Privacy Policy

Last updated November 5, 2026

The Engine makes short lyric videos and long-form music videos from a musician's show footage and songs, and posts them to the social accounts the musician connects. This policy explains what we collect, what we do with it, who receives it, and how to delete it. The Engine is operated by Maxwell Slater Totten ("we", "us"). You can reach us at maxtotten01@gmail.com. "You" means the person using The Engine.

1. What we collect

Account details. Your email address and a one-way hash of your password. The artists you create, and your settings: solo or band, time zone, posting schedule, captions, TikTok mode, and your YouTube channel's default visibility and whether automatic posting is on, with when you turned it on. We also record your actions in the feed, such as a like, a dislike, a cancelled post or what you set in a post's Details.

Footage and songs. The videos you upload, with their sound, file names, folder labels and recording dates. The songs you upload, and their lyrics. Everything we make from them: processing results (Section 2), video files and poster frames.

Connected accounts. When you connect a platform, it gives us tokens that let The Engine act for you, and the details below. We do not store profile pictures. We store tokens encrypted with AES-256-GCM. We keep the ID each platform returns for every post, except as Section 6 says for YouTube.

YouTube

Tokens: an access token and a refresh token.
With youtube.readonly: your channel title, and the public statistics of the videos The Engine posted (views, likes, comments).
With youtube.upload: we upload your videos to your channel.

Instagram

Tokens: a long-lived access token. Instagram gives no refresh token.
With instagram_business_basic: your username and account ID.
With instagram_business_manage_insights: the insights of the posts The Engine published (views, likes, comments, shares, saves).
With instagram_business_content_publish: we publish your videos and captions.

TikTok

Tokens: an access token and a refresh token.
With user.info.basic: your display name.
With video.list: the counts of the videos The Engine published (views, likes, comments, shares).
With video.publish: we publish your videos directly, visible only to you until TikTok has audited The Engine. With video.upload: we send them to your TikTok inbox as drafts. An account connected for drafts grants only video.upload and user.info.basic, and we read no counts for it.

Billing. Stripe handles payment, and we never see or store your full card number. We give Stripe your email address. Stripe gives us your customer and subscription IDs, the number of artists billed, the subscription status and the renewal date.

Cookies. When you sign in we set a session cookie and the sign-in security cookies that come with it, a cookie that remembers the artist you selected (one year), and, while you connect an account, an OAuth state cookie that protects that step (ten minutes). We use no advertising or analytics cookies.

Google Fonts. Our pages load fonts from Google, so Google receives your IP address when you open them. Google's handling of this is covered by its own privacy policy.

Logs. Our logs record errors and background jobs, with the IDs involved. Our web server is not set up to log visitors' IP addresses.

2. Automated processing of footage

To sort your footage and make your videos, The Engine automatically runs these steps on what you upload:

Pose estimation. A model finds every person visible in the footage and maps their body keypoints, including the nose and eyes. We use this to pick who is performing in a clip, to count the members of a band, and to choose cuts between shots. The result is stored as a data file for each video.
Speech transcription. A speech-to-text model transcribes the singing in the footage's audio into timed words. We compare the words with your lyrics to work out which song a clip is. The transcript is stored for each video.
Vocal separation. A model separates the vocals from the rest of the audio, both in your songs and in your footage's audio. The vocal and backing tracks of your songs are stored.
Audio matching and lyric alignment. We compare footage audio with the record to place each clip in the song, and align your lyrics to the record to time them on screen.

This processing covers anyone in the footage, including fans and bystanders. It is not used to identify anyone: The Engine has no face recognition, does not work out who a person is, and does not compare people across videos. We use your footage, songs and platform data only to provide The Engine to you. We do not use them to train models. The models we run are existing, already trained ones.

If you appear in someone's footage and want it removed, email us.

3. How we use information

To make videos from your footage and songs, and post them to the accounts you connect.
To show you which accounts are connected, and how your posts did, in the Posted tab.
To keep you signed in and to process your subscription.
To keep the service secure, prevent abuse and fix problems. When a post fails, the operator is alerted by email. We do not email users these alerts.

We do not sell your personal information, and we do not use it for advertising.

4. How posting works

The Engine makes posts from your footage and songs, and chooses the song section, the footage, the lyric style and which of your captions to use. Each post appears in your feed at least 24 hours before its time. A replacement for a post that showed a video you have since deleted can appear later than that. You can watch it, change its details (its caption, its YouTube title, description and visibility, and which accounts it goes to), cancel it or post it now. Its details lock once it starts going out. If you do nothing, it goes out automatically at its time, on the schedule you choose, to the accounts you connected, with one exception: a YouTube channel gets it automatically only if you have turned on automatic posting for that channel in Settings. Without that it goes to your other accounts, and to YouTube only if you choose Post now. On TikTok, posts go to your inbox as drafts unless you turn drafts off, and then they are visible only to you until TikTok has audited The Engine. Once a video is published, it stays on the platform until you remove it there.

5. Who receives your data

Google (YouTube), Meta (Instagram) and TikTok receive the videos, titles, descriptions, captions and visibility settings we post for you. Instagram fetches each video through a temporary link to our storage that lasts 6 hours.
Stripe receives your email address and handles your payments.
Cloudflare R2 stores your media: footage, songs, processing results and videos.
Modal runs the GPU processing in Section 2. It receives your footage, audio and lyrics for the length of each job.
Vultr hosts the server that runs The Engine and its database, which holds your account details, encrypted tokens and post records.
Our email provider sends alerts to the operator only. An alert holds an account ID, a platform name and an error message.
Google Fonts receives visitors' IP addresses, as described in Section 1.
Others when required. We share information when the law requires it, or to protect the rights, safety or property of our users or others. If The Engine is sold or merged, your information would pass to the new owner under the terms of this policy.

6. Google and YouTube

The Engine uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and your data is also governed by the Google Privacy Policy.

The Engine's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use YouTube data only for the uses in Section 1: to show which channel is connected, to upload your videos, and to show you how the videos The Engine posted are doing. Stats are kept to show you your posts' performance. YouTube data is held on our Vultr server. It is not sent to Modal or Cloudflare R2, and we do not sell it or use it for advertising.

You can revoke The Engine's access at any time by disconnecting the channel in Settings, or on Google's security settings page. When you disconnect, we ask Google to revoke our access straight away (if another of your artists is connected to the same channel, its access stays until that one is disconnected too), and we delete the tokens, channel title, video IDs and statistics at once. The post records stay, with no YouTube data in them. At least every 30 days we confirm with Google that we are still authorized and that each video still exists, and we refresh its statistics. If you revoked access on Google's page, we delete the same data as soon as we find out, and within 30 days of the revocation. A video no longer on YouTube loses its ID and statistics at that check, and anything we could not confirm for 30 days is deleted. None of this changes anything on YouTube: videos already uploaded stay there until you remove them there.

7. Retention

We keep your information while your account is active, until you delete it or ask us to. Some items stay longer than you might expect, so here is what actually happens:

Deleting a video. The video and its thumbnail go at once, and its pose data and transcript go in the next nightly cleanup. Its database row stays for good, marked deleted, with its file name, folder, size and dates. Internal edits already made from it can stay until they are dropped, which happens first to those edits once the artist has more than 60, or until the artist is deleted, and leftover pose matches can stay in the artist's cut-matching data until that is rebuilt. We never put a deleted video into a new post.
Deleting a song. Its audio and separated tracks go at once, and its loops and timing data in the nightly cleanup. Posts already released keep the song's title in their records.
A released post. The video file is deleted from our storage once it has been sent. Its poster frame, its data file (which records the footage and song section used) and its database record stay, with the platform's post ID and any stats (for YouTube, see Section 6). Stats are read daily for 30 days after a post goes out, and YouTube's again at each check in Section 6.
Deleting an artist. In Settings. This deletes the artist's footage, songs, processing results, edits, posts and connected accounts, including the items above, and asks Google to revoke our access to its YouTube channel.
Disconnecting an account. Its tokens and account name are deleted at once. See Section 6 for YouTube data.
Your user account. Your email address and password hash stay until you ask us to delete them (Section 8). The app has no delete-account button.
Backups. We take database backups before some upgrades. These can hold your information until they are removed.
Billing records. Kept as long as tax and accounting law require.

8. How to delete your data

Disconnect an account. Open Settings in The Engine and disconnect it in the Accounts section, whatever state it is in. A connection that never finished holds no login, so it has nothing to disconnect.

Delete everything. Email maxtotten01@gmail.com from your account's email address with the subject "Delete my data". We delete your account, footage, songs, tokens and stored data within 30 days, and any YouTube data within 7 days, and confirm when it is done. We keep only billing records the law requires us to keep.

Revoke access on the platform. For YouTube, disconnecting in The Engine also asks Google to revoke our access, once no other artist of yours is connected to that channel. For Instagram and TikTok it deletes our tokens but does not cancel the permission on the platform. You can revoke it on each platform yourself:

Google: security settings
Instagram or Meta: in Instagram, Settings, then Apps and websites
TikTok: in the TikTok app, Settings and privacy, then Security, then Manage app permissions

Deleting data from The Engine does not change anything stored by the platforms. Videos already posted stay there until you remove them using that platform, for example YouTube.

9. Security

We encrypt platform tokens at rest, store passwords only as bcrypt hashes, use HTTPS for traffic to the site, check ownership before serving your media, and limit access to production systems. No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.

10. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or limit certain uses of it. California residents have these rights under the CCPA, and people in the EEA and UK have them under the GDPR. To use any of these rights, email us. We will not treat you differently for doing so.

11. Children

The Engine is not intended for anyone under 13, or under the minimum age required by any platform you connect. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

12. Changes to this policy

If we update this policy, we will change the "Last updated" date at the top. If a change is significant, we will also notify you by email or in the app before it takes effect.

13. Contact

Maxwell Slater Totten, operator of The Engine
maxtotten01@gmail.com