ClipJazz is a small business run by one person in Ontario, Canada. We don't have a big security team. We keep things simple, use well-known services, and tell you the truth about how your data is handled. This page lists what we do today and what we don't do yet.
How your data moves
- Encrypted in transit. Every page and every API call on clipjazz.com uses HTTPS. Our site also tells browsers to only use HTTPS with us for a year (HSTS).
- Where it lives. Our website and app run on Netlify. Accounts, ad records and your files are stored in Supabase (a hosted database and file storage) in the US East (N. Virginia) region.
Who can see your stuff
- Only you can read your records. Every table in our database has row-level security turned on. Signed-in users can read only their own profile, products, ads, orders and credit history.
- Internal tables are locked. Tables that only our server uses (payment events, sign-in links, rate limits, logs, analytics) block all access from browsers.
- Your files are private. Your product images and ads are kept in a private storage bucket, not a public one. Our app only sends a file to the signed-in account that owns it.
- Server keys stay on the server. The keys that can bypass these rules are kept in server settings and are never sent to your browser.
Payments
- We never see your card number. When you pay, you go to a checkout page run by Stripe. You type your card there, not on clipjazz.com. Card numbers never reach our servers.
- What we keep: your Stripe customer and payment IDs, what you bought, and how many credits you have.
- Payment messages are checked. Our server only accepts payment updates that carry Stripe's signature.
Signing in
- Passwords are handled by Supabase Auth. We don't store passwords in plain text.
- Email sign-in links work once and expire after 30 minutes.
Abuse protection
- Product links are checked before we fetch them. We refuse links that point to private or internal network addresses, including after redirects.
- Free preview limits. To stop abuse, we limit free previews per account, per store and per network. For the network limit we store a scrambled (hashed) version of your IP address, not the address itself.
AI providers
To make your ad, we send your product photo, title, description and price to fal.ai. fal.ai runs the AI models we use for the video, the scene, the voice, the script and our quality checks. See our AI use policy.
Services we use
- Netlify hosts the website and app.
- Supabase runs our database, sign-in and file storage (US East).
- Stripe handles payments and the billing portal.
- fal.ai runs the AI image, video, voice and text models.
- Resend sends account and order email.
How long we keep data
- We delete product images and the still pictures we make 30 days after we make them. We delete finished ads 90 days after we make them. A daily job does this.
- We keep your account and order history until you ask us to delete your account.
- To delete your account and your files, email support@clipjazz.com.
- Sign-in links stop working after 30 minutes.
- Stripe keeps its own payment records under its own rules.
What we don't have yet
We want to be clear about this:
- We do not have a SOC 2 or ISO 27001 report.
- We have not had an outside security test (penetration test).
- We do not run a paid bug bounty.
If any of this matters for your business, email us and we'll answer your questions honestly.
Report a security problem
If you think you found a security issue, please email security@clipjazz.com.
- Tell us what you found and how to see it.
- Please don't access other people's data, change data, or slow down the service while testing.
- We'll reply within 3 business days, keep you updated, and credit you on this page if you want.
- We won't take legal action against good-faith research that follows these rules.
Our machine-readable contact file is at /.well-known/security.txt.