Privacy Policy
What Repackage stores, why, and who sees it.
Last updated
Repackage stores and shares as little data as possible. In short:
- We don't set cookies unless you sign in. The only cookie is a first-party session cookie so you stay logged in.
- We don't keep raw IP addresses in our database. IPs are hashed before they're written to storage.
- We don't sell or monetize your data, and we don't share it with advertisers.
- We share the minimum needed with a small set of service providers, listed below.
What we store when you transcribe a video
Below is the full list of data we store in our database when you use Repackage without an account.
| Name | Description |
|---|---|
| Hashed IP | Your IP run through SHA-256 before it's stored. Used to rate-limit abuse and deduplicate requests. Raw IPs aren't kept in our database. |
| Video ID | The YouTube video ID you transcribed. |
| Timestamp | When the request happened. |
Transcripts and AI summaries are cached briefly and keyed only by video ID — they're not linked to you.
What gets sent to the AI model
If you ask for a summary, we send the transcript text, video title, and channel name to our AI provider. The model sees what the video says — not who requested it.
What we store if you sign up
If you create an account, we also store the following:
| Name | Description |
|---|---|
| Needed to sign in. | |
| Name and image | Provided by you, or by an OAuth provider (like Google) if you sign in with one. |
| Session | A session token, your IP, and your browser's user agent, so we can keep you logged in. |
| OAuth tokens | Access and refresh tokens from any provider you signed in with, so the auth flow works. |
| Billing customer ID | Only if you upgrade to a paid plan. Links your subscription to your account. |
What we share with third parties
We use a small set of services to run Repackage. They only see what they need:
- PostHog — product analytics. Receives anonymous event data tied to your IP.
- OpenRouter — AI summaries. Sees transcript text. Doesn't see your account information.
- Polar — billing. Sees your name, email, and card if you subscribe. We never see card numbers.
- Upstash — caching and rate-limit infrastructure. Temporarily holds hashed IPs and cached transcript data.
- Vercel — web hosting. Standard access logs.
- Railway — API and database hosting. Standard access logs.
- Slack — where feedback submissions go so we can read them.
We don't share your data with anyone else, and we don't sell it.
Cookies
The only cookie we set is a first-party session cookie, and only after you sign in. It keeps you logged in and can be deleted at any time. We don't use tracking or advertising cookies.
Feedback submissions
If you use the "Share Feedback" form, the text you type, the video you were on, and the contact email you optionally provide go into a Slack channel our team reads. Email us if you want a submission removed.
How long we keep things
- Cached transcripts and summaries: a short period, then deleted.
- Rate-limit counters: short-lived.
- Transcription logs (video ID + hashed IP): kept so we can track product usage. Email us to remove yours.
- Account data: until you delete your account. We remove it within 30 days.
Your rights
If you want to access, correct, export, or delete your data — or exercise any right under GDPR, CCPA, or a similar law — email hi@repackage.app. We'll handle it within 30 days.
Repackage isn't built for children under 13, and we don't knowingly collect data from them.