Privacy Policy

1. Who we are

Online Timelapse ("we", "us") operates onlinetimelapse.com, a service for turning a sequence of photographs into a video. This policy explains what we collect, why, who else receives it, and what you can ask us to do about it. It applies to the website and everything you do through it.

The service is operated from Australia and hosted in the United States. For questions or requests, use the contact page.

2. What we collect

If you create an account: your email address, username, password (stored hashed, never in readable form), and anything you choose to add to your profile — first and last name, phone number, biography, profile picture, and social links. If you sign in with Google, we receive your Google account identifier and email address instead of a password.

Content you upload: your photographs, any soundtrack or custom watermark you add, the videos we render for you, and the titles and descriptions you write. We also generate and store smaller copies of your photographs — thumbnails and intermediate render-sized versions — because rendering directly from full-resolution originals is not practical.

Billing: your credit balance, purchase history, and a Stripe customer identifier. We never see or store your card details — those go directly to Stripe and never reach our servers.

Support: messages you send us and the email address you send them from.

Technical data: IP address, browser and device characteristics, and server logs, used to operate the service and prevent abuse.

3. Device identification, storage, and analytics

This section covers the things that are easy to gloss over, so we are being specific.

Device fingerprinting. You can make a timelapse without an account. To make that work, we generate an identifier from your browser and device characteristics and use it to remember which timelapses are yours. This is a form of device identification that does not rely on cookies. We use it only to associate anonymous work with the browser that created it, and to prevent abuse of the free tier. It is never sent to any analytics or advertising service. When you create an account and claim your work, the timelapses move to your account.

Browser storage. We store data in your browser's local storage to keep you signed in, preserve a timelapse you are part-way through, remember a render in progress so you can close the tab, and record your privacy choice. None of it is used for advertising. Clearing it will sign you out and may lose an unsaved draft.

Analytics. We use two services to understand how the site is used — which pages people visit, where they get stuck, and which features are used:

• PostHog, hosted in the United States, which records page views and interactions such as clicks and form submissions.
• Google Analytics, via Google Tag Manager, which records page views and interactions such as scrolling, outbound clicks and file downloads.

We do not send your photographs, videos, email address, name or password to either service, and we do not send the device fingerprint described above. Once you are signed in, events are associated with your numeric account identifier so we can understand how the product is used across a session. Web addresses that contain a security token — email verification and password reset links — are stripped before anything is recorded, so those tokens never reach an analytics provider.

Neither service is used for advertising, and we have disabled the settings that would share our analytics data with Google for its own purposes.

Your choice. Where the law requires your consent before we may do this — which includes the European Economic Area and the United Kingdom — we ask before any analytics loads, and nothing is sent unless you agree. Elsewhere, analytics runs on the basis of this notice and our legitimate interest in improving the service. Either way you can change your mind at any time using the Privacy settings link in the site footer, and we will stop.

reCAPTCHA. Our contact form is protected by Google reCAPTCHA, which receives your IP address and interaction data in order to distinguish people from automated submissions. It is governed by Google's own privacy policy.

4. Timelapses made without an account are public

Please read this one carefully. If you create a timelapse without signing in, it is public by default. That means:

• It can be viewed by anyone who has its share link, without signing in.
• It may appear among the featured videos on our home page.

When you create an account and claim a timelapse you made anonymously, it becomes private, and its previous share link stops working. If you have an account, you control whether each timelapse is public or private, and public profiles at/u/your-username show only what you have chosen to make public.

Do not upload anything you would not want to be publicly visible unless you are signed in and have set it to private.

5. Who else receives your data

We do not sell your personal information, and we do not share it for advertising. We use the following providers to run the service:

• Amazon Web Services (United States) — hosting, storage of your photographs and videos, databases, and outbound email.
• Stripe — payment processing. Stripe receives your payment details directly; we receive only a customer reference and the outcome.
• Google — sign-in with Google, reCAPTCHA on the contact form, and Google Analytics.
• PostHog (United States) — product analytics.

We may also disclose information where the law requires it, or where it is necessary to investigate abuse, enforce our Terms & Conditions, or protect the rights and safety of users.

6. Where your data is processed

Our servers, storage and analytics are located in the United States. If you are in the European Economic Area, the United Kingdom, Australia or anywhere else outside the US, using the service means your data is transferred there and processed under US law, which may offer protections different from those in your own country.

Where such transfers require a legal safeguard, we rely on the standard contractual clauses and data processing terms published by the providers named in section 5.

7. How long we keep things

• Account information: for as long as your account exists.
• Photographs, videos and soundtracks: until you delete them or ask us to close your account. Note that copying a timelapse re-uses the original photographs rather than duplicating them, so deleting one copy does not remove the underlying files while another copy still refers to them.
• Purchase records: retained as long as required for tax and accounting obligations.
• Emails we send you: we retain a log of outbound messages, including their content.
• Purchased credits expire 365 days after purchase; complimentary welcome credits expire sooner, as stated when they are granted.
• Analytics data: retained according to each provider’s configured retention period, and not longer than needed to understand product usage.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, obtain a copy in a portable form, object to or restrict certain processing, and withdraw consent you previously gave. If you are in the EEA or UK you also have the right to complain to your national data protection authority.

Some of this you can do yourself: edit or remove your profile information in your account settings, delete individual timelapses, make a timelapse private, and turn analytics off with the Privacy settings link in the footer.

Account deletion is not yet self-service. To have your account and its content deleted, contact us and we will action it within 30 days. We will tell you if anything must be retained for legal or accounting reasons, and why.

We do not use your data to make automated decisions with legal or similarly significant effects.

9. Security

Passwords are stored hashed. Traffic to the site is encrypted in transit. Your photographs and videos are stored privately and served through short-lived signed links rather than public web addresses, so they are not accessible by guessing a URL — except for timelapses you or the anonymous flow have made public, as described in section 4.

No service can promise perfect security, and we do not. If a breach affects your personal data, we will notify you and the relevant regulator where the law requires it.

10. Children

The service is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the service changes. The date at the top always reflects the current version. If a change materially affects how we handle your data, we will ask for your consent again where the law requires it.

12. Contact

For any privacy question or request, use the contact page. Your use of the service is also governed by our Terms & Conditions.