mkclipMKClip Privacy Policy
Local image processing, account data, Waffo payments and privacy rights
1. Responsible operator
MKClip is independently developed and operated by an individual, primarily for the US market, with English and Chinese interfaces. The operator is responsible for personal information collected by MKClip; this does not imply US incorporation or tax residence. Contact support@mkclip.com for privacy, rights requests and security.
This policy explains website, account and membership processing. Using the website is not blanket consent to every processing activity. We will obtain separate consent where law requires it.
2. Images stay on your device
Imported images, project settings and video encoding are processed in your browser. Projects and assets reside in this site's IndexedDB. The editor does not upload images, projects or exported videos to our servers or third-party services. Signing in and checking membership do not change this or provide synchronization or cloud backup.
You can erase local data in browser settings; back up first. Images, screenshots or project information you voluntarily send to support are received as support records, outside the editor's automatic local-processing flow.
3. Information processed
- Accounts: display name, email, verification status, creation and update times. Email registration stores a password hash; verification codes are also hashed. Passwords are not stored in plaintext.
- Google sign-in: authorized account identifier, name, email, avatar, and authorization information and tokens returned by the authentication flow as needed. This does not provide access to Google Photos or cloud files.
- Sessions and security: session identifiers and expiry, IP address, browser user agent, verification and rate-limit records needed for login and abuse prevention.
- Orders and membership: account references, buyer email, plan, order and payment-provider identifiers, amount, currency, payment status, billing periods, cancellation, refunds and entitlements. Waffo Pancake and its payment providers handle full card numbers and security codes; they are not stored in MKClip's database.
- Network and operations: Cloudflare hosting and security may process IP addresses, request paths, timestamps, errors and operational logs. If enabled for the deployment, Cloudflare Web Analytics may process page visits and performance measurements.
- Support: emails, feedback, order explanations and attachments you voluntarily provide. Do not send passwords, complete payment details or unnecessary sensitive information.
4. Purposes and bases
Account, session and order data support our contract to provide software, verify membership, process purchases and assist customers. Necessary security, fraud prevention, fault diagnosis and service maintenance rely on legitimate interests where applicable law permits. Tax, transaction-retention and valid legal requirements rely on legal obligations. Optional activities requiring consent rely on separately obtained consent.
Verification, password reset, welcome, billing and security emails are service communications. We currently offer no marketing-email subscription and do not use editing assets for advertising profiles or sale. We do not make decisions with legal or similarly significant effects solely through automated profiling.
5. Cookies and browser storage
Essential session cookies maintain login. Language cookies and browser storage hold preferences; IndexedDB holds local work. Blocking or clearing them may sign you out, reset preferences or erase projects. Signing out does not delete all account data. Historical theme preferences may remain on your device although the landing page uses a fixed light theme.
With your optional consent, Google Analytics 4 measures website traffic and PostHog measures product usage, export outcomes and confirmed purchases. GA uses analytics cookies; PostHog uses browser local storage. We send page paths, approved campaign tags, device/browser information and limited event attributes. Signed-in PostHog events use your internal account ID, not your email or name. Confirmed purchase analytics may include plan, amount and currency. Providers also receive network metadata such as IP addresses. We do not enable advertising personalization, automatic click capture or session/canvas recordings, and do not send your images, videos, project contents, file names, passwords, verification codes or checkout tokens. Declining does not affect editing, exports, authentication or payments. Change your choice on the browser storage page. We honor browser Do Not Track and Global Privacy Control signals. Signed-in choices are saved separately for optional server-side purchase analytics; withdrawal applies to future collection after the setting is saved and does not erase past events. Waffo controls its own payment-page storage.
6. Sharing and international processing
We do not sell personal information or share it for cross-context behavioral advertising. Necessary processing involves:
- PostHog: optional product and confirmed-purchase analytics, hosted in the US region. PostHog privacy policy.
- Cloudflare: hosting, security, D1 account and order storage, Email Service transactional delivery, and potentially Web Analytics. See Cloudflare's privacy policy.
- Waffo Pancake: Merchant of Record for payments, subscriptions, transaction taxes, refunds and fraud prevention. Checkout receives your account identifier, email, plan and order references to associate payment with your account, not editing assets. Consult its checkout privacy notice for the applicable transaction.
- Google: optional Google sign-in and, separately with analytics consent, GA4 website measurement. Google privacy policy.
- Support email providers: processing communications you initiate and information required to reply.
We may also disclose necessary information for valid legal requirements, protection of lawful rights or your express authorization. If a business transfer involves personal information, affected users will be notified and applicable protection obligations must continue.
Providers may process data in the US and other countries. Serving the US does not mean all data stays there. International processing must comply with applicable law; mechanisms such as EU Standard Contractual Clauses must be implemented before transfers where required. We do not claim a particular unverified storage location or executed agreement. Contact us for information about arrangements relevant to you.
7. Retention
These proposed periods require operator confirmation and implementation; they do not represent an existing automated deletion capability:
| Category | Proposed retention and disposition |
|---|---|
| Local images and projects | Until you delete them in the editor/browser or the browser clears them; not stored on our servers. |
| Account, sign-in linkage and session records | While the account is active; delete or anonymize unnecessary information within 30 days after verified account closure, except legally required transaction records. |
| Orders, refunds and necessary transaction evidence | Proposed 7 years after the transaction for accounting, tax and disputes, subject to confirmation under the operator's actual applicable law; then delete or anonymize. |
| Support records | Up to 2 years after resolution, then delete; unresolved disputes may require retention until resolution and mandatory periods expire. |
| Separate operational, security and rate-limit logs | Proposed maximum 90 days; verify Cloudflare/email-provider settings and implement application cleanup. |
Verification codes are valid for 5 minutes. Sessions are valid for 7 days and may refresh with use. These are authentication lifetimes, not evidence of physical deletion. Cancellation is not account closure. Legally extended retention should cover only necessary records, restricted from unrelated use.
8. Your rights
Subject to applicable law, you may request information, access, copies, correction, deletion, restriction, portability, objection to certain processing and withdrawal of consent. Withdrawal does not invalidate prior lawful processing. Eligible US state residents may also exercise local opt-out, authorized-agent and appeal rights. We will not discriminate for lawful exercise of privacy rights.
Email support@mkclip.com, preferably from your account email, describing your request. We may request only information needed to verify identity. Our proposed response period is 30 calendar days, or sooner if legally required. For a legally permitted extension, we will explain why and provide the expected timeframe. You may appeal a denial by email or complain to a competent data-protection or consumer-protection authority.
Erase local projects directly in your browser. Contact us for manual account deletion. Deletion may affect membership access and does not automatically erase legally required transaction records.
9. Security and incidents
We use HTTPS, password and verification-code hashing, authentication and server-side authorization. Payment callbacks require signature verification before membership updates. No network or storage system is absolutely secure; protect your email and device.
We will investigate and contain personal-data incidents and notify authorities and affected people as required by applicable law. For example, where GDPR supervisory reporting applies, we will report without undue delay and, where feasible, within 72 hours of awareness. That is not a universal notification deadline for every event or every user.
10. Children
Accounts and paid services are for people aged 18 or older. The service is not directed to children under 13, and we do not knowingly collect their personal information. Parents or guardians who believe a child provided data should contact us for investigation and legally required deletion.
11. Changes and contact
We will update this policy when actual processing changes. Material changes are proposed to be announced at least 14 days in advance on the website or by account email, except for legal or urgent security requirements. New purposes requiring consent will obtain it separately; continued use is not a substitute.
Privacy contact: the individual operator identified above. Email: support@mkclip.com. Public contact email is listed above. See Terms of Service for purchase rules.