Privacy Policy
Last updated: July 4, 2026
Controller
OneTapCut is provided by Thomas Hoche / Joshua Tree Labs, Am Carlusbaum 11, 65812 Bad Soden am Taunus, Germany. Contact: [email protected].
Scope
This policy applies to the OneTapCut app for iPhone, iPad and Mac, the OneTapCut website at https://joshua-tree-labs.com/dronecut/ and the linked support and legal pages. The German version is authoritative; translations are provided for convenience.
Local-first processing
OneTapCut is local-first. Import, local analysis, scene selection, preview, music mixing and export normally run on the device. Original videos are not automatically transferred to Joshua Tree Labs. Optional Premium AI uses reduced analysis data only.
Data processed in the app
When you select videos, OneTapCut locally processes file names or media references, duration, resolution, frame rate, technical video metadata, thumbnails, reduced storyboard/proxy frames, optical-flow metrics, quality scores, activity profile, edit and transition settings, music selection, project state and export files. This data stays on your device unless you enable Premium AI, contact support or share files yourself.
Photos, files and exports
OneTapCut accesses only videos you choose from Photos or Files. Finished videos are saved to Photos or shared only when you explicitly trigger it. Videos may contain people, places, licence plates or other personal information; you are responsible for using such content lawfully.
Premium AI and OpenRouter/Railway
When Premium AI is enabled, OneTapCut does not send original videos. It sends compact scene candidates: clip ID, time window, duration, activity profile, cut technique, optical-flow and quality metrics, local tags and heavily reduced storyboard/proxy JPEG images. Data is sent either directly from your device to OpenRouter when you store your own OpenRouter API key, or through the OneTapCut AI proxy hosted on Railway to OpenRouter and the selected vision model. The proxy protects the server key, rate-limits requests and converts responses into OneTapCut's format.
OpenRouter API key
If you store your own OpenRouter API key, it is kept locally in the iOS/macOS Keychain. Joshua Tree Labs does not receive that key while the app communicates directly with OpenRouter. You can delete the key in Settings.
Subscriptions, StoreKit and AI credits
Premium AI and Power AI are processed through Apple In-App Purchase / StoreKit. Apple handles payment, invoices, cancellation, refunds and taxes. OneTapCut reads StoreKit transaction state, product IDs and entitlement status to unlock premium features and monthly AI credits. Joshua Tree Labs receives no full payment data, no credit card details and no Apple ID.
Website, hosting and technical logs
The OneTapCut website is hosted on Cloudflare Pages. When you visit it, Cloudflare may process IP address, time, URL, user agent, referrer, error and security events in technical logs. The AI proxy runs on Railway; technical request metadata may be processed there for operation, security and debugging. Logs are kept limited where possible and are not used for advertising or profiling.
Purposes and legal bases
Local app processing provides the requested video editing service (Art. 6(1)(b) GDPR). Premium AI, StoreKit status and AI credits are processed for contract performance and abuse prevention (Art. 6(1)(b) and (f) GDPR). Website and server logs serve security, stability and debugging (Art. 6(1)(f) GDPR). Support data is processed to answer your request (Art. 6(1)(b) or (f) GDPR). Where consent is required, you may withdraw it for the future.
Recipients and international transfers
Recipients may include Apple (StoreKit, App Store), Cloudflare (website), Railway (AI proxy), OpenRouter and the selected vision-model provider. Processing may occur outside the EU/EEA, especially in the United States. Where required, transfers rely on adequacy decisions, standard contractual clauses or other appropriate safeguards. Provider privacy policies apply additionally to their processing.
Retention
Project and export data remains local until you delete it, remove the project or uninstall the app. Support emails are retained as long as needed for handling and legal records. Technical server logs are retained only as long as needed for operation, security and error diagnosis. AI requests are not used to build a OneTapCut training dataset from your private videos.
Children and sensitive content
OneTapCut is not specifically directed at children. Minors should use the app only with consent and supervision from a parent or guardian. Do not upload, share or export content if you do not have the rights or if it would violate privacy, personality rights or drone-flight rules.
Tracking and advertising
OneTapCut contains no advertising SDKs and no cross-app tracking within Apple's App Tracking Transparency framework. The app does not show an ATT tracking prompt. We do not sell personal data.
Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Local project and export data can be deleted directly in the app, Photos, Files or by uninstalling the app. For support or server-side data, contact [email protected]. You may also lodge a complaint with a data protection authority.
Changes and contact
We update this policy when app features, AI providers, server operations or legal requirements materially change. The current version is available on the OneTapCut website and is bundled in the app as an offline snapshot. Contact: [email protected].