Service, under contracts that limit their use of it:

We may also disclose data if required by law, to protect our rights or users' safety, or as part of a merger or acquisition (with notice to you).

Some providers process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK Addendum, or the EU-US Data Privacy Framework.

We use encryption in transit (HTTPS), httpOnly session cookies, encryption of stored API keys (AES-256-GCM), access controls and least-privilege service accounts. No system is perfectly secure; if a breach affects your data we will notify you and regulators as required by law.

Depending on where you live (for example under the GDPR, UK GDPR or CCPA/CPRA), you have the right to:

• Access and portability — use Settings → Download my data.
• Deletion — use Settings → Delete account, which removes your account and projects.
• Correction of inaccurate data.
• Objection or restriction of processing based on legitimate interests.
• Withdraw consent for analytics at any time via Cookie settings.
• Non-discrimination for exercising your rights (California).

For anything else, email support@heycaveman.com. We respond within 30 days (45 days under the CCPA). You may also complain to your local data protection authority.

HeyCaveman is not intended for children under 13 (or under 16 in the European Economic Area, the UK and Switzerland). We do not knowingly collect their data; if you believe a child has given us data, contact us and we will delete it.

We may update this policy. If changes are material, we will notify you by email or in the Service before they take effect. The "Last updated" date above shows the latest version.

Privacy questions or requests: support@heycaveman.com.