Legal

Privacy Policy

Last updated 1 September 2026. This describes what Pentimento actually does, written from the code rather than from a template. Pentimento is operated by Matthew Carolan, a sole proprietor in Massachusetts, United States.

The short version

We collect your email address, the videos you upload, and the transcripts made from them. We run no analytics, no tracking pixels and no advertising, and we set no third-party cookies. We do not sell your data, and we do not use your videos to train anything. The one thing worth knowing: producing captions means sending your video to AssemblyAI, which is explained below.

What we collect

Your account. Your email address and a password. Passwords are hashed by Supabase before storage — we cannot read yours, and neither can anyone who reaches the database.

Your videos. The files you upload, the streaming renditions we make from them, any edits you export, and the transcript and caption file produced from the audio.

Cookies. Two kinds, both strictly necessary. A signed cookie identifies a trial library recorded before you had an account, so it can be moved to your account when you sign up. Supabase sets cookies to keep you signed in. Both are first-party. There are no advertising or analytics cookies, so there is no consent banner — because there is nothing to consent to.

IP addresses. Seen by our host on every request and used for rate limiting, which is how the upload endpoint is protected from abuse. We do not build profiles from them.

If you join the early access list. Your email, plus whatever figures you chose to enter in the savings calculator — your current bill, video count, monthly views and library size. Those are your estimates, not measurements we took.

The embed scanner keeps nothing

When you paste a website address into our migration scanner, we fetch that site’s public pages, list the videos embedded on them, and return the result to your browser. We do not store the address, the results, or anything about the site. Close the tab and it is gone. You do not need an account to use it, and we do not ask for your email first.

Who else sees your data

These are the only companies involved in running Pentimento. Each one is here because something would not work without it:

We do not sell your data or share it with advertisers. If that list ever changes we will update this page, and we will email you if the change affects what happens to your videos.

Transcription, said plainly

Automatic captions and edit-by-transcript both need your speech turned into text, and we do not do that ourselves. When a video finishes uploading we give AssemblyAI a temporary link to it, they download it, transcribe it, and return the words and their timings. The link expires after an hour.

This means the audio of every video you upload is processed by a third party. If that is not acceptable for a particular video, do not upload it — we do not currently offer a way to opt one video out of transcription, and we would rather tell you that than let you find out later.

How long we keep things

Videos stay until you delete them. Deleting a video removes the original, every streaming rendition, every exported edit and its captions — not just the copy you were looking at. We have tested that it removes all of it, because a “deleted” video that is still playable to anyone holding a link is not deleted.

Account data stays until you ask us to delete it. Early access list entries stay until we launch or you ask us to remove yours.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it entirely. Email us and we will do it. We do not currently have a self-serve delete button — that is a gap we intend to close, and until we do, a human handles it.

Depending on where you live you may have additional rights under the GDPR or the CCPA. We will honour those requests regardless of where you live, because maintaining two standards would mostly mean treating some customers worse.

Security

Video files are not publicly readable. Every request for one goes through a check that you are allowed to see it, and is then served by a link that expires. Videos marked private are readable only by you. Traffic is encrypted in transit.

We are a young service and we will not pretend to guarantees we cannot back. If we ever discover a breach affecting your data, we will tell you what happened and what we know, promptly and without minimising it.

Children

Pentimento is not intended for anyone under 13, and we do not knowingly collect their information.

Contact

Any privacy question, or a deletion request: matthew@pentimentohq.com. A person reads it.