Privacy policy

Last updated: 13 September 2026. Draft pending legal review before launch.

Who we are

Asmar is a desktop video editor with AI-assisted analysis. This policy covers the Asmar website, the Asmar account service, and the AI analysis service. Contact: privacy@asmar.app.

What stays on your machine

Your video files, projects, timelines, and exports stay on your computer. Asmar does not upload your media library. Only the material selected for AI analysis leaves your machine, as described below.

What we collect

• Account data. When you sign in with Google we store your Google account identifier, email address, and display name. We use the identifier to recognise your account. We do not receive your password.
• Usage records. When you run AI analysis we record which model was called, token counts, and cost, tied to your account. This is how allowances and billing work.
• Crash reports. The app and our servers send error and crash reports to Sentry. Reports carry technical details: error type, app version, operating system, a device identifier, and your account identifier when signed in. Before a report leaves your machine we remove file paths that contain your user name, email addresses, transcripts, prompts, and model outputs.
• Product events. The app sends product usage events to PostHog: sign-up, first import, agent runs started and finished, proposals accepted or rejected, and exports. Events carry the event name and identifiers only, never the content of your videos, chats, or edits.

What the AI analysis sends to model providers

When you run AI analysis on a video, Asmar sends selected video frames, audio transcripts, and related text from that video to Amazon Web Services (Amazon Bedrock) for model inference. This happens only when you start an analysis or an agent run, never in the background. AWS processes this data to return results and does not use it to train models. Frames are not retained by Asmar's servers after the analysis completes.

Legal basis and Indian law

We process account and usage data to provide the service you signed up for, under the Digital Personal Data Protection Act, 2023 (India). You can withdraw consent by deleting your account.

Data deletion

See account deletion. Deletion removes your account row and usage history within 30 days of a verified request.

Third parties

• Supabase (authentication and database hosting, India region)
• DigitalOcean (application hosting, Bangalore)
• Amazon Web Services (model inference via Bedrock)
• Google (sign-in)
• Sentry (crash and error reports)
• PostHog (product usage events)

Changes

We will update this page and change the date above when the policy changes.