Privacy policy.

Who this covers

Kutara is made and sold by Orlando Gabriel Robertson, based in Victoria, Australia (“I” and “me” below). This policy covers the website kutara.shop and the parts of the Kutara panel that talk to it. The other services the panel can connect to with your own keys are described under the panel and other services.

What I collect, and why

• A free test key. Your email address, the key’s order id and the date you asked. Used to issue the key, to count the 50 free places, to write to you before test keys stop working on 2026-12-31, and to ask you once how it went. The key itself is not stored; it is generated and handed to you. It contains your email address in plain text, and the panel shows it (“Licensed to you@example.com”).
• Buying. Stripe runs the checkout. Stripe collects your email, card and billing details under its own privacy policy; I never see your card number. From Stripe I receive your email address, the amount and an order id. Your licence is generated from those, shown on your receipt page and emailed to you. I do not keep a separate record of sales: the record lives in Stripe, and the daily report I read is built from it.
• An account, if you make one. Accounts are optional, though the full Trends page asks for one with a key, and are run by Clerk. Clerk stores your email address, your name and profile picture if you sign in with Google, a password if you set one, your two-step verification secret and backup codes, and which devices are signed in. If you use Google, Google tells Clerk your name, email and picture; neither Clerk nor I ever see your Google password. I add two things of my own to the account: the order id and date of your purchase, and the order id and date of a free key if you ask for one while signed in, so the account can show your licence and open the Trends page. So that Clerk is not asked on every visit, the site also remembers, for up to a week, that an account has a key; that note holds the account’s id and nothing else. Deleting the account from Settings removes all of it.
• Updates. Your email address and the date, when you use the updates form or turn on the switch on your account page. Used only to send a short note when something ships. Every message has a link that removes you, and the switch does the same.
• Feedback. Whatever you type, your email address if you add it, and, when it is sent from inside the panel, the panel’s version number and the order id from your licence, so I can tell which build and which key. It is emailed to me and a copy is kept so it can be read and answered.
• Installed copies checking in. Once a day an installed panel asks this site two things: what the latest version is, sending the version it is running, and whether its licence is still valid, sending the order id from the licence. I count these per day and per version. No address, machine name or other identifier is sent or stored.
• Downloads. Counted. Nothing about who.
• Pages being read. When a page opens, my own code counts it. It records which page, the domain of the site you followed a link from (the domain only, never the full address), the country and the city your internet connection is registered to, and whether you are on a phone, a tablet or a computer. To count people rather than page loads, your IP address and browser description are put through a one-way hash together with a secret that is thrown away and replaced every day, so the same person cannot be recognised the next day, and the hash cannot be turned back into your address. Your IP address itself is never written down. No cookie is set, which is why this site still has no cookie banner. If you happen to be signed in, the view is recorded against your account. None of it is sent to any other company: it is counted by this site, for this site. If you would rather not be counted at all, visit kutara.shop/?nostats once and this browser is left out from then on. That saves a single flag in your browser saying so, which is the only thing this site keeps on your device.
• Server logs. Vercel, which hosts the site, keeps standard request logs (IP address, page requested, browser type) for a short time for security and debugging, as every host does. My own code never writes an IP address down; the only thing it does with yours is hash it, as described above.

What I do not do

• No advertising, no pixels, no tracking cookies, and no analytics company: the page views above are counted by this site’s own code and go nowhere else. Nothing here follows you from one site to another, or from one day to the next.
• No selling, renting or sharing of your details with anyone for their own use.
• No profiling or automated decisions about you.
• No data knowingly collected from children (see below).

Who handles it for me

These services process data on my instructions, under their own terms and data-processing agreements. Each sees only what its job needs.

• Vercel hosts the site and runs its code.
• Stripe takes payments and holds the sales records.
• Clerk runs accounts, sign-in and two-step verification.
• Upstash provides the small database that holds test-key signups, the updates list, copies of feedback, the daily counters and the page-view counts.
• Resend sends the receipt, feedback and update emails.
• Google, only if you choose to sign in with Google.
• YouTube, only if you press play on a video embedded on the site. The player loads from YouTube’s privacy-enhanced domain and nothing loads before you press play.
• Apple, Deezer, Google and YouTube, only on the Trends and Outliers pages. The charts and the list of searches are fetched by this site, not by you; but the album art, the thumbnails and the 30-second previews load from their servers when the page is open, and a preview streams from them when you press play. Each of them sees an ordinary request from your browser, as any page showing their pictures would cause.

The Trends and Outliers pages use the YouTube API Services. What YouTube sees and does is covered by the YouTube Terms of Service and the Google Privacy Policy. Those pages ask YouTube only for public numbers about public videos, never about you. To stop one visitor using up everyone’s daily searches on Outliers, the number of fresh searches from your address is counted for an hour under a salted hash that cannot be turned back into the address, then deleted. Ideas you save there stay in your own browser.

Where it is stored

Mostly in the United States, where these services run. If you are in the EU or the UK, that is a transfer outside your region; it rests on the providers’ standard contractual clauses and, where a provider holds it, Data Privacy Framework certification.

How long it is kept

• Test-key signups, feedback copies and the updates list: until you ask me to delete them or you unsubscribe. Each list holds at most 5,000 entries, so the oldest drop off as new ones arrive.
• Daily counters of downloads, check-ins and page views: 45 days.
• On Outliers: search results for a few hours, what each channel usually gets for a day, a video’s view count for three days, and the hourly search count for an hour.
• The list of recent page views the dashboard shows: the last 300, after which each drops off as newer ones arrive. The daily secret that a visitor’s hash is made with: two days.
• Account data: until you delete the account.
• The note that an account has a key: a week at most, then it is checked again.
• Sales records: in Stripe, for as long as tax law requires (at least five years in Australia).
• Emails between us sit in my inbox as any correspondence does. Ask, and I will delete them.

Your rights

You can ask me for a copy of what I hold about you, have it corrected or deleted, object to or restrict a use of it, and take back any consent you gave, at any time. Unsubscribing is one click in any update email; deleting an account is one button in Settings; for anything else, write to me and I will answer within 30 days. I may ask you to write from the address the data is held under, so that nobody else can ask on your behalf.

As a small business I may fall under the small-business exemption in the Privacy Act 1988 (Cth). I follow the Australian Privacy Principles regardless. If you are in the EU or the UK, the GDPR or UK GDPR gives you these rights in law, and I honour them for everyone, wherever you are.

If you think I have got something wrong and I have not put it right, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), to the UK Information Commissioner’s Office (ico.org.uk), or to the data-protection authority in your EU country.

Security

Everything travels over HTTPS. Keys and secrets live on the server, never in the browser. Licences are signed, so they cannot be forged. Passwords and two-step verification are handled by Clerk, which is built for exactly that. No system is perfectly secure; if I learn of a breach that affects you, I will tell you promptly.

Children

Kutara is not directed at children. Please do not use the site, request a key or create an account if you are under 16. If I learn that a child’s details have been collected, I will delete them.

The panel and other services

Kutara runs on your computer. Transcription for silence removal and b-roll happens on your machine; your audio is not uploaded. When you search for clips, the panel talks directly to the library you are searching (for example Openverse, Wikimedia Commons, Pixabay, Pexels, Freesound or GIPHY): your search words go to them under their own privacy policies, and where a key is needed it is your own. If you turn on AI b-roll or AI-drawn pictures, the panel sends the sentences of your transcript, and any subject you typed, to the provider you chose, OpenAI or Anthropic, using your own API key. Their policies apply to that. I never see that content or your keys, which stay on your machine.

Changes

The date at the top is when these words last changed. I will not use your details for a new purpose without telling you first.

Contact

To get in touch about your data, email orlando.grobertson@gmail.com or use the feedback page. You can also reply to any email you have had from Kutara.

See also the cookie policy and the terms of use.