Privacy policy

Last updated 7 November 2026

The short version

We keep what your account needs: your email address, a hash of your password, your plan, and the settings and links of the videos you save.
Your videos are made in your browser. The MP4 files never reach us.
The narrator's voice is made on your computer too: nothing you type is sent anywhere to make it.
No tracking cookies, no analytics, no advertising. We do not sell or rent your data.
You can delete your account, and everything in it, at any time on your account page.

1. Who we are

BounceReel (bouncereel.com) is run by Vuk Cvetković, Niš, Serbia (“we”, “us”). We are the controller of the personal data this policy describes, under the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti) and, for people in the European Union and the United Kingdom, the General Data Protection Regulation (GDPR).

For anything about your data, write to hello@bouncereel.com.

2. What we collect and why

What	Why	Legal basis
Your account: your email address; a hash of your password (never the password itself); when the account was created, last signed in and had its address confirmed; its role; whether it is suspended.	To give you an account, sign you in, and send the mails you ask for: confirming your address and setting a new password.	Performing our contract with you
Your profile, if you fill it in: your first and last name, and a profile picture (the square you cut from a photo in your browser, kept at 256 pixels).	To show them on your account, and to us when we look after your account.	Performing our contract with you
Your plan: which plan you are on, its status, its end date and how it was set. On a plan with a daily limit, when today's first video was saved and how many have been saved today.	To give you what your plan includes, and to apply its limits.	Performing our contract with you
Your video library: for each video you save, its settings (the matchup, the names, opening and winner line you type, the length, look and sound), its title, file name, length, format and recording time, which version of BounceReel made it, a summary of the race (who won and by how much), and the YouTube, TikTok and Instagram links you paste.	To keep your library: so you can find a video, make the same one again, and track where you posted it.	Performing our contract with you
A record of changes: when your plan, subscription or account standing changed, who changed it, and what it was before and after.	To keep an accurate history of each account, and to answer questions about it.	Our legitimate interest in keeping correct records
Security data: your IP address and the email address used, to count sign-in, sign-up and password-reset attempts; a hash of each sign-in session's token, and of each one-time link sent to you, with its expiry.	To keep accounts safe, stop password guessing and abuse, and make one-time links work only once.	Our legitimate interest in security
Technical logs: when you visit, our hosting provider processes your IP address, your browser's request (such as the address asked for and the browser's name) and the time, and keeps short logs of our server's work and errors.	To deliver the site, protect it from attacks, and find and fix faults.	Our legitimate interest in running a secure service
Messages you send us: your address and what you write.	To answer you.	Our legitimate interest in answering, or our contract with you

We do not use your data for advertising or profiling, and no decision about you is made by automated means alone. Where we rely on a legitimate interest, you can object to it (section 9). Giving us an email address and a password is needed to have an account; everything else is up to you.

3. What stays on your computer

The videos themselves. The studio records each MP4 in your browser and saves it to your computer. We never receive it.
The studio's settings, in your browser's own storage: your current matchup, the light or dark theme, the powers switch, whether you have seen the studio's first hint, and any recording waiting to be added to your library while you are offline. Signing out clears your account's settings from that browser.
The narrator. The voice, Kokoro, runs in your browser. The first time you use the narrator or hear a voice, your browser downloads the voice model from Hugging Face (huggingface.co), which sees your IP address as any website you visit does. What the narrator says is made on your computer and is not sent anywhere.

4. Cookies

BounceReel sets two cookies, both strictly necessary for the service you ask for, so they need no consent banner:

Name	What it does	How long
`__Host-br_session`	Keeps you signed in. It holds a random token; we store only its hash. Your browser sends it to bouncereel.com alone, scripts cannot read it, and it only travels over HTTPS.	Up to 30 days, or until you sign out
`br_hint`	Holds no personal data: it lets the public pages show “Open studio” instead of “Sign in” while you are signed in.	As long as the session

There are no analytics, advertising or tracking cookies, and no third-party scripts on BounceReel.

5. Who processes it for us

A few companies handle data for us, each only to provide its part of the service, and under a data processing agreement where it acts for us:

Company	What it does	What it receives
Cloudflare, Inc. (United States)	Hosts the site, runs our server, its database and the storage for profile pictures, and protects it from attacks.	Everything we store (section 2), and the IP address and request data of every visit.
Resend, Inc. (United States)	Sends our mails.	Your email address and the mail: a link to confirm your address or set a new password.
Hugging Face, Inc. (United States)	Serves the narrator's voice model your browser downloads (section 3). It acts under its own privacy policy, not for us.	Your IP address and your browser's request, when you use the narrator or hear a voice.

We share personal data with nobody else, except when the law requires it (for example a court order), or when it is needed to establish, exercise or defend a legal claim.

6. Data outside Serbia and the EU

The companies above may process data outside Serbia and the European Union, including in the United States. Where they do, the transfer rests on safeguards the law recognises: Cloudflare and Resend are certified under the EU–U.S. Data Privacy Framework, and their data processing agreements include the standard contractual clauses. You can ask us for a copy of the safeguards that apply to your data.

7. Payments

Paid plans are not on sale yet, so we hold no payment data. When they are, a payment provider will take the payment, and this page will name it and say what it receives before anyone pays. We never see or store your full card number. We will keep what the law requires for invoices and taxes, for as long as it requires.

8. How long we keep it

Your account, plan and library: as long as you have an account. Deleting your account on your account page deletes your email address, password hash, profile and picture, sessions, plan, and every video and link at once.
The record of changes stays after an account is deleted, as a history of what changed, with only the account's number: not its email address.
Sign-in sessions: until you sign out, and 30 days at most.
One-time links: confirming your address works for 7 days, setting a new password for 1 hour; each is deleted once it has expired.
Counts of attempts (security): about a day; they are cleared as new attempts come in.
Technical logs: a few days, and at most 7.
Backups: our database keeps a rolling history of up to 30 days for recovery, so data you delete is gone from it within 30 days.
Mails: Resend keeps a record of the mails it sends for a limited time, under its own retention policy.
Messages to us: as long as we need them to answer you, and no longer than two years.

9. Your rights

You have the right to:

access your personal data and get a copy of it;
correct it when it is wrong;
delete it (most of it at once, by deleting your account);
restrict how we use it, or object to a use based on our legitimate interest;
take it with you: we send your library in a standard format (JSON), and the studio exports any video's settings as a file;
complain to a data protection authority.

Much of this you can do yourself on your account page and the Videos page. For anything else, write to hello@bouncereel.com from your account's email address, so we know the request is yours. We answer within one month; a complicated request can take up to two months more, and we will tell you if it does. It costs nothing.

In Serbia, the authority is the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Bulevar kralja Aleksandra 15, 11120 Belgrade, poverenik.rs. In the EU or the UK, you can also complain to the authority where you live or work. We would like to hear from you first, though: most things are quicker to sort out by email.

10. Security

The site is served only over HTTPS. Passwords are stored as salted PBKDF2-SHA256 hashes, sign-in sessions and one-time links as hashes of random tokens, and the session cookie cannot be read by scripts. Sign-in, sign-up and password-reset attempts are limited, each account can read only its own library, and the admin area is open to the operator alone. No system is perfectly secure: if a breach puts your data at risk, we will tell you without undue delay, and the authority within 72 hours where the law requires it.

11. Children

BounceReel is not for children under 16, and we do not knowingly collect their data. If you think a child under 16 has an account, write to us and we will delete it.

12. Changes to this policy

When this policy changes, the date at the top changes too. If a change matters to you (a new use of your data, or a new kind of company handling it), we will email every account before it applies.

13. Contact

Vuk Cvetković
Niš, Serbia
hello@bouncereel.com