Momentum / cinemaOS
Beta 2 — interim

Privacy / Interim Beta 2

Your work stays yours.

Interim Beta 2 privacy notice — effective 25 July 2026 and in force, but subject to final revision before general release. A final version will replace this document. Continued use of cinemaOS after the final version is published constitutes acceptance of that final version.
Version identifier: privacy-beta2-2026-07-25. Interim status does not reduce your rights under the GDPR, which are described in section 12.

This notice replaces the private-beta notice of 19 July 2026 (privacy-beta-2026-07-19) for accounts that accept this version. It covers paid Beta 2 subscriptions as well as trials. It describes what the Momentum account and billing services process; the cinemaOS application itself processes your creative work locally, as set out in sections 3 and 4.

1. Controller and contact

The controller is Julien Kerknawi, trading as Momentum Studios, Belgian enterprise number 0648.946.826, VAT BE0648946826, registered establishment address Jules Van Biesbroeckstraat 156, 9050 Gent, Belgium. Privacy requests: privacy@mntm-studios.com. Support: support@mntm-studios.com.

[OPERATOR: confirm whether a data protection officer or an Article 27 representative must be designated for this processing and, if either is required, publish the contact details here. None is asserted in this interim version.]

2. What this notice covers

Two different things happen in cinemaOS, and they are governed separately. Your editing work is processed on your Mac and is not sent to us. Your account, entitlement and billing are processed on our servers because they cannot work otherwise. Sections 3 and 4 describe the first; sections 5 onwards describe the second.

3. Your creative work stays on your Mac

cinemaOS does not upload project files, media, frames, transcripts, prompts or model output. Editing, the JARED assistant and its vision components, semantic retrieval, Whisper transcription, speaker diarization, subject and person segmentation, sky replacement, stabilization, translation and all bundled model inference execute locally on your Mac. The local JARED inference server binds only to loopback, uses a random port and a per-launch key, and unloads after inactivity; it is not exposed to your local network.

We do not use your projects, media, transcripts or prompts to train or improve models, for advertising, for anti-piracy scoring or for fraud scoring, and we do not sell personal data. There is no analytics SDK, no session replay and no screen recording in the application or on this portal.

4. When cinemaOS uses the network

The application makes a network request only for a feature that needs one:

  • creating an account, signing in, verifying or resetting an account;
  • activating or releasing a Mac and refreshing its signed access lease;
  • loading account, education, referral, subscription or billing status;
  • opening a Stripe checkout or billing-portal session that you explicitly requested;
  • completing the hosted anti-abuse security check used by account actions;
  • checking for an update or downloading an update you accept;
  • downloading an optional model pack you request; or
  • opening a product, legal, privacy, support or email link.

Payment-card details are entered with Stripe and do not pass through cinemaOS.

5. Data we process

  • Account data: email address, password verifier, accepted legal versions and optional marketing consent.
  • Security data: hashed session and token identifiers, coarse request-security identifiers, device name, device public key fingerprint, sign-in and audit events.
  • Entitlement data: plan, trial and referral dates, education review status, active devices and signed licence generation.
  • Billing data: Stripe customer and subscription identifiers, plan, status and paid-through date. To meet VAT obligations, the billing country and address you enter at checkout and any VAT identification number you provide are processed and appear on invoices. Momentum does not receive or store full card details.
  • Support and optional crash data: messages you send us and, only after separate opt-in, scrubbed technical error and crash information.

6. Purposes and legal bases

  • Contract: create and secure your account, deliver trials and plans, activate devices, issue entitlements, take payment and provide support.
  • Legitimate interests: prevent abuse, protect accounts, diagnose service reliability and maintain an audit trail, balanced against your rights.
  • Legal obligations: accounting, VAT and invoicing, fraud response and valid authority requests.
  • Consent: marketing communications and optional remote crash reporting. Consent can be withdrawn at any time without affecting core account use, and withdrawal does not affect processing carried out before it.

7. Crash reporting requires a separate, explicit decision

Crash reporting is off unless you choose it, report by report. After a crash the report is discovered and scrubbed on your Mac. The consent window shows what would be sent and starts with no send action selected. Nothing is transmitted until you choose Send This Report. If the crash service is unavailable, the report is not silently rerouted.

A transmitted crash payload excludes project names, media, local paths, your email address, credentials, logs and free-form exception reasons. It can include the release channel, the application and macOS versions, a pseudonymous installation identifier and sanitized stack-frame symbols needed to diagnose the crash. Crash reports are retained for 30 days.

8. Diagnostic bundles stay on your Mac

The Report a Problem flow creates a support bundle on your Mac. It does not upload or email anything, and the preview identifies the contents before creation. A bundle can contain application and macOS version, hardware and free-disk summary, runtime logs, job and export history, recent crash reports, project counts and health state, and onboarding progress if you include it. Logs and job titles can contain project names, filenames and local paths. Bundles exclude media, rendered frames, transcript text, JARED prompts, passwords, tokens and private device keys. You decide whether and how to share the bundle you created. Get Started and mission progress are stored locally in UserDefaults, and the capped local funnel log stays on your Mac unless you include it in a bundle.

9. Processors and recipients

We use three processors, each under its data-processing terms:

  • Cloudflare — account portal and Worker hosting, the D1 account database, private opt-in crash-report storage and release hosting.
  • Stripe Payments Europe Ltd — payment processing, subscription billing, invoicing and tax calculation. Stripe is a controller in its own right for parts of this processing under its own privacy policy.
  • Resend — transactional email such as verification, password reset and account notices.

There are no other subprocessors, no third-party crash-reporting SDK, no advertising network and no analytics provider. We disclose data to authorities only where legally required, and to professional advisers under confidentiality where necessary.

[OPERATOR: before the final version, confirm the executed data-processing agreement and the current subprocessor list for each of Cloudflare, Stripe and Resend, and publish a stable link to a maintained subprocessor page. Add any new processor to this list before it starts processing.]

10. International transfers

Account data and opt-in crash reports are stored in EU-jurisdiction Cloudflare infrastructure. Where a provider processes personal data outside the EEA, transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework, with supplementary measures where required.

[OPERATOR: verify the current transfer mechanism relied on for each of the three processors and confirm the storage region configured for each service before the final version.]

11. Retention

Unused verification links 30 minutes; reset links 15 minutes; access sessions 15 minutes; rotating refresh sessions 30 days; expired security records pruned on a scheduled basis; optional scrubbed crash reports 30 days; raw education evidence deleted 30 days after a decision, or after 90 days if an application remains incomplete; education decision metadata kept for the account lifetime plus 24 months. Billing, invoice and tax records are kept for the periods Belgian statutory law requires, which is why some billing data survives account deletion. Other account data is deleted within 30 days of a deletion request.

12. Your rights

Subject to the applicable conditions, you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent. Contact privacy@mntm-studios.com. Identity verification may be required. Verified requests receive a response within one month, extendable where the law allows. You may complain to the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be) or to the supervisory authority where you live or work.

13. Security

Passwords are salted, peppered and one-way derived. Bearer and one-time tokens are stored as keyed hashes. Device proof uses P-256 keys; offline entitlements use server-signed ES256 claims. Production uses encrypted transport, rate limits, human verification, least-privilege secrets and signed application and update releases. Email links carry one-time secrets in a browser-only URL fragment so they never reach portal access logs. No system is risk-free; confirmed incidents are handled under the applicable notification rules.

14. Marketing and children

Transactional account, billing and security messages are required to operate the service and are separate from marketing. Marketing requires affirmative consent and always carries an unsubscribe route. cinemaOS is professional software, is not directed to children, and you must be at least 18 years old to hold an account.

15. Automated decisions and changes

Device, rate-limit and entitlement rules can automatically reject an individual action, but material education and abuse decisions receive human review. We do not carry out profiling that produces legal effects concerning you. Updates to this notice are versioned and dated, and are presented again where the law requires. This interim version will be replaced by a final version with a new identifier.